IKAREM-PENTEST

Fire at yourself before strangers do.

pip install ikarem-pentest — an active vulnerability scanner for Python APIs that sends real attacks at your own routes and reports what actually happened: statuses, bodies, reflected payloads. In-process via TestClient, so the fast loop needs no server and no network. Part of IKAREM extensions.

$ ikarem-pentest myapp:app
pentest: 6 probes, 6 pass, 0 warn, 0 fail -> CLEAN

01 — COVERAGE

Six probes, each with evidence and a fix.

PT-AUTHN calls every mutating route with no creds — a 2xx is an actively exploitable public write. PT-XSS reflects <script> through query params. PT-SQLI sends injection payloads and flags 500s. PT-REDIRECT tries ?next=https://evil…. PT-BODYCAP floods 2 MB bodies. PT-TRACE induces 500s and scans for tracebacks. Measured on a planted vuln gym: 7/7 recall with a token, 6/7 blind, zero false positives — and the gym caught two real probe misses plus a framework body-cap bug before release.

02 — COMPANY USE

Gates, allowlists, auth, reports.

$ ikarem-pentest myapp:app --strict --format markdown > pentest.md
$ ikarem-pentest myapp:app --strict --ignore PT-BODYCAP
$ IKAREM_PENTEST_TOKEN=... ikarem-pentest myapp:app --serve --all-routes

--strict fails the build on warns too. --ignore records accepted risk (counted, never silent). --token scans behind login. --serve spawns uvicorn, scans, kills it. --all-routes points Nuclei at every GET route instead of just /.

03 — DEPTH

Nuclei when you want the deep scan.

The built-in probes are the seconds-fast loop. For depth, --nuclei drives ProjectDiscovery's Nuclei engine (8000+ community templates, including CISA KEV coverage) against your live server and merges findings into the same report — plus three shipped IKAREM templates (openapi/docs exposure, security headers). Only scan systems you own.

FAQ

Straight answers.

Setup? None — in-process, seconds.

What does it catch? Auth bypass, reflected XSS, injection 500s, open redirects, missing body caps, traceback leaks.

ZAP replacement? Complement: seconds-fast loop here, deep proxy DAST there — and Nuclei bridges the middle.

CI? --strict, exit codes, JSON + Markdown.

Authenticated routes? --token; only PT-AUTHN stays unauthenticated, by design.

KEEP GOING

Secure the login too.

Scanning is half the story — ikarem-oauth adds refresh-token rotation and Google/GitHub login. Back to the extensions hub, the reference, or the guide.