ReAct-Reasoning-Loop
SmarterPentester nutzt den ReAct-Ansatz (Reasoning + Acting). Jede Scan-Aufgabe durchläuft einen iterativen Zyklus:
Observe → Think → Act → Reflect → Observe → ...
Der Agent beobachtet Ziel-Systeme (Observe), bildet Hypothesen über Schwachstellen (Think), führt gezielte Tests aus (Act) und evaluiert Ergebnisse (Reflect). Bei Bedarf startet ein neuer Zyklus. Bis zu 50 Iterationen pro Scan. Mit Timeout nach 300 Sekunden.
API-Beispiel: Vulnerability-Scan starten
POST /api/v1/agents/smarterpentester/scan
Content-Type: application/json
Authorization: Bearer <JWT>
{
"action": "start_vuln_scan",
"target": "https://api.techsphere.example",
"scan_profile": "owasp_top10",
"scope": ["rest_api", "graphql", "websocket"],
"depth": "thorough",
"options": { "fuzz_undefined_endpoints": true }
}
JSON-Response
{
"status": "success",
"scan_id": "SCN-20260711-0042",
"data": {
"target": "https://api.techsphere.example",
"scan_profile": "owasp_top10",
"duration_ms": 84200,
"findings": [
{
"id": "FND-001",
"type": "SQL_Injection",
"severity": "critical",
"cvss": 9.8,
"endpoint": "/api/v2/search",
"method": "POST",
"payload": "' OR '1'='1",
"owasp_category": "A03:2021-Injection",
"reproduction": "curl -X POST https://api.techsphere.example/api/v2/search -d \"q=' OR '1'='1\"",
"fix_recommendation": "Parameterized queries verwenden. Input-Validierung implementieren.",
"cwe": "CWE-89"
},
{
"id": "FND-002",
"type": "BOLA",
"severity": "high",
"cvss": 7.5,
"endpoint": "/api/v2/users/{id}",
"method": "GET",
"owasp_category": "A01:2021-Broken Access Control",
"description": "User can access other users' data by changing ID",
"fix_recommendation": "Object-level authorization checks implementieren.",
"cwe": "CWE-639"
}
],
"summary": {
"critical": 1,
"high": 1,
"medium": 3,
"low": 5,
"info": 12
}
},
"audit_trail": {
"agent_id": "smarterpentester-001",
"reasoning_steps": 47,
"scan_profile": "owasp_top10",
"model": "glm-5.2",
"tokens": { "input": 12500, "output": 8400 }
}
}
Audit-Trail
Jede SmarterPentester-Aktion wird protokolliert. Der Audit-Trail enthält: Agent-ID, Zeitstempel, Reasoning-Steps, Scan-Profile, Modell, Token-Verbrauch, Finding-Hashes. Speicherung in SQLite oder PostgreSQL. Verschlüsselt, manipulationssicher, forensisch verwertbar. Aufbewahrung gemäß DSGVO-Aufbewahrungsfristen. Jeder Scan ist rechtssicher dokumentiert.
Multi-Agenten-Stack
SmarterPentester (Security Orchestrator)
├── Recon Agent → OSINT, DNS-Enumeration, Subdomain-Discovery
├── Network Scanner → Port-Scan, Service-Detection, Nmap-Integration
├── Web Scanner → OWASP Top 10, XSS, SQLi, CSRF, SSRF
├── API Tester → REST, GraphQL, gRPC, WebSocket, Fuzzing
├── CVE Matcher → NVD, Exploit-DB, Metasploit, Advisory-Feeds
├── Cloud Auditor → AWS, Azure, GCP, Kubernetes, Terraform
├── Red Team Sim → Kill-Chain, Lateral Movement, Priv-Esc
├── Compliance Reporter → NIS2, DSGVO, ISO 27001, SOC 2
└── (Custom Sub-Agenten möglich)
Kommunikation über NATS JetStream. State in Redis. Jeder Sub-Agent kann unabhängig skalieren. Fehler-Isolation: Ein Sub-Agent-Crash beeinträchtigt nicht den Orchestrator. Circuit-Breaker-Pattern aktiviert bei 3 Fehlern in 60 Sekunden. Scan-Isolation: Jeder Target-Scan läuft in isoliertem Container.
