SAGE Lite

Automated web penetration testing CLI framework - Orchestrates 30+ open-source pentesting tools across 7 automated phases with parallel execution and streaming pipeline support.

_________   _____    ___________________
\   _____/  /  _  \  /  _____/\_   _____/
 \_____  \  /  /_\  \/   \  ___ |    __)_ 
 /        \/    |    \    \_\  \|        \
/_______  /\____|__  /\______  /_______  /
        \/         \/        \/        \/ 
    .____    ._________________________   
    |    |   |   \__    ___/\_   _____/   
    |    |   |   | |    |    |    __)_    
    |    |___|   | |    |    |        \   
    |_______ \___| |____|   /_______  /   
            \/                      \/  

🚀 Key Features

• Pure CLI - No web UI, designed for automation and scripting
• 7-Phase Methodology - Complete pentesting workflow from recon to retest
• 30+ Tools - Integrates best open-source security tools
• Streaming Pipeline - Concurrent phase execution (50-70% faster)
• 4 Scan Modes - STEALTH / NORMAL / AGGRESSIVE / MAXIMUM
• Parallel Execution - Tools run concurrently, not sequentially
• Smart Targeting - Priority-based vulnerability scanning
• Tech-Based Scanning - Templates match detected technologies
• Pretty Output - Rich terminal output with colors and tables
• JSON Reports - Machine-readable output for automation

⚡ Quick Start

# Clone and install
git clone https://github.com/kuro-toji/sage-lite.git
cd sage-lite
pip install -e .

# Run full 7-phase pentest
sagelite automate example.com

# Or use streaming pipeline (50-70% faster)
sagelite stream example.com

⚡ Scan Modes

Choose the right speed for your engagement:

Mode	Speed	Use Case
stealth	Slow	Bug bounty, quiet testing
normal	Medium	Balanced pentest
aggressive	Fast	Time-critical assessments
maximum	Fastest	Full coverage, all tools

📋 Command Reference

Main Automation Commands

# Standard sequential 7-phase automation
sagelite automate TARGET

# ⚡ STREAMING PIPELINE - 50-70% faster (concurrent phases)
sagelite stream TARGET

# 🚀 AGGRESSIVE - parallel execution + optimized settings
sagelite fast TARGET

# ⚡ MAXIMUM - everything enabled, full coverage
sagelite lightning TARGET

# 🔇 STEALTH - slow, minimal footprint
sagelite stealth TARGET

Scan with Mode Selection

# Scan with specific mode and phase
sagelite scan TARGET --mode aggressive --phase 3

# Show mode comparison
sagelite tools --modes

Optimized Phase Commands

# Phase 1: Reconnaissance (parallel version - 60-70% faster)
sagelite recon TARGET -O

# Phase 2: Scanning (smart URL discovery)
sagelite scan-phase TARGET -O

# Phase 3: Vulnerability Analysis (tech-based targeting)
sagelite vuln TARGET -O

# Phase 4: Exploitation
sagelite exploit TARGET -f findings.json

# Phase 5: Post-Exploitation
sagelite post TARGET

Utilities

# List all supported tools
sagelite tools --list-tools

# Check which tools are installed
sagelite tools --check-installed

# Show phase descriptions
sagelite phases --list

# Generate report from scan results
sagelite report results/scan.json --format json

🔧 Architecture

Traditional Sequential Pipeline

Phase 1 ──────► Phase 2 ──────► Phase 3 ──────► Phase 4
   │              │               │               │
   ▼              ▼               ▼               ▼
[Wait...]    [Wait...]       [Wait...]       [Wait...]
   └──────────────┴───────────────┴───────────────┘
                    Total Time = T1 + T2 + T3 + T4

Streaming Pipeline (NEW!)

Phase 1 ──────────┬──────────────────────────────┐
   │              │                              │
   ▼              ▼                              ▼
[Recon]     [Scan]────────────────────────► [Exploit]
   │              │                              ▲
   │              ▼                              │
   │         [Vuln] ◄────────────────────────────┘
   │              │
   └──────────────┘
        TargetStream (queues)

50-70% faster - phases overlap instead of waiting.

Optimizations Applied

Optimization	Before	After	Improvement
Parallel Execution	Sequential tools	15 concurrent	~70% faster
Port Scan	1000 ports	5000 ports	5x coverage
SQLMap Level	1	3	+40% detection
Nuclei Threads	50	100-200	2-4x faster
Template Coverage	6 categories	11 categories	+83%
URL Discovery	Manual only	Auto sitemap/JS/robots	+200% URLs

📦 7-Phase Methodology

Phase 1: Reconnaissance

Passive and active information gathering.

