Show HN: Mazinger – AI that tries to break into your web app

7 hours ago 1

Elite AI-Powered Penetration Testing Assistant

An intelligent, collaborative penetration testing CLI that combines the power of AI with professional security tools

Features • Installation • Usage • Commands • Legal

Mazinger is a professional-grade AI penetration testing assistant that speaks like a seasoned ethical hacker. Unlike automated scanners, Mazinger works collaboratively with you - executing one command at a time, explaining findings in technical detail, and suggesting tactical next steps.

Think of it as having an elite pentester sitting next to you, guiding you through security assessments with real-time analysis and expert recommendations.

🌐 Current Focus: Web Application Security

Mazinger v1.0 currently specializes in:

✅ Websites and Web Applications - The primary focus
✅ Web APIs (REST, GraphQL, SOAP)
✅ Web Services and cloud-accessible platforms
✅ Network Services accessible over the internet
✅ Server Infrastructure and configurations

⏳ Coming Soon (See Roadmap):

📱 Mobile App Pentesting (iOS/Android)
💻 Desktop Application Security
🎣 Phishing Campaign Management
📡 Wireless Security (WiFi/Bluetooth)
🔓 Binary Analysis & Reverse Engineering
☁️ Cloud Security Testing
🌐 IoT Device Testing
And everything else needed for comprehensive penetration testing!

🧠 AI-Powered Intelligence - GPT-5 integration with professional hacker personality
⚡ Interactive Command Execution - Real-time terminal integration with live output streaming
🔐 Domain Verification System - Prove ownership before testing (DNS, file upload, or manual verification)
🎭 Professional Pentester Tone - Uses proper security terminology (recon, enum, privesc, RCE, SQLi)
🛠️ Self-Healing Capabilities - Automatically installs missing tools and handles errors
📊 Session Statistics - Track commands executed, session duration, and verified domains
📄 PDF Report Generation - Comprehensive penetration test reports with AI analysis
🎨 Beautiful CLI Design - Animated spinners, progress bars, and typewriter effects
🔄 Auto-Response Prompts - Handles interactive commands (passwords, yes/no questions)

Mazinger executes ONE command at a time, analyzes results, and asks for your approval before proceeding - giving you full control over the engagement.

→ Starting recon on target EXECUTE_COMMAND: nmap -sV -sC demo.owasp-juice.shop [After scan completes] Attack surface mapped: → Port 80: Apache 2.4.41 (CVE-2021-41773 - path traversal → RCE) → Port 443: HTTPS (need to check cert/config) → Port 22: SSH (OpenSSH 7.4, key-based auth) Apache's the weak point. Outdated version with known exploit. Next move: A) Search exploits for Apache RCE B) Enum web directories (find hidden endpoints) C) Check SSL misconfigurations What's the play?

🔐 Domain Ownership Verification

Before testing any domain, Mazinger requires proof of ownership through:

DNS TXT Record - Add a verification token to your DNS
File Upload - Upload verification file to web root
Manual Confirmation - Type 'verified' to confirm ownership
Auto-Approved Targets - localhost, demo.owasp-juice.shop, testphp.vulnweb.com

⏱️ Animated Loaders - Multiple spinner styles with live timers
📊 Progress Bars - Visual feedback for long operations
⌨️ Typewriter Effects - Cinematic startup and shutdown sequences
📈 Live Statistics - Session duration, command count, verified domains
🎯 Command Counter - Track each executed command (#1, #2, #3...)

Full access to professional web pentesting tools:

Category Tools

Network Reconnaissance	nmap, masscan
Web Enumeration	gobuster, ffuf, dirb, dirsearch
Technology Detection	whatweb, wafw00f
Subdomain Discovery	sublist3r, subfinder
Vulnerability Scanning	nikto, nuclei, wapiti
CMS-Specific Scanners	wpscan, joomscan
Database Attacks	sqlmap
XSS Testing	xsser, dalfox
Command Injection	commix
Parameter Discovery	arjun
JWT Analysis	jwt_tool
Web Proxies	burpsuite, OWASP ZAP
HTTP Clients	curl, httpie, wget
Web Login Bruteforce	hydra
Custom Scripts	Create Python/Bash scripts on-the-fly

Python 3.8+ (Python 3.12 recommended)
OpenAI API Key (Get one here)
macOS/Linux (Windows WSL supported)

1️⃣ Clone the repository

git clone https://github.com/ayman8jebari/MAZINGER.git cd MAZINGER

2️⃣ Install dependencies

pip3 install -r requirements.txt

3️⃣ Configure API Key

Option 1: Environment Variable (Recommended)

export OPENAI_API_KEY='your-openai-api-key-here'

Option 2: Config File

cp config.example.txt config.txt # Edit config.txt and paste your API key nano config.txt

Get your API key from: OpenAI API Keys

4️⃣ Run Mazinger

Simply describe what you want to do:

