Skip to content

kiwi-pentesting

Early scaffold, not installable yet

kiwi-pentesting is a scaffold. It has a core library, its data model, a tool catalog and unit tests. The CLI, the GUI and the installer are not there yet, and it is not in the Kiwi catalog. This page describes the design in its README.

A planned containerized CLI and GUI suite for authorized security testing, built for Bluefin-DX with rootless Podman.

The idea

It is designed as a client of kiwi-fox. Each tool runs in a container that joins a kiwi-fox identity's gateway network namespace, so the tool leaves through the same exit (same IP, same DNS) as the browser profile used for the same engagement. kiwi-pentesting does not reimplement any of the network isolation. It attaches to the gateway kiwi-fox already created, so if that gateway dies, the tool has no route either.

Tools are sorted into tiers by how they relate to that proxy: tools that run fully through it, tools that run through it with restricted options, and hardware-local tools that cannot be proxied at all. The last tier requires an explicit acknowledgement and is logged as not anonymized.

Responsible use

The suite is meant for authorized testing only. The design ties every engagement to a written authorization reference, enforces an allowlist of in-scope targets, and appends every invocation, including the identity and exit IP used, to an append-only audit log.