Skip to content
This repository was archived by the owner on Jul 31, 2026. It is now read-only.

README.md

Latest commit

 

History

History
483 lines (360 loc) · 16.6 KB

README.md

File metadata and controls

483 lines (360 loc) · 16.6 KB
Raw

Cancer CLI

AI-driven penetration testing and C2 operations toolkit. Forked from Google Gemini CLI — adds a 40-module security scanner, credential management, DLL templates for privilege escalation, and a system prompt tuned for security engagements.

License Node CI

⚠️ Fork notice: This project extends Google Gemini CLI with security tooling. See FORK.md for the delta from upstream. See ROADMAP.md for future direction.

Quickstart

# 1. Clone and install
git clone https://github.com/n4igme/cancer-cli.git
cd cancer-cli
npm install

# 2. Build all packages
npm run build

# 3. Bundle the chat binary (required for the `cancer` command)
npm run bundle

# 4. Make both commands available globally (optional, but convenient)
npm link

# 5. Run your first scan — dry-run shows attack surface without sending payloads
cancer-scan https://example.com --dry-run

# 6. Full scan
cancer-scan https://example.com --profile normal

Note: npm link makes cancer-scan and cancer available globally. Without it, use node scripts/cancer-scan.js (scanner) or node scripts/start.js (chat). To unlink: npm unlink -g @n4igme/cancer-cli

Tip: scope.json in the project root defaults to ["*"] (all targets allowed). For bug bounties with a limited scope, edit scope.json first.

What it does

Cancer CLI is two things in one repo:

1. C2 Operations Toolkit

Infrastructure for managing sessions, credentials, and pivots across targets during penetration tests. All via the AI chat interface (cancer command).

Native TypeScript modules (packages/kali-tools/src/scanner/):

Module Purpose
tools/payload-encoder.ts PowerShell encoding, reverse shells, file writing, credential stash
tools/listener.ts HTTP callback listener with exfil endpoint
tools/lpd-exploit.ts LPD command injection exploit
tools/socks5-deployer.ts Pure-Java SOCKS5 proxy deployer for distroless targets
post-exploit/privesc-enum.ts Linux privilege escalation enumeration (16+ checks)
post-exploit/harvest.ts Credential harvesting (SSH keys, AWS creds, shadow hashes)
tools/c2-session/ Session and pivot management
tools/ad-scanner/ Active Directory security assessment

scripts/ directory:

Tool Purpose
cancer-sliver/ Sliver C2 client library with pre-compiled protobuf stubs
cancer-revshell.js Reverse shell deployment CLI
templates/ Native x64 DLL templates with Makefile (adduser, flagsearch)

2. Security Scanner (standalone, no AI key required)

A 40-module web vulnerability scanner with CVSS 3.1 scoring, MITRE ATT&CK mapping, WAF bypass, and CI-ready output (SARIF).

cancer-scan https://target.com                     # Full scan
cancer-scan https://target.com --profile aggressive  # Deeper scan
cancer-scan https://target.com --dry-run            # Show surface, no payloads
cancer-scan --type mobile app.apk                   # Mobile analysis
cancer-scan --type host 192.168.1.0/24              # Host scan
cancer-scan --proxy http://127.0.0.1:8080            # Via Burp
cancer-scan --module sqli                           # Single module
cancer-scan -f sarif -o out.sarif.json              # CI output

🛡️ Server Guardian Mode

Activate by mentioning "server", "guard", "defend", "protect" in chat. Runs ASSESS → HARDEN → MONITOR workflow.

Scan types

  • web (default) — Web application vulnerability scanning
  • host — Network port scanning + service detection
  • mobile — APK static analysis + deep link enumeration
  • scode — Source code review patterns
  • privesc — Post-exploitation privilege escalation checks
  • desktop — Desktop application analysis

Profiles

Profile Concurrency Payloads/param Crawl depth WAF bypass Use case
stealth 1 2 1 off IDs/IPS avoidance, production
normal 5 5 2 level 1 Standard scans
aggressive 5 15 3 level 2 Staging/testing
brutal 10 no limit 5 level 3 Internal/Lab

Configuration

Settings in .cancer/config.json (optional):

{
  "proxy": "http://127.0.0.1:8080",
  "headers": { "Authorization": "Bearer ..." },
  "cookie": "session=abc123",
  "exclude": ["logout", "admin"],
  "concurrency": 3,
  "maxUrls": 200,
  "timeout": 10000
}

Scanner modules (40+)

SQLi          XSS          SSRF         SSTI          XXE
JWT           CSRF         LFI          CMDi          IDOR
CORS          GraphQL      OAuth        NoSQL         Upload
Redirect      Headers      Actuator     Auth-Bypass   Directory-listing
Subdomain-enum Cloud-infra Mobile-apk   Mobile-deeplink NFS
SSH-bruteforce SSH-version Webshell      Dirbust       Vhost-enum
Login-bruteforce Grep       Method-tamper Default-creds Roundcube
Openstamanager Olivetin    Craft-CMS    Php-deserialization
Subdomain-takeover React-RSC-RCE