YOU> Scan demo.owasp-juice.shop for open ports YOU> Find SQL injection in the login form YOU> Check if there's an admin panel YOU> Enumerate web directories

Prefix with / to run shell commands directly:

YOU> /ls -la YOU> /pwd YOU> /nmap -sV localhost YOU> /curl -I https://example.com

Before testing your own website:

YOU> verify Enter domain to verify: mywebsite.com [Choose verification method: DNS, File Upload, or Manual]

Command Description

exit / quit	Exit Mazinger
verify	Verify domain ownership
report	Generate PDF penetration test report
stats	Show session statistics
/command	Execute shell command directly

┌─[YOU] └──➤ Test demo.owasp-juice.shop ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ┃ 🤖 MAZINGER │ Session: 2m 15s │ Commands: 3 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Starting recon. EXECUTE_COMMAND: nmap -sV demo.owasp-juice.shop ╔══════════════════════════════════════════════╗ ║ ⚡ EXECUTING COMMAND #1 ║ ╠══════════════════════════════════════════════╣ ║ ➜ nmap -sV demo.owasp-juice.shop ║ ╚══════════════════════════════════════════════╝ ✓ Command started ──────────────────────────────────────────────── PORT STATE SERVICE VERSION 80/tcp open http Node.js Express framework 443/tcp open ssl/http Node.js Express framework ──────────────────────────────────────────────── ✓ Command completed successfully (exit code: 0) [12.45s] Attack surface: → Port 80/443: Node.js Express (web app) → No SSH exposed (good security) Web app's the only entry point. Let's enum directories. Next move: A) Run gobuster to find hidden endpoints B) Check for known vulnerabilities in Express C) Manual web app testing What's the play?

Type stats to view:

⏱️ Session duration
⚡ Commands executed
🎯 Current target
💬 Conversation length
🔐 Verified domains

Type report to generate a comprehensive penetration test report including:

Executive summary
Methodology
Detailed findings
Successful attacks
Recommendations
Command execution log

Mazinger automatically handles interactive prompts:

Password prompts → Auto-responds
Yes/No questions → Auto-responds with 'yes'
FTP login → Anonymous login
Confirmation dialogs → Auto-confirms

IMPORTANT: Only test systems you own or have explicit written authorization to test.

Unauthorized access to computer systems is illegal under:

Computer Fraud and Abuse Act (CFAA) - United States
Computer Misuse Act - United Kingdom
European Cybercrime Convention
Local laws in your jurisdiction

✅ Legal Testing Resources

Practice your skills legally on these platforms:

🧃 OWASP Juice Shop - Intentionally vulnerable web app
🔬 testphp.vulnweb.com - Legal testing target
📦 HackTheBox - Ethical hacking labs
🎮 TryHackMe - Cybersecurity training
🐐 DVWA - Damn Vulnerable Web Application
🔓 VulnHub - Vulnerable VMs

If you find vulnerabilities:

Do NOT exploit them maliciously
Report to the organization privately
Wait for them to patch before public disclosure
Follow responsible disclosure guidelines

┌─────────────────────────────────────────────┐ │ User Interface (CLI) │ │ • Animated spinners & progress bars │ │ • Real-time command output streaming │ │ • Beautiful terminal formatting │ └─────────────────┬───────────────────────────┘ │ ┌─────────────────▼───────────────────────────┐ │ Mazinger AI Engine (GPT-5) │ │ • Professional pentester personality │ │ • One-command-at-a-time execution │ │ • Technical analysis and suggestions │ └─────────────────┬───────────────────────────┘ │ ┌─────────────────▼───────────────────────────┐ │ Command Execution Layer │ │ • pexpect for interactive prompts │ │ • Auto-response system │ │ • Real-time output capture │ └─────────────────┬───────────────────────────┘ │ ┌─────────────────▼───────────────────────────┐ │ Security Tools & Scripts │ │ • nmap, gobuster, sqlmap, nikto, etc. │ │ • Custom script generation │ │ • Auto-installation of missing tools │ └─────────────────────────────────────────────┘

openai>=1.0.0 # AI engine fpdf>=1.7.2 # PDF report generation pexpect>=4.8.0 # Interactive command handling

🗺️ Roadmap - What's Coming Next

Note: Mazinger currently focuses on web application security (v1.0). The features below are planned additions to create a comprehensive penetration testing platform covering ALL attack vectors.

🎯 Next Priority: Expanding Attack Surface

Our goal is to make Mazinger the ultimate AI pentesting assistant for everything - not just websites. Here's what's being added:

🚀 Upcoming Attack Vectors:

📱 Mobile App Pentesting (iOS & Android)
🎣 Phishing & Social Engineering campaigns
💻 Desktop Application Security (Windows/macOS/Linux)
📡 Wireless Testing (WiFi/Bluetooth/RFID)
☁️ Cloud Security (AWS/Azure/GCP)
🔓 Binary Analysis & Reverse Engineering
🌐 IoT & Embedded Systems
🛡️ Physical Security testing
📞 VoIP & Telephony security
🎮 Gaming Platform exploitation
And literally everything else used to compromise systems!

