AI-powered Cyber Sec professional tool

---

Install

curl -sSfL https://raw.githubusercontent.com/zimkk/vigil/main/install.sh | bash

Or with pip / pipx:

pipx install redteam
# or
pip install redteam

Requires Python 3.11+.

---

What it does

Vigil drives an agentic red team engagement from a single CLI. Each command maps to a phase of the PTES methodology and spins up one or more AI agents that plan, call real security tools, interpret output, and write findings to a local SQLite database.

Phase	Command	Description
OSINT / Passive recon	vigil enumerate	Subdomain enum, DNS, WHOIS, cert transparency — no active probing
Active recon	vigil active	Port scan, service fingerprint, web crawl
Vulnerability assessment	vigil assess	Nuclei, nikto, SSL/TLS checks, tech-stack CVEs
Validation	vigil validate	Confirm findings, eliminate false positives
Exploitation	vigil exploit	Controlled PoC against validated findings
Post-exploitation	vigil post-exploit	Enumerate from foothold
Privilege escalation	vigil privesc	Local privesc vector detection
Credential access	vigil cred-access	Credential hunting
Discovery	vigil discover	Users, files, services, internal hosts
Lateral movement	vigil lateral	Pivot via harvested credentials
Persistence	vigil persist	Persistence mechanism identification
Defense evasion	vigil evade	Security control detection and evasion planning
C2 assessment	vigil c2	C2 channel feasibility and evasion-aware planning
Collection	vigil collect	Sensitive data staging for exfil simulation
Exfiltration	vigil exfil	Channel testing and impact estimation
Impact	vigil impact	Business risk quantification
Cleanup	vigil cleanup	Remove Vigil-created artifacts from target
Report	vigil report	Final engagement report across all phases

---

Usage

# Passive recon (no authorization required)
vigil enumerate example.com

# Full active assessment (requires written authorization)
vigil active example.com
vigil assess example.com
vigil validate
vigil report --output report.md

Run any phase in --mode sequential (single agent) or the default --mode parallel (multi-agent wave).

vigil enumerate --mode sequential example.com

List the tools registered for any phase:

vigil tools enumerate

---

LLM backend

Vigil works with Anthropic Claude (default) or any OpenAI-compatible endpoint — Ollama, vLLM, LM Studio, OpenRouter.

Create a .env file in your working directory:

# Anthropic (default)
VIGIL_BACKEND=anthropic
VIGIL_API_KEY=sk-ant-...
VIGIL_MODEL=claude-sonnet-4-6

# Ollama (local)
VIGIL_BACKEND=openai_compat
VIGIL_BASE_URL=http://localhost:11434/v1
VIGIL_API_KEY=ollama
VIGIL_MODEL=qwen2.5:7b

---

External tools

Vigil calls real security binaries. Install them all at once:

curl -sSfL https://raw.githubusercontent.com/zimkk/vigil/main/install-tools.sh | bash

Key tools installed: nmap, masscan, nuclei, subfinder, httpx, ffuf, gobuster, sqlmap, nikto, dalfox, gitleaks, trufflehog, rustscan, feroxbuster, wpscan, and more (426 total across Go, Cargo, pip, npm, and gem).

---

Legal

Vigil is built for authorized security testing. Running it against systems you do not own or have explicit written permission to test is illegal. The authors accept no liability for unauthorized use.

---