j3ssie/vigolium repository overview

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

Vigolium provides two complementary scanning modes:

• Native Scan (vigolium scan): Fast, powerful, and flexible. Deterministic, multi-phase scanning with 251 modules across content discovery, browser/SPA spidering, and active/passive audit, covering injection, access control, file/path, API/protocol, framework-specific, cloud/infra, and out-of-band (OAST) vulnerability classes.

• Agentic Scan (vigolium agent): Thoroughly audits your codebase. AI-driven scanning that autonomously plans attacks, selects modules, generates custom extensions, and triages results, combining deep source-code audit with autonomous and targeted vulnerability scanning.

⁠Installation

⁠Quick Install (Recommended)

curl -fsSL https://vigolium.com/install.sh | bash

⁠npm

npm install -g @vigolium/vigolium

⁠Docker

docker pull j3ssie/vigolium:latest
docker run --rm j3ssie/vigolium:latest scan -h

⁠Build from Source

git clone https://github.com/vigolium/vigolium.git
cd vigolium
make build         # build and install to $GOPATH/bin

Requires Go 1.26+ and bun 1.3.11+. See HACKING.md⁠ for prerequisites and build details.

UI Dashboard	Traffic Dashboard

Static Reports	Static Reports

Native scan	Agentic Scan

⁠⚡ Vigolium Cloud Console

A cloud-based solution for teams that want the power of Vigolium without managing infrastructure. Console is the upgraded, fully-featured version of Vigolium: managed scanning, centralized reporting, team collaboration, and extra features layered on top of the open-source core, so you can focus on fixing vulnerabilities instead of maintaining tooling.

⁠Key Features

⁠Native Scan

• 235+ scanner modules: 144+ active (fuzzing) + 91+ passive (pattern matching), covering OWASP Top 10 and beyond
• Out-of-band testing (OAST): blind XSS/SSRF/command injection via interactsh callbacks with automatic payload correlation
• Value-aware mutation: classifies parameters by semantic type (integer, UUID, JWT, email) and mutates per intent
• Multi-phase pipeline: external harvesting, content discovery (Deparos), browser/SPA spidering (Spitolas), and audit, controlled by strategy presets and scanning profiles
• Flexible inputs: URLs, OpenAPI/Swagger, Postman, Burp Suite, cURL, Nuclei JSONL
• Multi-session authentication: inline sessions, session files, or full auth configs with login flows, token extraction, and IDOR/BOLA testing
• JavaScript extensions: custom modules and hooks via embedded JS engine with session-aware HTTP APIs
• Scalable & reportable: concurrent worker pool with per-host rate limiting, hybrid in-memory/disk/Redis queue, and self-contained HTML reports

⁠Agentic Scan

• In-process olium runtime: every agent mode runs on the native Go pkg/olium engine: turn-based loop, built-in tool registry, skills support, and pluggable provider drivers (no subprocess SDK pools)
• Autopilot: agent autonomously discovers endpoints, runs scans, and triages findings, with optional multi-specialist pipeline and session resume
• Swarm: master agent selects modules, generates custom JS attack extensions, runs code audit + SAST, executes scans, and triages results; targeted or full-scope (--discover), with --diff/--last-commits for change-focused runs
• Source-audit drivers: audit, piolium, and the unified audit dispatcher run foreground source-code audits sharing one finding schema and DB tagging
• Query mode: single-shot prompts for code review, endpoint discovery, and secret detection
• Pluggable providers: openai-codex-oauth (default), anthropic-api-key, anthropic-oauth, openai-api-key, anthropic-cli, google-vertex. Same modes exposed over the REST API with SSE streaming and an OpenAI-compatible chat endpoint

⁠Quick Start: Native Scan

# Scan a single target (default: balanced strategy)
vigolium scan -t https://example.com

# Scan with a strategy preset
vigolium scan -t https://example.com --strategy deep

# Scan specific modules only
vigolium scan -t https://example.com -m xss-reflected,sqli-error

# Scan from an OpenAPI spec
vigolium scan -T openapi.yaml -I openapi

# Pipe URLs from stdin
cat urls.txt | vigolium scan

# Run a single phase directly
vigolium run discovery -t https://example.com

# Generate an HTML report
vigolium scan -t https://example.com --only discovery --format html -o report.html

See docs.vigolium.com/architecture/overview⁠ for the full overview and docs.vigolium.com/native-scan/strategies⁠ for strategies, profiles, and pace configuration.

⁠Documentation

Full documentation lives at docs.vigolium.com⁠. Quick links:

⁠JavaScript Engine

Run JavaScript/TypeScript code directly or write custom scan modules and hooks without recompiling:

# Execute inline JavaScript
vigolium js --code 'let r = vigolium.http.get(TARGET); console.log(r.statusCode)' -t https://example.com

# Run a JS file with timeout
vigolium js --code-file ./my-script.js -t https://example.com --timeout 60s

# Manage extensions
vigolium ext ls                # list loaded extensions
vigolium ext docs --example    # browse API with code examples
vigolium ext preset            # install starter scripts

The JS engine exposes session-aware HTTP APIs for authenticated testing:

// Create a persistent session with shared cookie jar
let session = vigolium.http.session();
session.post("https://app.example.com/login", { user: "admin", pass: "secret" });
session.get("https://app.example.com/dashboard"); // cookies auto-sent

// Automated login flow with token extraction
let authed = vigolium.http.login({
  url: "https://app.example.com/api/auth",
  method: "POST",
  body: JSON.stringify({ username: "admin", password: "pass" }),
  extract: [{ source: "json", path: "$.token", apply_as: "Authorization: Bearer {value}" }]
});

// IDOR/BOLA testing across multiple sessions
let results = vigolium.http.authTest({
  sessions: { admin: adminSession, user: userSession },
  requests: [{ method: "GET", url: "https://app.example.com/api/users/1" }]
});

// Multi-step authentication sequences
let result = vigolium.http.sequence([
  { url: "/csrf", extract: [{ source: "cookie", name: "csrf_token", as: "token" }] },
  { url: "/login", method: "POST", body: "csrf={token}&user=admin" }
]);

// Parallel request batching (race conditions, IDOR)
let responses = vigolium.http.batch([req1, req2, req3], { concurrency: 10 });

// CSRF token extraction
let csrf = vigolium.http.csrf("https://app.example.com/form");

// HTTP request replay with variations
let varied = vigolium.http.replay(rawRequest, [
  { headers: { "Authorization": "Bearer admin_token" } },
  { headers: { "Authorization": "Bearer user_token" } }
]);

See docs.vigolium.com/customization/writing-extensions⁠ for the extension authoring guide and pkg/jsext/vigolium.d.ts for the full TypeScript API definitions.

⁠Security

Vigolium is an offensive security tool, and two parts of it are intentionally permissive: agent mode runs with no sandbox (the LLM has full shell, file, and network access on the host) and extensions can run arbitrary commands. Run agent mode in a disposable container/VM scoped to the engagement, and treat untrusted extensions like untrusted code. See SECURITY.md⁠ (or docs.vigolium.com/others/security-warning⁠) before you start, and report vulnerabilities in Vigolium itself privately to [email protected]⁠.

⁠License

Vigolium is released under the GNU Affero General Public License v3.0⁠. Derivative works must remain open under the same terms.

Crafted with ♥ by @j3ssie⁠, with @theblackturtle⁠ as a core initial contributor.