web3-ai-tools

これはレビュー時に保存された抜粋です。完全で最新の内容は外部ソースを確認してください。

---
name: web3-ai-tools
description: AI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discovery.
Contains: CAI Framework, Shannon AI pentester, LuaN1ao dual-graph agent, SmartGuard multi-agent auditor, AI-generated code hunting patterns, Claude security skills.
---

# AI TOOLS ARSENAL
> AI-powered automation for every phase of Web3 bug hunting.
> Replaces: 28-cai-framework, 29-claude-skills-security, 30-shannon-ai-pentester,
>           31-luan1ao-agent, 32-ai-generated-code-hunting, 33-smartguard-agent

---

## TOOL SELECTION GUIDE

| Tool | Target Type | Best For | Cost |
|------|------------|----------|------|
| **Shannon** | Web apps + API (white-box) | IDOR, SQLi, SSRF, auth bypass | ~$50/run |
| **LuaN1ao** | Any web target | Autonomous OWASP Top 10 | $0.09/exploit |
| **CAI** | Web/network/IoT | Bug bounty recon + validation | API cost only |
| **SmartGuard** | Solidity files | Auto PoC generation for SC bugs | API cost |
| **AI Code Hunt** | AI-written contracts | Bugs Slither/Forge miss | Manual (patterns) |

**For DeFi smart contracts:** SmartGuard + AI Code Hunt patterns
**For DeFi web frontends:** Shannon (web layer) + skills 01-07 (contract layer)
**For CTF/web targets:** LuaN1ao or CAI

---

## TOOL 1: SHANNON — AUTONOMOUS WEB PENTESTER

**Source:** github.com/KeygraphHQ/shannon
**Score:** 96.15% on XBOW source-aware benchmark (100/104 exploits)
**Model:** Claude Agent SDK (Anthropic)
**Cost:** ~$50/run | ~1-1.5 hours

### What Shannon Finds
```
✅ IDOR — changes IDs across accounts, tests all API routes
✅ SQLi — error-based and time-based blind
✅ Command injection — OS separators in all inputs
✅ XSS — reflected + stored (confirmed in real browser)
✅ SSRF — webhook/fetch URL inputs, OOB callbacks
✅ JWT attacks — alg:none, RS256→HS256 confusion, weak keys
✅ Auth bypass — session fixation, forgot-password flaws
✅ Privilege escalation — viewer→admin, cross-tenant
✅ OAuth misconfigs — state parameter, redirect_uri

❌ Race conditions (sequential, not concurrent)
❌ Business logic (needs domain expertise)
❌ Smart contract bugs — use files 01-07 for these
❌ Novel techniques not in prompt templates
```

### Setup
```bash
git clone https://github.com/KeygraphHQ/shannon
cd shannon && npm install
cp .env.example .env  # Add: ANTHROPIC_API_KEY=sk-ant-...
npm run build

# Direct mode (simple):
node dist/index.js --config configs/my-target.yaml

# Docker (includes nmap, subfinder, whatweb):
docker run --env-file .env \
  -v ./configs:/app/configs \
  keygraph/shannon:latest \
  --config configs/my-target.yaml
```

### Config Template
```yaml
# configs/target.yaml
target:
  name: "DeFi App Frontend"
  url: "https://app.DEFI.com"
  source_path: "/path/to/frontend/clone"  # white-box = much better
  additional_context: |
    DeFi app. Users connect MetaMask wallets.
    Focus on: IDOR in /api/portfolio?address=0x...,
    GraphQL introspection, JWT handling, SSRF via webhooks.
    DO NOT interact with smart contracts.

authentication:
  login_type: form  # form | sso | api | basic
  login_url: "https://app.DEFI.com/login"
  credentials:
    username: "[email protected]"
    password: "testpassword"
  login_flow:
    - "Fill in username field with $username"
    - "Fill in password field with $password"
    - "Click the login button"
  success_condition:
    type: url
    value: "/dashboard"

test_accounts:
  - username: "[email protected]"
    password: "testpassword"
    role: "viewer"
  - username: "[email protected]"
    password: "victimpassword"
    role: "admin"

scope:
  include: ["https://app.DEFI.com/*"]
  exclude: ["https://app.DEFI.com/admin/destroy-all"]
```

### The Shannon Workflow
```
YOUR PLAN:
1. Setup config + 2 test accounts (15 min)
2. Run Shannon (90 min) → do MANUAL business logic testing while it runs
3. Review Shannon findings (30 min) → verify each PoC manually
4. Manual hunting for what Shannon misses: race conditio