Standalone scanner (no AI key needed)

cancer-scan https://target.com
cancer-scan https://target.com --profile aggressive
cancer-scan --diff <run1> <run2>
cancer-scan --suppress <stable_id>
cancer-scan --runs

Scan lifecycle (diff, suppress, runs)

Each scan produces a run directory in output/. Findings are identified by content-hash stable_id — re-scan the same target and only new/different findings appear.

cancer-scan diff <run_id_1> <run_id_2>        # What changed
cancer-scan suppress <stable_id>               # Hide a FP
cancer-scan suppress --list                    # All suppressions
cancer-scan suppress --remove <id>             # Unsuppress
cancer-scan runs                               # Past scans

Privilege escalation scanner

Scan a Linux system for privesc vectors:

cancer-privesc target:/path      # Local path or SSH remote
cancer-privesc --format json     # Machine-readable output
cancer-privesc --thorough        # Longer scan, more checks

The scanner can also be invoked programmatically via the post-exploit runner when RCE is confirmed during a scan (auto-chains from CMDi/webshell findings).

Full bug bounty automation

# Pipeline: recon → classify → hunt → report
npm run hunt -- --target https://target.com
npm run hunt -- --config my-bounty.json
npm run hunt -- --quick                    # Fast pass
npm run hunt -- --aggressive               # Deep pass

AI chat mode (requires API key or local Ollama)

# Option 1: Use Ollama locally (no API key needed)
ollama serve
ollama pull qwen2.5-coder:7b
cancer

# Option 2: Use OpenRouter
export OPENROUTER_API_KEY="sk-or-v1-xxxxx"
cancer

In chat mode, tell the agent a target and it orchestrates the full workflow: reconnaissance → vulnerability classification → exploitation → reporting. The system prompt (.gemini/system.md) tunes it for security operations.

CLI options

cancer-scan

cancer-scan <target> [options]

Target:
  URL, IP, CIDR range, APK file, or directory path

Options:
  --type        web | host | mobile | scode | privesc | desktop  (default: web)
  --profile     stealth | normal | aggressive | brutal           (default: normal)
  --module      Run only specific module (e.g. sqli, xss)
  --exclude     Skip specific module(s) by name
  --dry-run     Show attack surface without sending payloads
  --output      Output directory (default: output/<run_id>/)
  -f, --format  plain | json | sarif | md                        (default: plain)
  -o            Output file (for json/sarif)
  --proxy       HTTP proxy (e.g. http://127.0.0.1:8080)
  --header      Custom header (repeatable)
  --cookie      Session cookie
  --timeout     Request timeout in ms (default: 10000)
  --concurrency Max concurrent requests (default: 5)
  --max-urls    Max URLs to crawl (default: 200)
  --crawl       Crawl depth (default: 2)
  --diff        Compare two run IDs
  --suppress    Suppress a finding by stable_id
  --runs        List all persisted scans
  -v, --verbose Verbose output
  --version     Show version

cancer-privesc

cancer-privesc <target> [options]

Target:
  Local directory path or SSH remote (user@host:/path)

Options:
  --format     plain | json          (default: plain)
  --thorough   Enable deep checks   (default: off)
  --output     Write results to file

Troubleshooting

Symptom Fix
npm run build fails Node ≥20 required. Check node --version. Try nvm use
cancer-scan not found Run npm link first, or use node scripts/cancer-scan.js
cancer not working Check your provider config. For Ollama: ensure ollama serve is running. For others: verify API key is set.
Ollama connection refused Start Ollama with ollama serve. Check OLLAMA_BASE_URL if using non-default port.
Permission denied Run chmod +x node_modules/.bin/* after install
No targets found Check scope.json — defaults to ["*"]
WAF blocking Use --profile stealth to reduce payload aggression
Memory errors Most type checks require ~4GB+ RAM. Use --max-old-space-size=4096 with Node
tsc OOM Run workspace-specific typecheck: npm run typecheck:kali-tools
Linting errors on fork See FORK.md section on merge conflicts

Kali Linux tools (optional)

Cancer CLI integrates with 65+ Kali Linux tools for advanced operations. Tools are auto-detected on first use if installed on the system.

For a full Kali experience in a container:

docker pull kalilinux/kali-rolling
docker run -it kalilinux/kali-rolling
apt update && apt install -y kali-linux-headless

See docs/kali-linux-setup.md for details.

Web search

AI chat mode uses web search (Tavily, SearXNG, Google) for OSINT during recon. No API key needed for SearXNG (built-in).

