htunnthuthu/offsec-ai repository overview

# Run a basic port scan
docker run --rm htunnthuthu/offsec-ai:latest scan example.com

# Check for L7 protection (WAF/CDN)
docker run --rm htunnthuthu/offsec-ai:latest l7-check example.com

# Analyze SSL/TLS certificate chain
docker run --rm htunnthuthu/offsec-ai:latest cert-check example.com

# Full security scan with all features
docker run --rm htunnthuthu/offsec-ai:latest full-scan example.com

# Scan common ports
docker run --rm htunnthuthu/offsec-ai:latest scan google.com

# Scan specific ports
docker run --rm htunnthuthu/offsec-ai:latest scan example.com --ports 80,443,8080,9000

# Scan multiple targets
docker run --rm htunnthuthu/offsec-ai:latest scan google.com cloudflare.com --concurrent 10

# Basic L7 protection check
docker run --rm htunnthuthu/offsec-ai:latest l7-check example.com

# L7 check with DNS tracing
docker run --rm htunnthuthu/offsec-ai:latest l7-check example.com --trace-dns

# Check multiple sites for protection
docker run --rm htunnthuthu/offsec-ai:latest l7-check site1.com site2.com

# Basic certificate analysis
docker run --rm htunnthuthu/offsec-ai:latest cert-check github.com

# Complete certificate chain analysis
docker run --rm htunnthuthu/offsec-ai:latest cert-chain example.com

# Detailed certificate information with PEM format
docker run --rm htunnthuthu/offsec-ai:latest cert-info example.com --show-pem

# Certificate analysis with custom port
docker run --rm htunnthuthu/offsec-ai:latest cert-check example.com --port 8443

# Save certificate analysis results
docker run --rm -v $(pwd)/results:/app/output \
  htunnthuthu/offsec-ai:latest cert-chain example.com \
  --output /app/output/cert-analysis.json

# Verify hostname against certificate
docker run --rm htunnthuthu/offsec-ai:latest cert-check example.com --no-verify-hostname

# Enable revocation checking (OCSP/CRL)
docker run --rm htunnthuthu/offsec-ai:latest cert-chain example.com --check-revocation

# Check mTLS support
docker run --rm htunnthuthu/offsec-ai:latest mtls-check example.com

# Test with client certificates (mount volume)
docker run --rm -v /path/to/certs:/certs \
  htunnthuthu/offsec-ai:latest mtls-check example.com \
  --client-cert /certs/client.crt --client-key /certs/client.key

# Generate test certificates
docker run --rm -v $(pwd)/certs:/output \
  htunnthuthu/offsec-ai:latest mtls-gen-cert test.example.com \
  --output-dir /output

# Full scan with all features
docker run --rm htunnthuthu/offsec-ai:latest full-scan example.com

# Save results to host system
docker run --rm -v $(pwd)/results:/app/output \
  htunnthuthu/offsec-ai:latest full-scan example.com \
  --output /app/output/security-report.json

# Verbose output with detailed logging
docker run --rm htunnthuthu/offsec-ai:latest full-scan example.com --verbose

- name: Security Port Scan
  run: |
    docker run --rm -v ${{ github.workspace }}/reports:/app/output \
      htunnthuthu/offsec-ai:latest full-scan ${{ env.TARGET_HOST }} \
      --output /app/output/security-scan.json

- name: Certificate Analysis
  run: |
    docker run --rm -v ${{ github.workspace }}/reports:/app/output \
      htunnthuthu/offsec-ai:latest cert-chain ${{ env.TARGET_HOST }} \
      --output /app/output/cert-analysis.json --check-revocation

security_scan:
  image: docker:latest
  script:
    - docker run --rm -v $PWD/reports:/app/output 
        htunnthuthu/offsec-ai:latest full-scan $TARGET_HOST 
        --output /app/output/security-scan.json
    - docker run --rm -v $PWD/reports:/app/output
        htunnthuthu/offsec-ai:latest cert-chain $TARGET_HOST
        --output /app/output/cert-analysis.json
  artifacts:
    reports:
      paths:
        - reports/security-scan.json
        - reports/cert-analysis.json

pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh '''
                    docker run --rm -v $WORKSPACE/reports:/app/output \
                      htunnthuthu/offsec-ai:latest full-scan $TARGET_HOST \
                      --output /app/output/security-scan.json
                '''
                sh '''
                    docker run --rm -v $WORKSPACE/reports:/app/output \
                      htunnthuthu/offsec-ai:latest cert-chain $TARGET_HOST \
                      --output /app/output/cert-analysis.json --verbose
                '''
                archiveArtifacts artifacts: 'reports/*.json'
            }
        }
    }
}

version: '3.8'
services:
  port-scanner:
    image: htunnthuthu/offsec-ai:latest
    command: full-scan example.com --output /app/output/results.json
    volumes:
      - ./scan-results:/app/output
    environment:
      - TARGET_HOST=example.com
      
  cert-analyzer:
    image: htunnthuthu/offsec-ai:latest
    command: cert-chain example.com --output /app/output/cert-analysis.json --check-revocation
    volumes:
      - ./cert-results:/app/output
    environment:
      - TARGET_HOST=example.com

apiVersion: batch/v1
kind: Job
metadata:
  name: security-port-scan
spec:
  template:
    spec:
      containers:
      - name: port-scanner
        image: htunnthuthu/offsec-ai:latest
        command: ["offsec-ai", "full-scan", "example.com"]
        volumeMounts:
        - name: results-volume
          mountPath: /app/output
      volumes:
      - name: results-volume
        persistentVolumeClaim:
          claimName: scan-results-pvc
      restartPolicy: Never
---
apiVersion: batch/v1
kind: Job
metadata:
  name: certificate-analysis
spec:
  template:
    spec:
      containers:
      - name: cert-analyzer
        image: htunnthuthu/offsec-ai:latest
        command: ["offsec-ai", "cert-chain", "example.com", "--output", "/app/output/cert-analysis.json"]
        volumeMounts:
        - name: cert-volume
          mountPath: /app/output
      volumes:
      - name: cert-volume
        persistentVolumeClaim:
          claimName: cert-results-pvc
      restartPolicy: Never

docker run --rm htunnthuthu/offsec-ai:latest \
  ai-owasp-scan https://api.example.com/v1/chat/completions

# OpenAI judge
docker run --rm \
  -e OPENAI_API_KEY=sk-... \
  htunnthuthu/offsec-ai:latest \
  ai-owasp-scan https://api.example.com/v1/chat/completions --llm-judge

# Anthropic judge
docker run --rm \
  -e ANTHROPIC_API_KEY=sk-ant-... \
  htunnthuthu/offsec-ai:latest \
  ai-owasp-scan https://api.example.com/v1/chat/completions --llm-judge

# Google Gemini judge (no extra package needed)
docker run --rm \
  -e GEMINI_API_KEY=AIzaSy... \
  htunnthuthu/offsec-ai:latest \
  ai-owasp-scan https://api.example.com/v1/chat/completions --llm-judge

# Custom OpenAI-compatible endpoint (Ollama, LM Studio, Azure OpenAI, etc.)
docker run --rm \
  -e OFFSEC_LLM_BASE_URL=http://host.docker.internal:11434/v1 \
  -e OFFSEC_LLM_MODEL=llama3 \
  htunnthuthu/offsec-ai:latest \
  ai-owasp-scan https://api.example.com/v1/chat/completions --llm-judge

# Scan an MCP endpoint
docker run --rm htunnthuthu/offsec-ai:latest \
  mcp-scan https://mcp.example.com/mcp

# Active MCP attack (requires authorization flag)
docker run --rm htunnthuthu/offsec-ai:latest \
  mcp-attack https://mcp.example.com/mcp --i-have-authorization --mode deep

