什么是 xuanjian？What is xuanjian?
XuanJian（读作「玄鉴」，仓库代号 xuanjian）把传统扫描器、AI 辅助分析与人类渗透测试员的经验编码进同一套可执行的智能体。XuanJian (pronounced "Xuán Jiàn", repo codename xuanjian) encodes traditional scanners, AI-assisted analysis, and human pentester expertise into one executable agent.
它不是签名扫描器Not a signature scanner
xuanjian 像人一样工作：驱动浏览器、拦截并改写流量、推理业务逻辑、构造 payload、验证漏洞、抑制误报——但永远不会忘记某一步测试。xuanjian works like a human: drives a browser, intercepts and rewrites traffic, reasons about business logic, crafts payloads, verifies vulnerabilities and suppresses false positives — yet never forgets a single test step.
每个发现都可归因Every finding is attributable
每个漏洞都归属到具体的 (endpoint × 漏洞域) 对，并在稀疏覆盖矩阵上追踪状态，确保不漏测、每个端点都有结论。Every vulnerability maps to a concrete (endpoint × vuln-domain) pair and is tracked on a sparse coverage matrix — guaranteeing no endpoint is left untested.
自主验证，而非报告即信Self-verifying, not report-and-trust
独立的 LLM 审计员核验真实危害，检测层硬规则在检测当下就拦截误报，即使不开危害验证的 FAST 模式也保持干净。An independent LLM auditor validates real impact, while detection-layer hard rules block false positives at detection time — staying clean even in FAST mode without harm validation.
可生长的技能库A growable skill library
把你的渗透测试经验编码为 SKILL 方法论，xuanjian 会随你一起成长；内置 discovery / exploit 技能库均为 MIT 许可。Encode your pentest experience as SKILL methodologies and xuanjian grows with you; the built-in discovery / exploit skill libraries are MIT-licensed.
核心能力Core Capabilities
xuanjian 覆盖从单 URL 到凭据登录、从批处理到实时的端到端渗透测试。xuanjian covers end-to-end pentesting from a single URL to credentialed logins, from batch to realtime.
| 能力Capability | 说明Description |
|---|---|
| URL 端到端渗透URL end-to-end pentest | 输入目标 URL —— 爬虫 → 分析 → 测试 → 报告，全自动。Give it a target URL — crawl → analyze → test → report, fully automated. |
| 凭据式渗透Credentialed pentest | 输入用户名/密码 + URL，自动登录后测试。Provide username/password + URL; it logs in and tests automatically. |
| 凭据注入Credential injection | 输入 Cookie / JWT / Header，绕过登录直接测试。Pass Cookie / JWT / Header to test without logging in. |
| 手动登录捕获Manual login capture | Playwright 有头模式，交互捕获 Cookie/Token/Authorization，支持验证码。Headed Playwright mode to interactively capture Cookie/Token/Authorization, including CAPTCHAs. |
| SPA 智能降级SPA smart fallback | 自动识别 Vue / React / Angular，链接不足时切换手动浏览 + 流量录制。Auto-detects Vue / React / Angular and switches to manual browsing + traffic recording when links are scarce. |
| 验证码 OCRCAPTCHA OCR | 内置图片验证码 OCR，复杂验证码支持人工介入。Built-in image CAPTCHA OCR, with human-in-the-loop for complex ones. |
| 自定义 SKILLCustom SKILL | 把你的渗透测试经验编码为方法论，xuanjian 持续成长。Encode your pentest experience as methodologies; xuanjian keeps growing. |
两种正交的扫描维度Two orthogonal scanning dimensions
xuanjian 的「扫描模式」由两个正交维度决定，避免语义混淆。xuanjian's "scan mode" is defined by two orthogonal dimensions to avoid semantic confusion.
维度一 · 扫描深度Dimension 1 · Scan depth
FAST 无 LLM STANDARD 轻量 DEEP 全链路 SMART 自适应
维度二 · 编排方式Dimension 2 · Orchestration
Batch 整站 Realtime 边点边测 Packet 单包全检
工程化特性Engineering features
多会话管理Multi-session
并发运行多个渗透任务（含并发上限）。Run multiple pentest tasks concurrently (with a concurrency cap).
