Download the PHP package librevlad/basilisk without Composer

Basilisk

Professional modular security framework for autonomous reconnaissance, analysis, and pentesting.

188 auto-discovered plugins across 10 categories, all wrapped as v4 Scenarios. Unified autonomous engine with knowledge graph, deterministic decision traces, cognitive reasoning, and persistent campaign memory. Rich live visualization with real-time progress tracking. Training validation benchmarked against 20 vulnerable containers (298 expected findings) with ~97% guided validation coverage.

Quick Start

Architecture Overview

Autonomous Engine

The autonomous engine builds a knowledge graph about the target and iteratively discovers knowledge gaps, selects optimal plugins to fill them, executes them, and merges results back into the graph. Each decision is recorded with full context for reproducibility.

Cycle: find gaps -> match capabilities -> score -> decide -> execute -> observe -> merge -> hypothesize -> revise beliefs -> repeat

Terminates when:

• no_gaps — all knowledge gaps filled (audit complete)
• limit_reached — max_steps or max_duration exceeded
• no_capabilities — remaining gaps can't be filled by available plugins
• no_candidates — all candidates already executed or on cooldown

Knowledge Graph

Central world model storing all information about audit targets. 9 typed entity types and 11 relation types form a graph that grows with each autonomous cycle iteration.

9 Entity Types

11 Relation Types

Deterministic IDs and Deduplication

Entity IDs are SHA256 hashes of key fields — identical inputs always produce the same ID. When a plugin produces an entity with an existing ID, it's merged instead of duplicated:

Persistence

Knowledge graph persists to SQLite via KnowledgeStore (tables: kg_entities, kg_relations). Decision history persists to decision_history.json.

Gap Detection (Planner)

The Planner examines the knowledge graph and identifies 18 types of knowledge gaps:

Capabilities and Scoring

Capability Model

Each plugin maps to a Capability with 4 action types:

145 plugins explicitly mapped in CAPABILITY_MAP. The rest use auto-inference from PluginMeta/ScenarioMeta.

Scoring Formula

Cognitive Reasoning

Deterministic reasoning primitives over the knowledge graph. No AI/LLM — pure pattern logic.

Hypothesis Engine

Generates testable hypotheses from 5 pattern detectors:

Evidence Aggregator

Belief revision based on source-family independence (6 families: dns, network_scan, http_probe, exploit, config_leak, verification).

• Evidence from 2+ independent source families → independence bonus (+0.05 per family, max +0.15)
• Contradicting evidence → penalty (-0.1)
• Per-step belief revision with confidence clamped to [0.1, 1.0]

Container Security Audit

Integrated subsystem for auditing Docker/K8s infrastructure. Automatically detects container runtimes, enumerates containers and images, audits configurations, and probes escape vectors.

7 plugins: container_discovery -> container_enumeration -> registry_lookup -> image_fingerprint -> container_config_audit -> container_escape_probe -> container_verification

Training Validation

Benchmarking system for measuring detection coverage against known vulnerable targets. Each training profile defines a target, Docker compose configuration, authentication, scan paths, and expected findings. The validator uses multi-strategy matching (title containment, abbreviation expansion, category aliases, word overlap) with ±1 severity tolerance.

Benchmark Results (20 containers, 298 expected findings)

Guided validation coverage: ~97% (289/297) across 19 tested containers, 13 at 100%.

Note: Coverage is measured with pre-seeded endpoints, configured authentication, and multi-strategy validator matching. This measures the framework's detection capability when given optimal conditions, not blind discovery from scratch.

Decision Tracing

Every autonomous decision is recorded with full context for auditability and debugging.

Pre-execution (before plugin runs):

• Context snapshot (entity/relation/gap counts, active hypotheses)
• All evaluated candidates with score breakdowns (max 20)
• Chosen plugin, target, score, reasoning trace, action type
• Related hypothesis IDs and resolution gain

Post-execution (after plugin runs):

• Observation count, new entity count, confidence delta, duration
• was_productive flag (new_entities > 0 or confidence_delta > 0.01)

14 event types: ENTITY_CREATED, ENTITY_UPDATED, OBSERVATION_APPLIED, PLUGIN_STARTED, PLUGIN_FINISHED, GAP_DETECTED, STEP_COMPLETED, DECISION_MADE, GOAL_ADVANCED, AUDIT_COMPLETED, BELIEF_STRENGTHENED, BELIEF_WEAKENED, HYPOTHESIS_CONFIRMED, HYPOTHESIS_REJECTED.

Campaign Memory

Persistent cross-audit learning. Remembers infrastructure, plugin effectiveness, and technology stacks across audits. Opt-in, disabled by default.

What it learns:

• Target profiles — services, technologies, endpoints, findings per host
• Plugin efficacy — per-plugin success rates with tech-stack breakdown
• Tech fingerprints — technology patterns per organization (base domain)

How it helps:

• Adjusts plugin cost based on historical success rate
• Adds prior bonus for known infrastructure
• Data stored in ~/.basilisk/campaigns/campaign.db (SQLite WAL)

Plugin System

188 Plugins (10 categories)

All 188 plugins are automatically wrapped as v4 Scenarios via bridge/legacy_scenario.py. 5 native v4 scenarios in scenarios/.

Writing a Plugin

Drop into basilisk/plugins/<category>/ — auto-discovered at startup.

Signature Databases

Project Structure

Stack

• Python 3.12+ target
• Pydantic v2 — data models and validation
• aiohttp — async HTTP with connection pooling
• aiosqlite — async SQLite (WAL mode)
• dnspython — async DNS resolution
• aiolimiter — token bucket rate limiting
• aiofiles — async file I/O (streaming wordlists)
• Typer + Rich — CLI
• cryptography — SSL certificate parsing
• uv — package manager
• ruff — linting (py312, line-length 100)
• pytest + pytest-asyncio — testing (asyncio_mode = auto)

Development

License

MIT