whackamole

automated penetration testing with verified fixes

whackamole attacks your application, proves vulnerabilities are exploitable, generates fixes, and verifies the fixes actually work.

install

npm install
npm run build

usage

attack mode

find and exploit vulnerabilities:

# attack using gaps from static analysis
whackamole attack \
  --base-url http://localhost:3000 \
  --gaps-file gaps.json \
  --output audit-report

# dry run (show targets without attacking)
whackamole attack --dry-run --gaps-file gaps.json

# verbose output
whackamole attack -v --base-url http://localhost:3000 --gaps-file gaps.json

fix mode

attack, generate fixes, and verify:

# full attack -> fix -> verify cycle
whackamole fix \
  --base-url http://localhost:3000 \
  --gaps-file gaps.json \
  --max-fix-attempts 3

# with AI fix generation (requires OPENAI_API_KEY or ANTHROPIC_API_KEY)
export OPENAI_API_KEY=sk-...
whackamole fix --base-url http://localhost:3000 --gaps-file gaps.json

gaps.json format

input file describing vulnerability locations (from static analysis):

{
  "gaps": [
    {
      "categoryId": "sql-injection",
      "categoryName": "SQL Injection", 
      "filePath": "src/api/users.js",
      "lineStart": 25,
      "lineEnd": 30,
      "codeSnippet": "db.query(`SELECT * FROM users WHERE id = ${id}`)",
      "severity": "critical",
      "confidence": "high",
      "endpoint": "/api/users",
      "method": "GET",
      "parameter": "id"
    }
  ]
}

supported vulnerabilities

| category | payloads | detection | |----------|----------|-----------| | sql injection | union, blind, time-based, error-based | response content, timing, errors | | xss | script, img, svg, attribute, polyglot | reflection detection | | command injection | semicolon, pipe, backtick, $() | system file content | | path traversal | ../, encoding variants, null byte | sensitive file content | | ssrf | localhost, cloud metadata, internal | response content | | auth bypass | jwt, session, idor, privilege escalation | unauthorized data access |

cli options

whackamole attack [options]
  -b, --base-url <url>     target application url (default: http://localhost:3000)
  -g, --gaps-file <file>   path to gaps json file (default: gaps.json)
  -o, --output <file>      output report file without extension (default: audit-report)
  -f, --format <format>    report format: json, md, html (default: md)
  -m, --max-requests <n>   maximum http requests (default: 100)
  -d, --delay-ms <ms>      delay between requests (default: 100)
  -t, --timeout <ms>       request timeout (default: 10000)
  --dry-run                show targets without attacking
  -v, --verbose            enable verbose logging

whackamole fix [options]
  (same as attack, plus:)
  --max-fix-attempts <n>   max convergence attempts per vuln (default: 3)

exit codes

| code | meaning | |------|---------| | 0 | no critical/high vulnerabilities found | | 2 | critical or high severity vulnerabilities exploited |

output

markdown report

# Whackamole Security Audit

**Report ID:** WHACK-20260204-XXXX
**Overall Risk Level: CRITICAL**

## Executive Summary
2 exploitable vulnerabilities found...

## Technical Details
### WM-XXXXX: SQL-INJECTION
**Severity:** CRITICAL
**Exploit:** ' OR '1'='1
**Evidence:** All user passwords leaked

json report

full structured data including:

• exploit proofs with request/response
• fix diffs
• verification results

programmatic usage

import { 
  Fuzzer, 
  gapToFuzzTarget,
  generateExploitProof,
  ConvergenceLoop,
  createAiClient,
  generateAuditReport 
} from "whackamole";

// create fuzzer
const fuzzer = new Fuzzer({ targetUrl: "http://localhost:3000" });

// fuzz a target
const target = gapToFuzzTarget(gap, { url: "http://localhost:3000/api/users" });
const result = await fuzzer.fuzzTarget(target);

// generate proof for successful attacks
for (const attack of result.successfulAttacks) {
  const proof = generateExploitProof(gap, attack);
  console.log(proof.evidence.explanation);
}

safety

built-in protections:

• rate limiting: configurable delay between requests
• request caps: maximum total requests per run
• circuit breaker: stops on repeated failures
• host allowlist: prevent attacking production by accident
• dry run mode: preview without sending requests

development

npm run dev          # watch mode
npm run test         # run tests
npm run test:run     # run tests once
npm run lint         # check linting
npm run typecheck    # check types

architecture

src/
  attacks/           # payload library and detection
    payloads/        # sqli, xss, command, path, auth, ssrf
    detector.ts      # exploitation detection heuristics
    proof.ts         # exploit evidence generation
  attacker/          # live attack execution
    http-client.ts   # http with rate limiting
    fuzzer.ts        # payload injection orchestration
  convergence/       # fix generation and verification
    ai-client.ts     # openai/anthropic integration
    fix-generator.ts # template and ai fixes
    verifier.ts      # re-attack verification
    loop.ts          # fix -> verify iteration
    file-ops.ts      # source file manipulation
  output/            # reporting
    audit-report.ts  # md/json/html reports
  safety/            # protection mechanisms
    index.ts         # circuit breakers, rate limits
  cli/               # command line interface
    index.ts         # attack and fix commands

license

mit