流量管理Traffic manager
查看、搜索、重放所有 mitmproxy 流量。View, search and replay all mitmproxy traffic.
决策回放Decision replay
逐步回退任意渗透动作的 LLM 决策链。Step back through the LLM decision chain of any pentest action.
经验沉淀Experience learning
从历史发现自动学习，复用至相似目标。Auto-learn from past findings and reuse them on similar targets.
合规报告Compliance reports
内置合规模板，含漏洞统计与修复跟踪。Built-in compliance templates with vuln stats and remediation tracking.
热切换模型Hot-swap models
10+ LLM 提供商，Web UI 内一键切换。10+ LLM providers, switchable in one click inside the Web UI.
八阶段方法论（无人在环）Eight-stage methodology (human-out-of-the-loop)
xuanjian 的流水线由真实的 core.* 模块驱动，每个阶段都可独立验证。xuanjian's pipeline is driven by real core.* modules; each stage is independently verifiable.
站点探索Site exploration
爬虫 + JS 分析 + 流量捕获 + SPA 降级（AutoCrawler）。Crawl + JS analysis + traffic capture + SPA fallback (AutoCrawler).
功能分析Function analysis
识别功能 → 生成测试清单（Main Agent + AnalyzeWorker）。Identify features → generate a test checklist (Main Agent + AnalyzeWorker).
业务理解Business understanding
语义分析 → 攻击假设（analyze_business）。Semantic analysis → attack hypotheses (analyze_business).
并行漏洞测试Parallel vuln testing
HTTP 子智能体 + 浏览器项并行执行（Orchestrator）。HTTP sub-agents + browser items run in parallel (Orchestrator).
业务对账Business reconciliation
清单 × 业务理解交叉验证（reconcile_loop）。Checklist × business understanding cross-validation (reconcile_loop).
补测Supplemental testing
对新发现的 API 自动补测（SupplementalTestAgent）。Auto-test newly discovered APIs (SupplementalTestAgent).
危害验证Harm validation
三态闭包裁决 + 误报抑制（HarmValidator / verdict）。Three-state closure adjudication + FP suppression (HarmValidator / verdict).
报告聚合Report aggregation
覆盖矩阵 + 漏洞详情 + 修复建议 + PoC（Main Agent）。Coverage matrix + vuln details + remediation + PoC (Main Agent).
下一代编排引擎 core/testflow/（opt-in，环境变量 XUANJIAN_TESTFLOW_V2）围绕 8 大风险域（authz / csrf / upload / ssrf / injection / file / business / config）与稀疏覆盖矩阵、七道门控（G0–G6）进一步 deterministic 化测试。The next-gen engine core/testflow/ (opt-in, env XUANJIAN_TESTFLOW_V2) further determinizes testing around 8 risk domains (authz / csrf / upload / ssrf / injection / file / business / config) with a sparse coverage matrix and seven gates (G0–G6).
漏洞覆盖Vulnerability coverage
浏览器驱动 + 流量拦截 + LLM 深度分析，自动发现并验证：Browser-driven + traffic interception + deep LLM analysis, automatically discovering and verifying:
Web 注入Web injection
SQL 注入（内置 Fuzz 引擎）、XSS（反射/存储/DOM，13 步专用引擎）。SQL injection (built-in fuzz engine), XSS (reflected/stored/DOM, dedicated 13-step engine).
认证授权Auth & authorization
IDOR、认证绕过、越权访问。IDOR, auth bypass, privilege escalation.
服务端Server-side
SSRF（含 OOB 带外验证 + 危害证明）、信息泄露、条件竞争。SSRF (with OOB validation + proof-of-harm), info leakage, race conditions.
业务逻辑Business logic
验证码绕过、用户枚举、业务逻辑分析。CAPTCHA bypass, user enumeration, business-logic analysis.
其他Others
CSRF、XXE、SSTI、文件上传、路径遍历、命令注入。CSRF, XXE, SSTI, file upload, path traversal, command injection.
亮点Highlights
危害验证达 SRC 标准；自动生成可运行 PoC；可插拔自定义 SKILL。SRC-grade harm validation; auto-generated runnable PoCs; pluggable custom SKILLs.
