wehub/usestrix--strix
1
0
Fork 0
Code Issues Pull Requests Actions Deployments Models Agent Notes Packages Projects Releases Wiki Activity

docs: make Chinese README the default

Browse Source
This commit is contained in:
wehub-resource-sync
2026-07-13 09:57:07 +00:00
parent a5e6f232d2
commit 883e38f2df
1 changed files with 87 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+87 -81
View File
@@ -1,3 +1,9 @@
<!-- WEHUB_ZH_README -->
> [!NOTE]
> 本文档由 WeHub 基于上游 README 翻译整理，属于社区翻译，非官方中文文档。
> [English](./README.en.md) · [原始项目](https://github.com/usestrix/strix) · [上游 README](https://github.com/usestrix/strix/blob/HEAD/README.md)
> 原作者、版权与许可证归属以原始项目及本仓库 LICENSE 文件为准。
<p align="center">
<a href="https://strix.ai/">
<img src="https://github.com/usestrix/.github/raw/main/imgs/cover.png" alt="Strix Banner" width="100%">
@@ -8,7 +14,7 @@
# Strix
### The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities.
### 开源 AI 渗透测试工具。自主 AI 黑客可发现并修复你应用中的漏洞。
<br/>
@@ -34,22 +40,22 @@
> [!TIP]
> **New!** Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production - [Get started with no setup required](https://app.strix.ai).
> **全新！** Strix 可与 GitHub Actions 和 CI/CD 流水线无缝集成。在每次拉取请求时自动扫描漏洞，并在不安全代码进入生产环境前将其拦截 - [无需配置即可开始](https://app.strix.ai).
---
## Strix Overview
## Strix 概览
Strix are autonomous AI penetration testing agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proofs-of-concept. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.
Strix 是自主 AI 渗透测试智能体，其行为与真实黑客如出一辙——它们会动态运行你的代码、发现漏洞，并通过实际的概念验证（proof-of-concept，PoC）加以验证。面向需要快速、准确安全测试的开发者和安全团队而构建，无需承担手动渗透测试的开销，也避免了静态分析工具常见的误报。
**Key Capabilities:**
**核心能力：**
- **Full pentesting toolkit** - reconnaissance, exploitation, and validation out of the box
- **Multi-agent orchestration** - teams of AI pentesters that collaborate and scale
- **Real exploit validation** - working PoCs, not false positives like legacy vulnerability scanners
- **Developer‑first CLI** - actionable findings with remediation guidance
- **Auto‑fix & reporting** - generate patches and compliance-ready pentest reports
- **完整渗透测试工具包** - 开箱即用的侦察、利用与验证能力
- **多智能体编排** - 协作并可扩展的 AI 渗透测试团队
- **真实漏洞利用验证** - 提供可用的 PoC，而非传统漏洞扫描器那样的误报
- **开发者优先 CLI** - 提供可操作的发现结果与修复指导
- **自动修复与报告** - 生成补丁及符合合规要求的渗透测试报告
<br>
@@ -62,20 +68,20 @@ Strix are autonomous AI penetration testing agents that act just like real hacke
</div>
## Use Cases
## 使用场景
- **Application Security Testing** - Detect and validate critical vulnerabilities in your applications
- **Rapid Penetration Testing** - Get penetration tests done in hours, not weeks, with compliance reports
- **Bug Bounty Automation** - Automate bug bounty research and generate PoCs for faster reporting
- **CI/CD Integration** - Run tests in CI/CD to block vulnerabilities before reaching production
- **应用安全测试** - 检测并验证应用中的关键漏洞
- **快速渗透测试** - 在数小时而非数周内完成渗透测试，并生成合规报告
- **漏洞赏金自动化** - 自动化漏洞赏金研究，生成 PoC 以加快报告速度
- **CI/CD 集成** - 在 CI/CD 中运行测试，在漏洞进入生产环境前将其拦截
## 🚀 Quick Start
## 🚀 快速开始
**Prerequisites:**
- Docker (running)
- An LLM API key from any [supported provider](https://docs.strix.ai/llm-providers/overview) (OpenAI, Anthropic, Google, etc.)