🔧 Core Platform Improvements

Multiple AI model support (Claude, Gemini, local LLMs)
Web UI dashboard for remote access
Team collaboration features
Vulnerability database integration (CVE, NVD)
Automated exploit chaining
Cloud deployment (Docker/Kubernetes)
Plugin system for custom tools
Multi-target concurrent scanning
Real-time collaboration mode
Built-in note taking and reporting

📱 Mobile App Penetration Testing (HIGH PRIORITY)

iOS App Penetration Testing
- IPA file analysis and reverse engineering
- Runtime manipulation with Frida/Objection
- SSL pinning bypass
- Jailbreak detection bypass
- Binary analysis and class dumping
- API endpoint extraction
- Keychain data extraction
Android App Penetration Testing
- APK decompilation and analysis
- Smali code analysis
- Runtime hooking with Frida
- Root detection bypass
- SSL certificate pinning bypass
- Intent fuzzing and activity testing
- SharedPreferences and database extraction
- Native library analysis

Software & Binary Analysis

Desktop Application Testing
- Windows PE analysis (.exe, .dll)
- macOS binary analysis (Mach-O)
- Linux ELF binary analysis
- Debugger integration (gdb, lldb, WinDbg)
- Memory corruption detection
- Reverse engineering automation
Thick Client Testing
- .NET application analysis
- Java desktop app testing
- Electron app security testing
- Protocol analysis (TCP/UDP)
- Local storage inspection

Wireless Security
- WiFi penetration testing (WPA/WPA2/WPA3)
- Bluetooth security assessment
- RFID/NFC analysis
Cloud Security
- AWS/Azure/GCP misconfigurations
- S3 bucket enumeration
- Container escape techniques
- Kubernetes security testing

IoT Device Testing
- Firmware extraction and analysis
- Hardware interface testing (UART, JTAG)
- Embedded system exploitation
API Security
- GraphQL testing
- REST API fuzzing
- OAuth/JWT exploitation
- API rate limit bypass

🎣 Social Engineering & Phishing (HIGH PRIORITY)

Phishing Campaign Management
- Email template creation and customization
- Phishing website cloning and hosting
- Link tracking and analytics
- Credential harvesting (for authorized tests)
- SMS phishing (smishing) capabilities
- Voice phishing (vishing) script generation
- QR code phishing attacks
OSINT (Open Source Intelligence)
- Automated information gathering
- Social media reconnaissance
- Email enumeration and validation
- Username harvesting across platforms
- Leaked credential database searches
- Employee information gathering
- Domain and subdomain discovery
Pretexting & Impersonation
- Fake identity creation
- LinkedIn/social media profiling
- Spear phishing automation
- Business Email Compromise (BEC) testing

Contributions are highly welcome! We're building the ultimate AI-powered hacking assistant and need help in these areas:

🎯 High Priority Contributions Needed

Mobile App Security Features
- iOS app pentesting integration (Frida, Objection)
- Android APK analysis and decompilation
- Mobile runtime hooking frameworks
- SSL pinning bypass automation
Binary & Software Analysis
- Desktop application testing (Windows/macOS/Linux)
- Reverse engineering tools integration
- Debugger automation (gdb, lldb, WinDbg)
- Malware analysis capabilities
Cloud & Infrastructure
- AWS/Azure/GCP security scanning
- Container security testing
- Kubernetes penetration testing
- Cloud misconfiguration detection
Advanced Protocols
- Bluetooth/WiFi testing
- IoT firmware analysis
- Hardware hacking tools
- Custom protocol fuzzing

🍴 Fork the repository
🔨 Create a feature branch (git checkout -b feature/MobileAppTesting)
💾 Commit your changes (git commit -m 'Add iOS app analysis with Frida')
📤 Push to the branch (git push origin feature/MobileAppTesting)
🎉 Open a Pull Request

Code Style: Follow PEP 8 for Python
Documentation: Add clear comments and update README
Testing: Test thoroughly on different platforms
AI Prompts: Update system prompts for new capabilities
Tools: Ensure new tools are auto-installable
Security: All contributions must be for ethical/legal use

Easy (Good First Issues)

Add new security tool integrations
Improve error handling and logging
Add more spinner animations
Enhance PDF report generation

Medium

Mobile app decompilation support
Bluetooth/WiFi testing modules
Cloud security scanners
API fuzzing frameworks

Hard

Binary analysis and reverse engineering
Custom exploit development framework
Multi-target orchestration
Machine learning for vulnerability detection

Contributors will be:

Listed in the README acknowledgments
Credited in release notes
Given contributor badge on GitHub
Invited to core team for significant contributions

This project is licensed under the MIT License - see the LICENSE file for details.

MIT License Copyright (c) 2025 Ayman Jebari Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Ayman Jebari (Zero)