Skills (AI chat mode)

Skills extend the agent's capabilities. Activate at runtime:

  • kali-nmap — Network scanning with Nmap
  • kali-gobuster — Directory busting
  • kali-sqlmap — SQL injection automation
  • kali-hydra — Network login brute-force
  • kali-metasploit — Exploit framework integration
  • kali-wpscan — WordPress vulnerability scanning
  • kali-theharvester — OSINT email/subdomain enumeration
  • cancer-revshell — Reverse shell deployment
  • cancer-listener — Callback listener setup
  • cancer-socks5 — SOCKS5 proxy for distroless targets
  • And 20+ more Kali skills

Project structure

packages/
├── cli/             Terminal UI, input processing, tool execution
├── core/            Backend orchestration, AI provider integration
├── kali-tools/      Security scanner (primary value)
│   └── src/scanner/
│       ├── modules/         40+ vulnerability detection modules
│       ├── post-exploit/    Privesc enum, credential harvesting, GTFOBins
│       ├── tools/           Payload encoder, listener, LPD, SOCKS5, AD scanner
│       └── platforms/       Web, host, mobile, scode scan handlers
├── a2a-server/      Agent-to-agent protocol (candidate for removal)
├── sdk/             Embedding SDK (candidate for removal)
├── devtools/        Network/console inspector (candidate for removal)
├── test-utils/      Shared test fixtures
└── vscode-ide-companion/  VS Code extension (candidate for removal)
scripts/             C2 operations toolkit
├── cancer-scan.js          Standalone scanner CLI
├── cancer-privesc.js       Privesc automation
├── auto-hunt.mjs           Full bug bounty pipeline
├── cancer-sliver/          Sliver C2 client library (Python + protobuf)
└── templates/              Native DLL sources + Makefile

Development

# Install
npm install

# Build all packages
npm run build

# Run tests
npm run test

# Lint
npm run lint

# Typecheck
npm run typecheck

# Full validation (build + lint + test)
npm run preflight

See CONTRIBUTING.md for PR workflow, FORK.md for upstream merge conflicts.

How the scanner works

Recon → Discover → Endpoint Import → Hunt → Score → Validate → Suppress → Report
  1. Recon — Port scan, tech fingerprint, subdomain discovery
  2. Discover — Crawl endpoints from URLs, JS bundles, forms, sitemaps
  3. Import — HAR, Burp XML, OpenAPI/Swagger, text, JSONL
  4. Hunt — 40+ modules each test their vuln class with payloads
  5. Score — CVSS 3.1 + MITRE ATT&CK + contextual modifiers (EOL, WAF, debug)
  6. Validate — Anti-inflation gate, evidence quality checks
  7. Suppress — Cross-run dedup via content-hash stable_id
  8. Report — Plain text, JSON, SARIF 2.1.0, Markdown

Proxy support (Burp)

cancer-scan https://target.com --proxy http://127.0.0.1:8080

All HTTP traffic routes through the proxy. Also works via config file:

{ "proxy": "http://127.0.0.1:8080" }

MCP Server (native_scan tool)

The scanner exposes a native_scan tool via MCP (Model Context Protocol) for AI chat clients. Started automatically when the scanner profile requests it.

Docker

# Build
docker build -t cancer-cli .

# Run scanner
docker run cancer-cli cancer-scan https://example.com

# Run chat with OpenRouter
docker run -e OPENROUTER_API_KEY=$OPENROUTER_API_KEY cancer-cli

# Run chat with OpenAI-Compatible provider
docker run -e OPENAI_COMPATIBLE_BASE_URL=https://api.groq.com/openai/v1 \
           -e OPENAI_COMPATIBLE_API_KEY=$GROQ_API_KEY cancer-cli

AI providers (chat mode only)

Cancer CLI supports multiple AI providers. Choose one:

Provider Required env var(s) Notes
Ollama (Local) OLLAMA_BASE_URL (optional, defaults to localhost) No API key needed, runs locally
OpenRouter OPENROUTER_API_KEY Multiple models, free tier
OpenCode OPENCODE_API_KEY DeepSeek models, free tier
OpenAI-Compatible OPENAI_COMPATIBLE_BASE_URL, OPENAI_COMPATIBLE_API_KEY Any OpenAI-compatible API

Quick setup examples

# Option 1: Ollama (local, no API key)
ollama serve
ollama pull qwen2.5-coder:7b
cancer

# Option 2: OpenRouter (free models available)
export OPENROUTER_API_KEY="sk-or-v1-xxxxx"
cancer

# Option 3: OpenCode
export OPENCODE_API_KEY="your-key"
cancer

# Option 4: OpenAI-Compatible (e.g., Groq, LM Studio)
export OPENAI_COMPATIBLE_BASE_URL="https://api.groq.com/openai/v1"
export OPENAI_COMPATIBLE_API_KEY="gsk_xxxxx"
cancer

See .env.example for full configuration options.

Credits

This project is a fork of Google Gemini CLI, licensed under Apache 2.0. See NOTICE for full attribution and FORK.md for the complete list of modifications.

License

Apache 2.0. See LICENSE and NOTICE.