**前置条件：**
- Docker（已运行）
- 来自任意[受支持提供商](https://docs.strix.ai/llm-providers/overview) (OpenAI、Anthropic、Google 等) 的 LLM API 密钥
### Installation & First Scan
### 安装与首次扫描
```bash
# Install Strix
@@ -90,64 +96,64 @@ strix --target ./app-directory
```
> [!NOTE]
> First run automatically pulls the sandbox Docker image. Results are saved to `strix_runs/<run-name>`
> 首次运行会自动拉取沙箱 Docker 镜像。结果将保存至 `strix_runs/<run-name>`
---
## ☁️ Strix Platform
## ☁️ Strix 平台
Try the Strix full-stack penetration testing platform at **[app.strix.ai](https://app.strix.ai)** - sign up for free, connect your repos and domains, and launch a pentest in minutes.
在 **[app.strix.ai](https://app.strix.ai)** 免费注册，连接你的代码仓库与域名，数分钟内即可启动渗透测试，体验 Strix 全栈渗透测试平台。
- **Validated findings with PoCs** - every vulnerability includes a working proof-of-concept exploit and reproduction steps
- **One-click autofix** - AI-generated security patches as ready-to-merge pull requests
- **Continuous pentesting** - always-on vulnerability scanning that keeps pace with your deployments
- **DevSecOps integrations** - GitHub, GitLab, Bitbucket, Slack, Jira, Linear, and CI/CD pipelines
- **Continuous learning** - AI that builds on past findings, adapts to your codebase, and reduces false positives over time
- **经 PoC 验证的发现** - 每个漏洞均包含可用的概念验证利用代码与复现步骤
- **一键自动修复** - AI 生成的安全补丁，以可直接合并的拉取请求形式提供
- **持续渗透测试** - 始终在线的漏洞扫描，与你的部署节奏保持同步
- **DevSecOps 集成** - 支持 GitHub、GitLab、Bitbucket、Slack、Jira、Linear 及 CI/CD 流水线
- **持续学习** - AI 会基于历史发现持续积累，适配你的代码库，并随时间减少误报
[**Start your first pentest →**](https://app.strix.ai)
[**启动你的首次渗透测试 →**](https://app.strix.ai)
---
## ✨ Features
## ✨ 功能特性
### Agentic Pentesting Tools
### 智能体渗透测试工具
Strix agents come equipped with a comprehensive offensive security toolkit - the same tools used by professional penetration testers and ethical hackers:
Strix 智能体配备全面的进攻性安全工具包——与专业渗透测试人员和道德黑客使用的工具相同：
- **HTTP Interception Proxy** - Full request/response manipulation and analysis with Caido
- **Browser Exploitation** - Automated browser for testing XSS, CSRF, clickjacking, and auth bypass flows
- **Shell & Command Execution** - Interactive terminal for exploit development and post-exploitation
- **Custom Exploit Runtime** - Python sandbox for writing and validating proof-of-concept exploits
- **Reconnaissance & OSINT** - Automated attack surface mapping, subdomain enumeration, and fingerprinting
- **Static & Dynamic Code Analysis** - SAST + DAST capabilities for comprehensive application security testing
- **Vulnerability Knowledge Base** - Structured findings with CVSS scoring and OWASP classification
- **HTTP 拦截代理** - 借助 Caido 实现完整的请求/响应操控与分析
- **浏览器利用** - 自动化浏览器，用于测试 XSS、CSRF、点击劫持及认证绕过流程
- **Shell 与命令执行** - 交互式终端，用于漏洞利用开发与后渗透操作
- **自定义漏洞利用运行时** - Python 沙箱，用于编写并验证概念验证漏洞利用代码
- **侦察与 OSINT** - 自动化攻击面映射、子域名枚举与指纹识别
- **静态与动态代码分析** - SAST + DAST 能力，实现全面的应用安全测试
- **漏洞知识库** - 结构化发现结果，附带 CVSS 评分与 OWASP 分类
### Comprehensive Vulnerability Scanner
### 全面漏洞扫描器
Strix identifies, validates, and exploits a wide range of security vulnerabilities across the OWASP Top 10 and beyond:
Strix 可识别、验证并利用 OWASP Top 10 及更广范围内的各类安全漏洞：
- **Broken Access Control** - IDOR, privilege escalation, auth bypass
- **Injection Attacks** - SQL injection, NoSQL injection, OS command injection, SSTI