Tools: subfinder, amass, theHarvester, nmap, dnsrecon, assetfinder, findomain, shodan

Phase 2: Scanning & Enumeration

Directory brute-forcing, fingerprinting, parameter discovery.

Tools: gobuster, ffuf, nikto, whatweb, dirsearch, arjun, wapalyzer

Phase 3: Vulnerability Analysis

CVE scanning, injection detection, misconfiguration checks.

Tools: nuclei, sqlmap, dalfox, commix, corsy, crlfmap, ssrfmap, retire, jwt_tool

Phase 4: Exploitation

Confirming and exploiting vulnerabilities.

Tools: sqlmap (os-shell, dump), dalfox (poc), commix, gitdump, gitleaks, hydra

Phase 5: Post-Exploitation

Pivoting, persistence, lateral movement.

Tools: chisel, proxychains, nmap, enum4linux, netdiscover

Phase 6: Reporting

Generate comprehensive pentest reports.

Phase 7: Retest

Verify vulnerability fixes.

🔌 Complete Tool List

Phase	Tool	Purpose
1	subfinder	Passive subdomain discovery
1	amass	Deep subdomain enumeration
1	theHarvester	OSINT email/host harvesting
1	nmap	Port scanning (5000 ports in aggressive mode)
1	dnsrecon	DNS enumeration
1	assetfinder	Fast subdomain finder
1	findomain	Subdomain enumeration
1	shodan	Internet exposure search
2	gobuster	Directory brute-forcing
2	ffuf	Web fuzzing
2	nikto	Web server scanning
2	whatweb	Technology fingerprinting
2	wapalyzer	Tech stack detection
2	dirsearch	Path scanning
2	arjun	Parameter discovery
3	nuclei	CVE vulnerability scanning (11 template categories)
3	sqlmap	SQL injection detection
3	dalfox	XSS scanning
3	commix	Command injection
3	corsy	CORS misconfiguration
3	crlfmap	CRLF injection
3	ssrfmap	SSRF scanning
3	retire	Vulnerable JS detection
3	jwt_tool	JWT tampering
4	gitdump	Git repository dumper
4	gitleaks	Secrets scanning
4	hydra	Password brute-forcing
5	chisel	Tunneling/pivoting
5	proxychains	Proxy routing
5	enum4linux	SMB enumeration
5	netdiscover	Network discovery

⚙️ Configuration

Scan Modes

# STEALTH - Slow, minimal footprint
sagelite stealth example.com

# NORMAL - Balanced (default)
sagelite scan example.com --mode normal

# AGGRESSIVE - Fast, parallel
sagelite fast example.com
# or
sagelite scan example.com --mode aggressive

# MAXIMUM - Everything enabled
sagelite lightning example.com

AggressiveConfig Settings

Setting	STEALTH	NORMAL	AGGRESSIVE	MAXIMUM
Parallel Workers	3	15	20	25
SQLMap Level	1	3	4	5
Nuclei Threads	20	100	150	200
Rate Limit	Low	Medium	300	500
Ports Scanned	100	1000	5000	5000+

📊 Smart Targeting

Priority scoring system for optimal vulnerability discovery:

Base Score = 1.0
× Tech Type (admin=1.5x, api=1.5x, auth=1.5x)
× Vulnerable Pattern (cmd==3x, id=2.5x, file=2x, q=1.5x)
× In-scope (1.2x) / Out-of-scope (0.5x)
× Multi-param bonus (1.3x if ≥3 params)

High-Value Target Patterns

Type	Patterns	Priority
Admin Panel	/admin, /dashboard, /manage	Critical
API Endpoint	/api/v*, /rest, /graphql	Critical
Auth	/login, /oauth, /token	High
Upload	/upload, /file, /avatar	High
Search	/search, /query, /filter	Medium

📁 Output

[Phase 1: Reconnaissance] - Streaming Mode
Target: example.com

[✓] Subfinder - Found 45 subdomains (parallel)
[✓] Amass - Found 23 subdomains (parallel)
[✓] Nmap - Found 12 open ports (5000 ports)
[✓] Phase 2 starting early with discovered data...

Results:
  Total subdomains: 68
  Open ports: 80, 443, 8080, 22
  Time saved: ~40% via parallel execution

🛠️ Development

# Install dev dependencies
pip install -e ".[dev]"

# Run tests
pytest tests/ -v

# Format code
black src/

# Type check
mypy src/

📝 License

MIT License - See LICENSE file for details.

⚠️ Disclaimer

WARNING: This tool is for authorized security testing only. Always obtain proper authorization before testing any system. Unauthorized access to computer systems is illegal.