OXO Template Agent

This repo is a template for building an OXO agent in Python. It ships with Good best practices like:

• Github actions workflow
• Linting checks with Ruff
• Static typing checks with Mypy
• Running the unit test with Pytest

Getting Started

Here are links to good resources to get started:

• Write your first Agent
• Use OXO to run scans
• Debugging and Testing Agents
• Understand OXO Internals

Contributing

To contribute to this project, follow these steps:

1. Fork this repository.
2. Clone your forked repository: git clone <your_fork_url>
3. Navigate into your repository's directory: cd <repository_directory>
4. Create a new branch: git checkout -b <branch_name>.
5. Install the dependencies: pip install -r requirements.txt.
6. Make your changes.
7. Ensure the tests pass:

   pip install -r tests/test-requirements.txt
   pytest .

8. Ensure the linter passes:

   ruff format .
   ruff check .

9. Ensure the static type checks pass:

   pip install -r typing-requirements.txt
   mypy

10. Commit your changes: git commit -m '<commit_message>'.
11. Push to the remote branch: git push origin <branch_name>.
12. Create a pull request from the forked repository.

Ideas for Agents to build

Implementation of popular tools like:

• semgrep for source code scanning.
• nbtscan: Scans for open NETBIOS nameservers on your target’s network.
• onesixtyone: Fast scanner to find publicly exposed SNMP services.
• Retire.js: Scanner detecting the use of JavaScript libraries with known vulnerabilities.
• snallygaster: Finds file leaks and other security problems on HTTP servers.
• testssl.sh: Identify various TLS/SSL weaknesses, including Heartbleed, CRIME and ROBOT.
• TruffleHog: Searches through git repositories for high entropy strings and secrets, digging deep into commit history.
• cve-bin-tool: Scan binaries for vulnerable components.
• XSStrike: XSS web vulnerability scanner with generative payload.
• Subjack: Subdomain takeover scanning tool.
• DnsReaper: Subdomain takeover scanning tool.