ReAct Reasoning Loop
SmarterPentester uses the ReAct approach (Reasoning + Acting). Each scan task goes through an iterative cycle:
Observe → Think → Act → Reflect → Observe → ...
The agent observes target systems (Observe), forms hypotheses about vulnerabilities (Think), executes targeted tests (Act) and evaluates results (Reflect). If needed, a new cycle starts. Up to 50 iterations per scan. With timeout after 300 seconds.
API Example: Start Vulnerability Scan
POST /api/v1/agents/smarterpentester/scan
Content-Type: application/json
Authorization: Bearer <JWT>
{
"action": "start_vuln_scan",
"target": "https://api.techsphere.example",
"scan_profile": "owasp_top10",
"scope": ["rest_api", "graphql", "websocket"],
"depth": "thorough",
"options": { "fuzz_undefined_endpoints": true }
}
JSON Response
{
"status": "success",
"scan_id": "SCN-20260711-0042",
"data": {
"target": "https://api.techsphere.example",
"scan_profile": "owasp_top10",
"duration_ms": 84200,
"findings": [
{
"id": "FND-001",
"type": "SQL_Injection",
"severity": "critical",
"cvss": 9.8,
"endpoint": "/api/v2/search",
"method": "POST",
"payload": "' OR '1'='1",
"owasp_category": "A03:2021-Injection",
"reproduction": "curl -X POST https://api.techsphere.example/api/v2/search -d \"q=' OR '1'='1\"",
"fix_recommendation": "Use parameterized queries. Implement input validation.",
"cwe": "CWE-89"
},
{
"id": "FND-002",
"type": "BOLA",
"severity": "high",
"cvss": 7.5,
"endpoint": "/api/v2/users/{id}",
"method": "GET",
"owasp_category": "A01:2021-Broken Access Control",
"description": "User can access other users' data by changing ID",
"fix_recommendation": "Implement object-level authorization checks.",
"cwe": "CWE-639"
}
],
"summary": {
"critical": 1,
"high": 1,
"medium": 3,
"low": 5,
"info": 12
}
},
"audit_trail": {
"agent_id": "smarterpentester-001",
"reasoning_steps": 47,
"scan_profile": "owasp_top10",
"model": "glm-5.2",
"tokens": { "input": 12500, "output": 8400 }
}
}
Audit Trail
Every SmarterPentester action is logged. The audit trail contains: agent ID, timestamp, reasoning steps, scan profiles, model, token consumption, finding hashes. Storage in SQLite or PostgreSQL. Encrypted, tamper-proof, forensically sound. Retention according to GDPR retention periods. Every scan is legally documented.
Multi-Agent Stack
SmarterPentester (Security Orchestrator)
├── Recon Agent → OSINT, DNS enumeration, subdomain discovery
├── Network Scanner → Port scan, service detection, Nmap integration
├── Web Scanner → OWASP Top 10, XSS, SQLi, CSRF, SSRF
├── API Tester → REST, GraphQL, gRPC, WebSocket, fuzzing
├── CVE Matcher → NVD, Exploit-DB, Metasploit, advisory feeds
├── Cloud Auditor → AWS, Azure, GCP, Kubernetes, Terraform
├── Red Team Sim → Kill chain, lateral movement, priv-esc
├── Compliance Reporter → NIS2, GDPR, ISO 27001, SOC 2
└── (Custom sub-agents possible)
Communication via NATS JetStream. State in Redis. Each sub-agent can scale independently. Error isolation: a sub-agent crash does not affect the orchestrator. Circuit breaker pattern activated after 3 failures in 60 seconds. Scan isolation: each target scan runs in an isolated container.
