open-sploit

YOLO offensive-security agent + /target engagement command for opencode. Full-scope pen-testing through Kali Linux (WSL2), Burp Suite MCP, and Playwright.

What you get

• offsec agent — pure offensive operator: recon → enumeration → exploitation → post-exploitation → report. No defensive fluff.
• /target <url> command — one slash command to run a full engagement end to end. It classifies the target (web / API / PHP) and auto-loads the matching attack skills.
• 19 attack skills installed into ~/.config/opencode/skills/ — battle-tested technique playbooks for every major web vulnerability class.
• YOLO permissions — every action auto-approved (read/edit/bash/external dirs/web).
• Kali (WSL2) routing — all tooling runs through wsl -d kali-linux (nmap, sqlmap, metasploit, ffuf, hashcat, impacket, …).
• Playwright MCP — real browser for login flows, session/auth handling, CSRF, XSS, SSO/OAuth, DOM bugs, screenshot evidence.
• Burp MCP (auto-detected on Windows) — interception, scanning, repeater attack flows.

Installed skill library

| Category | Skills | | --- | --- | | Frameworks | web-app-penetration-testing, owasp-top-10-testing, api-security-testing, conducting-api-security-testing, hackerone | | Injection | exploiting-sql-injection-vulnerabilities, exploiting-sql-injection-with-sqlmap, exploiting-nosql-injection-vulnerabilities, exploiting-api-injection-vulnerabilities, exploiting-template-injection-vulnerabilities | | Server-side risk | exploiting-server-side-request-forgery, exploiting-http-request-smuggling, exploiting-websocket-vulnerabilities, exploiting-race-condition-vulnerabilities | | Access control | exploiting-idor-vulnerabilities, exploiting-prototype-pollution-in-javascript | | Auth & tokens | exploiting-jwt-algorithm-confusion-attack, exploiting-oauth-misconfiguration, exploiting-type-juggling-vulnerabilities |

The /target command auto-routes: web target → injection/SSRF/smuggling/access-control skills, API target → API skills, PHP backend → type-juggling, and any bug-bounty flow → hackerone.

Install

npx open-sploit

It copies agent/offsec.md + command/target.md into ~/.config/opencode/, installs the 19 attack skills into ~/.config/opencode/skills/ (skipping any you already have), and safely merges permissions, the offsec agent, and MCP servers into your opencode.json. Your existing config is preserved — only missing/permission keys are added.

Then restart opencode.

Prerequisites

• opencode installed
• Kali Linux in WSL2 with distro name kali-linux (Windows) — or any host with wsl + Kali
• npx (comes with Node.js ≥ 18)
• Optional: Burp Suite with the MCP server extension on 127.0.0.1:9876

Usage

/target http://10.10.10.10
# or
/target example.com — scope: *.example.com, in-scope only
# or
/target https://api.example.com/openapi.json

The agent classifies the target, auto-loads the matching attack skills, then runs the full pipeline: OSINT → nmap/masscan → ffuf/gobuster → browser-assisted auth & client-side testing → exploit → collect flags/creds → ranked report with PoCs and screenshots.

Uninstall

rm -rf ~/.config/opencode/skills ~/.config/opencode/agent/offsec.md ~/.config/opencode/command/target.md

Then remove the offsec entry and added mcp servers from ~/.config/opencode/opencode.json.

Customizing

• Point Kali tools at a different distro: rename kali-linux in agent/offsec.md.
• Burp proxy at 127.0.0.1:9876 by default — edit the burp MCP entry in opencode.json if yours differs.

⚠️ Legal

This installs YOLO allow-all permissions and an offensive-security automation. Only use it against systems you own or have explicit written authorization to test. Unauthorized access is a crime in most jurisdictions. The authors are not responsible for misuse.

License

MIT