误报防护（FP 铁律）False-positive guard (the FP iron rules)
xuanjian 借鉴 api-pentest-extension 的 FP 判定铁律，由检测层（而非事后 LLM 仲裁）强制执行确定性过滤：xuanjian borrows the FP iron rules from api-pentest-extension, enforced deterministically by the detection layer (not post-hoc LLM arbitration):
| 层级Layer | 机制Mechanism | 覆盖Covers |
|---|---|---|
| 业务错误码解析Biz error-code parse | HTTP 200 但 code:500/未登录 → 不报越权HTTP 200 but code:500/not-logged-in → no authz report | 越权 / CORS / 信息泄露IDOR / CORS / info leak |
| 空数据检测Empty-data detection | 200 但 data:null/[] → 不报数据泄露200 but data:null/[] → no data-leak report | 越权 / CORSIDOR / CORS |
| WAF 拦截页识别WAF block-page ID | 403/418/429 + 拦截关键词 → 跳过403/418/429 + block keywords → skip | 路径遍历 / 命令注入 / SSRFPath traversal / cmd injection / SSRF |
| SQL 布尔盲注 3 层校验SQL bool-blind 3-layer | True≈基线 且 False=WAF/报错 → 跳过True≈baseline and False=WAF/error → skip | SQL 注入SQL injection |
| 时间盲注二次复现Time-blind re-run | 延迟 ≥3.5s 且可复现，单次命中视为抖动Delay ≥3.5s and reproducible; a single hit is treated as jitter | SQL 注入SQL injection |
| XSS 可执行上下文XSS exec context | 落在 HTML 注释/纯 JSON → 降级为弱证据Lands in HTML comment / raw JSON → downgrade to weak evidence | XSSXSS |
| 证据质量分级Evidence grading | 所有发现标记 body_confirmed/header_onlyAll findings tagged body_confirmed/header_only | 全部All |
多种入口Multiple entry points
Web UIWeb UI
对话式交互、多会话、实时报告、凭据注入登录。Conversational UX, multi-session, live reports, credential-injection login.
Burp Suite 插件Burp Suite extension
右键发送 + 被动扫描 + SSE 反馈。Right-click send + passive scan + SSE feedback.
REST APIREST API
第三方集成与 CI/CD 流水线。Third-party integration and CI/CD pipelines.
快速开始Quick Start
要求：Python ≥ 3.10、Git、约 500MB 空间（Playwright Chromium）。Requirements: Python ≥ 3.10, Git, ~500MB disk (Playwright Chromium).
方式一 · 一行命令Method 1 · One-liner
# macOS / Linux
git clone https://github.com/yzdily/xuanjian.git
cd xuanjian
./start.sh
# Windows (PowerShell)
git clone https://github.com/yzdily/xuanjian.git
cd xuanjian
.\start.ps1方式二 · 手动步骤Method 2 · Manual steps
git clone https://github.com/yzdily/xuanjian.git
cd xuanjian
python -m pip install -r requirements.txt
python -m playwright install chromium
cp .env.example .env # edit .env with your LLM API Key
python start.py # open http://localhost:7788方式三 · DockerMethod 3 · Docker
git clone https://github.com/yzdily/xuanjian.git
cd xuanjian
docker compose up -d # visit http://localhost:7788资源与链接Resources & links
GitHub 仓库GitHub repo
github.com/yzdily/xuanjian — 源码、Issue、Release。source, issues, releases.
架构文档Architecture
ARCHITECTURE.md — 模块级流水线全图。module-level pipeline map.
中文文档Docs (中文)
README.zh.md — 中文说明。Chinese guide.
技能贡献指南Skill guide
CONTRIBUTING_SKILLS.md — 编写你的 SKILL。write your own SKILL.
下一代编排Next-gen engine
法律声明Legal
DISCLAIMER.md — 仅限合法授权测试。authorized testing only.
想了解更多关于 xuanjian（玄鉴）的实战与案例？欢迎 Star 仓库并阅读上述文档。Want more war-stories and cases about xuanjian (玄鉴)? Star the repo and read the docs above.