- **Server-Side Vulnerabilities** - SSRF, XXE, insecure deserialization, RCE
- **Client-Side Attacks** - XSS (stored/reflected/DOM), prototype pollution, CSRF
- **Business Logic Flaws** - Race conditions, payment manipulation, workflow bypass
- **Authentication & Session** - JWT attacks, session fixation, credential stuffing vectors
- **Infrastructure & Cloud** - Misconfigurations, exposed services, cloud security issues
- **API Security** - Broken authentication, mass assignment, rate limiting bypass
- **访问控制失效** - IDOR、权限提升、认证绕过
- **注入攻击** - SQL 注入、NoSQL 注入、操作系统命令注入、SSTI
- **服务端漏洞** - SSRF、XXE、不安全的反序列化、RCE
- **客户端攻击** - XSS（存储型/反射型/DOM）、原型污染、CSRF
- **业务逻辑缺陷** - 竞态条件、支付操纵、工作流绕过
- **认证与会话** - JWT 攻击、会话固定、凭证填充向量
- **基础设施与云** - 配置错误、暴露服务、云安全问题
- **API 安全** - 认证失效、批量赋值、速率限制绕过
### Graph of Agents (Multi-Agent Pentesting)
### 智能体图谱（多智能体渗透测试）
Advanced multi-agent orchestration for comprehensive automated penetration testing:
先进的多智能体编排，实现全面的自动化渗透测试：
- **Distributed Pentesting** - Specialized AI agents for recon, exploitation, and post-exploitation
- **Scalable Security Testing** - Parallel execution across multiple targets for fast, comprehensive coverage
- **Dynamic Coordination** - Agents share discoveries, chain vulnerabilities, and collaborate like a red team
- **分布式渗透测试** - 专用于侦察、利用与后渗透的 AI 智能体
- **可扩展安全测试** - 跨多个目标并行执行，实现快速、全面的覆盖
- **动态协同** - 智能体共享发现、串联漏洞，像红队一样协作
---
## Usage Examples
## 使用示例
### Basic Usage
### 基础用法
```bash
# Scan a local codebase
@@ -160,7 +166,7 @@ strix --target https://github.com/org/repo
strix --target https://your-app.com
```
### Advanced Testing Scenarios
### 高级测试场景
```bash
# Grey-box authenticated testing
@@ -185,17 +191,17 @@ strix --target api.your-app.com --instruction-file ./instruction.md
strix -n --target ./ --scan-mode quick --scope-mode diff --diff-base origin/main
```
### Headless Mode
### 无头模式（Headless Mode）
Run Strix programmatically without interactive UI using the `-n/--non-interactive` flag - perfect for servers and automated jobs. The CLI prints real-time vulnerability findings and the final report before exiting. Exits with non-zero code when vulnerabilities are found.
使用 `-n/--non-interactive` 标志，即可在无需交互式 UI 的情况下以编程方式运行 Strix，非常适合服务器与自动化任务。CLI 会实时打印漏洞发现结果，并在退出前输出最终报告。若发现漏洞，进程将以非零退出码退出。
```bash
strix -n --target https://your-app.com
```
### CI/CD (GitHub Actions)
### CI/CD（GitHub Actions）
Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:
可将 Strix 集成到你的流水线中，通过轻量级 GitHub Actions 工作流对 Pull Request 执行安全测试：
```yaml
name: strix-penetration-test
@@ -223,11 +229,11 @@ jobs:
```
> [!TIP]
> In CI pull request runs, Strix automatically scopes quick reviews to changed files.
> If diff-scope cannot resolve, ensure checkout uses full history (`fetch-depth: 0`) or pass
> `--diff-base` explicitly.
> 在 CI 的 Pull Request 运行中，Strix 会自动将快速审查范围限定为已变更文件。
> 若 diff-scope 无法解析，请确保 checkout 使用完整历史（`fetch-depth: 0`），或显式传入
> `--diff-base`。
### Configuration
### 配置
```bash
export STRIX_LLM="openai/gpt-5.4"
@@ -240,42 +246,42 @@ export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high,
```
> [!NOTE]
> Strix automatically saves your configuration to `~/.strix/cli-config.json`, so you don't have to re-enter it on every run.