# Set timeout for operations
docker run --rm -e TIMEOUT=30 htunnthuthu/offsec-ai:latest scan example.com

# Enable debug logging
docker run --rm -e DEBUG=1 htunnthuthu/offsec-ai:latest l7-check example.com

# Certificate analysis timeout
docker run --rm -e CERT_TIMEOUT=15 htunnthuthu/offsec-ai:latest cert-chain example.com

# Mount configuration directory
docker run --rm -v /host/config:/app/config \
  htunnthuthu/offsec-ai:latest scan example.com

# Mount output directory for reports
docker run --rm -v /host/reports:/app/output \
  htunnthuthu/offsec-ai:latest full-scan example.com \
  --output /app/output/report.json

# Mount certificate directory for mTLS
docker run --rm -v /host/certs:/app/certs \
  htunnthuthu/offsec-ai:latest mtls-check example.com \
  --client-cert /app/certs/client.crt --client-key /app/certs/client.key

# Structured JSON for automation
docker run --rm htunnthuthu/offsec-ai:latest scan example.com --format json

# Pretty printed JSON
docker run --rm htunnthuthu/offsec-ai:latest scan example.com --format json --pretty

# Certificate analysis in JSON format
docker run --rm htunnthuthu/offsec-ai:latest cert-chain example.com --output cert-results.json

# Human readable text (default)
docker run --rm htunnthuthu/offsec-ai:latest scan example.com

# Verbose text output
docker run --rm htunnthuthu/offsec-ai:latest scan example.com --verbose

# CSV format for spreadsheet import
docker run --rm htunnthuthu/offsec-ai:latest scan example.com --format csv

# Ensure proper volume permissions
docker run --rm -v $(pwd)/output:/app/output:Z \
  htunnthuthu/offsec-ai:latest scan example.com \
  --output /app/output/results.json

# Test network connectivity
docker run --rm htunnthuthu/offsec-ai:latest scan google.com

# Use host networking if needed
docker run --rm --network host \
  htunnthuthu/offsec-ai:latest scan localhost

# Debug certificate chain retrieval
docker run --rm htunnthuthu/offsec-ai:latest cert-check example.com --verbose

# Disable hostname verification for testing
docker run --rm htunnthuthu/offsec-ai:latest cert-check example.com --no-verify-hostname

# Test certificate with custom port
docker run --rm htunnthuthu/offsec-ai:latest cert-info example.com --port 8443

# Show certificate in PEM format for inspection
docker run --rm htunnthuthu/offsec-ai:latest cert-info example.com --show-pem

# Enable verbose logging
docker run --rm htunnthuthu/offsec-ai:latest scan example.com --verbose

# Get version information
docker run --rm htunnthuthu/offsec-ai:latest --version

# Display help
docker run --rm htunnthuthu/offsec-ai:latest --help

# Adjust concurrency for better performance
docker run --rm htunnthuthu/offsec-ai:latest scan example.com --concurrent 20

# Scan multiple targets efficiently
docker run --rm htunnthuthu/offsec-ai:latest scan \
  site1.com site2.com site3.com --concurrent 10

# Set memory limits
docker run --rm --memory=512m htunnthuthu/offsec-ai:latest scan example.com

# Set CPU limits
docker run --rm --cpus=2 htunnthuthu/offsec-ai:latest full-scan example.com

# Build the image locally
make docker-build

# Build without cache
make docker-build-no-cache

# Build multi-arch (linux/amd64 + linux/arm64) — requires docker buildx
make docker-build-multi

# Push to Docker Hub (builds first, then tags + pushes :version and :latest)
make docker-push                              # uses DOCKER_USERNAME=htunnthuthu by default
make docker-push DOCKER_USERNAME=youruser     # override username

# Full release in one command
make docker-release                           # equivalent to docker-build + docker-push

# Test the local image
make docker-test

# Scan image for vulnerabilities (requires trivy)
make docker-scan

# Clean up local Docker artifacts
make docker-clean