SecGPT is an experimental, autonomous LLM-driven tool designed for network security tasks like penetration testing and vulnerability scanning. It emulates AutoGPT's decision-making process, leveraging a plugin architecture to execute actions such as web requests, SQL injection testing via sqlmap, and report generation. The project targets security professionals and researchers seeking an AI-assisted approach to automate security assessments.

How It Works

SecGPT operates by aggregating AI-driven decisions with local plugin functionalities. The LLM, guided by predefined goals and constraints, analyzes information and selects appropriate plugins to execute tasks. It constructs basic behavior logic, calls plugin functions, and processes their outputs to achieve objectives like vulnerability scanning and report writing. This approach aims to automate complex security workflows by chaining LLM reasoning with specialized tools.

Quick Start & Requirements

• Install:

  git clone https://github.com/ZacharyZcR/SecGPT.git
  pip install -r requirements.txt
  

• Run:

  python install.py # Environment check
  python SecGPT.py  # Start SecGPT
  

• Prerequisites: Requires an OpenAI API key. The example usage demonstrates integration with sqlmap.

Highlighted Details

• Emulates AutoGPT with a focus on network security applications.
• Features a refined plugin system for customizable functionality.
• Demonstrates automated SQL injection testing using sqlmap.
• Generates vulnerability reports and provides mitigation recommendations.

Maintenance & Community

The project is a solo developer effort, with the author currently studying LangChain. Contributions are welcomed, and guidance for writing plugins is available in Plugins.md. Contact is available via GitHub issues or email at PayasoNorahC@protonmail.com.

Licensing & Compatibility

Licensed under the Apache License 2.0. This license is permissive and generally compatible with commercial use and closed-source linking.

Limitations & Caveats

The project is experimental, with the author noting poor code implementation quality and a limited number of plugins with potential bugs. The update speed is slow due to the author's ongoing learning.