> Strix 会自动将配置保存到 `~/.strix/cli-config.json`，因此你无需在每次运行时重新输入。
**Recommended models for best results:**
**推荐模型（效果最佳）：**
- [OpenAI GPT-5.4](https://openai.com/api/) - `openai/gpt-5.4`
- [Anthropic Claude Sonnet 4.6](https://claude.com/platform/api) - `anthropic/claude-sonnet-4-6`
- [Google Gemini 3 Pro Preview](https://cloud.google.com/vertex-ai) - `vertex_ai/gemini-3-pro-preview`
See the [LLM Providers documentation](https://docs.strix.ai/llm-providers/overview) for all supported providers including Vertex AI, Bedrock, Azure, and local models.
请参阅 [LLM 提供商文档](https://docs.strix.ai/llm-providers/overview)，了解所有受支持的提供商，包括 Vertex AI、Bedrock、Azure 及本地模型。
## Enterprise Pentesting
## 企业级渗透测试
Get the same Strix experience with [enterprise-grade](https://strix.ai/demo) controls: SSO (SAML/OIDC), custom compliance-ready penetration testing reports (SOC 2, ISO 27001, PCI DSS), dedicated support & SLA, custom deployment options (VPC/self-hosted), BYOK model support, and tailored AI pentesting agents optimized for your environment. [Learn more](https://strix.ai/demo).
以 [企业级](https://strix.ai/demo) 管控获得同样的 Strix 体验：SSO（SAML/OIDC）、可定制的合规就绪渗透测试报告（SOC 2、ISO 27001、PCI DSS）、专属支持与 SLA、自定义部署选项（VPC/自托管）、BYOK 模型支持，以及针对你的环境优化的定制 AI 渗透测试智能体。[了解更多](https://strix.ai/demo).
## Documentation
## 文档
Full documentation is available at **[docs.strix.ai](https://docs.strix.ai)** - including detailed guides for usage, CI/CD integrations, skills, and advanced configuration.
完整文档请参阅 **[docs.strix.ai](https://docs.strix.ai)** —— 其中包含用法、CI/CD 集成、技能（skills）及高级配置的详细指南。
## Contributing
## 贡献
We welcome contributions of code, docs, and new skills - check out our [Contributing Guide](https://docs.strix.ai/contributing) to get started or open a [pull request](https://github.com/usestrix/strix/pulls)/[issue](https://github.com/usestrix/strix/issues).
欢迎贡献代码、文档与新技能——查看我们的 [贡献指南](https://docs.strix.ai/contributing) 入门，或提交 [Pull Request](https://github.com/usestrix/strix/pulls)/[issue](https://github.com/usestrix/strix/issues).
## Join Our Community
## 加入社区
Have questions? Found a bug? Want to contribute? **[Join our Discord!](https://discord.gg/strix-ai)**
有问题？发现 Bug？想参与贡献？**[加入我们的 Discord！](https://discord.gg/strix-ai)**
## Support the Project
## 支持本项目
**Love Strix?** Give us a ⭐ on GitHub!
**喜欢 Strix？** 请在 GitHub 上给我们点个 ⭐！
## Acknowledgements
## 致谢
Strix builds on the incredible work of open-source projects like [LiteLLM](https://github.com/BerriAI/litellm), [Caido](https://github.com/caido/caido), [Nuclei](https://github.com/projectdiscovery/nuclei), [Playwright](https://github.com/microsoft/playwright), and [Textual](https://github.com/Textualize/textual). Huge thanks to their maintainers!
Strix 建立在 [LiteLLM](https://github.com/BerriAI/litellm),、[Caido](https://github.com/caido/caido),、[Nuclei](https://github.com/projectdiscovery/nuclei),、[Playwright](https://github.com/microsoft/playwright), 和 [Textual](https://github.com/Textualize/textual). 等优秀开源项目的卓越工作之上。衷心感谢各位维护者！
> [!WARNING]
> Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.
> 仅对你拥有或已获授权测试的应用进行测试。你须对以合乎道德与法律的方式使用 Strix 负责。
</div>