{"id":181810,"date":"2026-05-30T14:48:13","date_gmt":"2026-05-30T12:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vigolium-v0-1-13-beta"},"modified":"2026-05-30T14:48:13","modified_gmt":"2026-05-30T12:48:14","slug":"vigolium-v0-1-13-beta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vigolium-v0-1-13-beta","title":{"rendered":"Vigolium v0.1.13-beta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><a rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/images\/23496\/original.png\" itemprop=\"contentURL\"><\/p>\n<p>      <img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/05\/6b5dca385b6e09391b374bd74ce93d2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>      <\/a><\/p>\n<p><noindex>      <noindex><\/p>\n<p>Initial open release published <strong><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium\/releases\/tag\/v0.1.13-beta\">Vigolium v0.1.13-beta<\/a><\/strong> \u2014 a vulnerability scanner for web applications that combines traditional deterministic scanning with agent-based auditing based on LLM. The project is available on GitHub and is distributed under a license <strong>GNU AGPLv3<\/strong>; the commercial part is moved to the cloud <strong>Cloud Console<\/strong>, while the core scanner is stated to be open-source.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p>Vigolium offers two main modes of operation: vigolium scan \u2014 a standard multi-step scan with content discovery, browser spidering, active and passive auditing; and vigolium agent \u2014 an agent mode where LLM selects modules, plans attacks, generates custom JavaScript extensions, and combines dynamic testing with source code auditing.<\/p>\n<p><noindex><\/p>\n<p>According to data <a rel=\"nofollow\" href=\"https:\/\/docs.vigolium.com\/native-scan\/modules-reference\">current module reference<\/a>, Vigolium includes <strong>251 verification modules<\/strong>, of which <strong>154 are active<\/strong> and <strong>97 are passive<\/strong>. Active modules send altered requests and apply fuzzing, injections, and behavioral analysis, while passive ones analyze existing request\/response pairs without generating additional traffic.<\/p>\n<p><\/noindex><\/p>\n<h3><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium#key-features\">Capabilities<\/a><\/h3>\n<ul>\n<li>\n<p><strong>Native Scan \u2014 standard deterministic scanning.<\/strong><br \/>\nThe vigolium scan mode is designed for quick and reproducible checks. It goes through several phases: external data gathering, content discovery, browser\/SPA-spidering, and auditing. This mode is convenient for CI, regular checks, and cases where it's crucial to obtain predictable results without LLM involvement.<\/p>\n<\/li>\n<li>\n<p><strong>Agentic Scan \u2014 agent-based auditing with LLM.<\/strong><br \/>\nThe vigolium agent mode uses an integrated runtime <strong>olium<\/strong>. The agent can autonomously search for endpoints, select modules, run checks, analyze code, perform SAST, and recheck findings. Autopilot, Swarm, and Query mode scripts are supported: from autonomous scanning of targets to one-off requests for code reviews, endpoint searches, and secret discovery.<\/p>\n<\/li>\n<li>\n<p><strong>Checks for XSS, SQLi, NoSQLi, SSTI, LFI, RCE, XXE, and SSRF.<\/strong><br \/>\nThe module reference lists checks for reflected XSS, SQL injections via errors and boolean-based blind SQLi, NoSQL injections, server-side template injection, local file inclusion, command injection, XXE, SSRF, and out-of-band vulnerabilities. Findings use a severity scale from critical to info and a confidence scale of certain, firm, tentative.<\/p>\n<\/li>\n<li>\n<p><strong>OAST checks for 'blind' vulnerabilities.<\/strong><br \/>\nVigolium can detect blind XSS, blind SSRF, blind XXE, and blind RCE through callback mechanisms, including via interactsh. This is necessary for cases where the vulnerability does not manifest directly in the HTTP response, but the server makes an external DNS\/HTTP request or performs a delayed action.<\/p>\n<\/li>\n<li>\n<p><strong>Value-aware mutation - mutation of parameters considering the semantics of the value.<\/strong><br \/>\nThe scanner classifies parameters by semantic type: number, UUID, JWT, email, and other options, then selects mutations based on context. This should reduce noise compared to naively substituting the same payloads in all fields consecutively.<\/p>\n<\/li>\n<li>\n<p><strong>Support for various input formats.<\/strong><br \/>\nAs input, you can provide URLs, OpenAPI\/Swagger specifications, Postman collections, data from Burp Suite, cURL, and Nuclei JSONL. URL input through stdin and running separate scanning phases are also supported.<\/p>\n<\/li>\n<li>\n<p><strong>Authenticated scanning and IDOR\/BOLA checks.<\/strong><br \/>\nVigolium supports multiple sessions simultaneously: sessions can be passed inline, loaded from files, or described through full login flows with token extraction. This is used for checking horizontal and vertical access control, including IDOR\/BOLA and privilege escalation.<\/p>\n<\/li>\n<li>\n<p><strong>Framework checks and typical leaks.<\/strong><br \/>\nThe module list includes checks for Next.js, Spring\/Java, Django, Flask, FastAPI, Laravel, Symfony, Rails, Express, and ASP.NET\/IIS. For example, for Spring, it checks open Actuator endpoints, Spring Boot Admin, Spring Cloud Config, H2 Console, Jolokia, and Java application server consoles; for Next.js \u2014 leaks through \/_next\/data, SSRF in Image Optimizer, and bypasses middleware.<\/p>\n<\/li>\n<li>\n<p><strong>JavaScript extensions.<\/strong><br \/>\nUsers can write their own modules and hooks in JavaScript through the built-in JS engine with an HTTP API that considers sessions. An important limitation: such extensions can execute arbitrary commands and are not sandboxed, so they should be treated as regular executable code.<\/p>\n<\/li>\n<li>\n<p><strong>Separate triage phase for results.<\/strong><br \/>\nIn LLM-assisted security testing, there is often the problem of plausible but non-reproducible findings. The author of Vigolium describes triage as a separate pass: first, the scanner collects candidates, then a separate check revalidates each finding against the evidence.<\/p>\n<\/li>\n<li>\n<p><strong>Budget constraints for agent mode.<\/strong><br \/>\nFor agent-based scanning, you can limit tokens, number of tool calls, triage iterations, and total execution time. This is crucial for CI and pentests with fixed timelines: the agent should not endlessly \"dig\" into one target, burning the budget on low-value hypotheses.<\/p>\n<\/li>\n<li>\n<p><strong>Reports, queue, and scaling.<\/strong><br \/>\nNative Scan features a competitive worker pool, per-host rate limiting, a hybrid queue in memory, on disk, or in Redis, as well as self-sufficient HTML reports. Outputs are available in console, JSONL, and HTML formats.<\/p>\n<\/li>\n<li>\n<p><strong>Server mode, API, and integration with Burp Suite.<\/strong><br \/>\nVigolium can run as an API server, accept traffic, enable a transparent HTTP proxy, and automatically scan the received data. A separate burp-vigolium extension is mentioned for Burp Suite, allowing live traffic to be sent to the Vigolium server.<\/p>\n<\/li>\n<li>\n<p><strong>Workbench and Console.<\/strong><br \/>\nIn addition to CLI, the project describes <strong>Workbench<\/strong> \u2014 a self-hosted dashboard for visualizing results, managing projects, and tracking findings. <strong>Console<\/strong> \u2014 a cloud commercial layer for managed scanning, centralized reporting, collaboration, and audit planning.<\/p>\n<\/li>\n<\/ul>\n<h3>Installation<\/h3>\n<p>The project offers installation via shell script, npm, Docker, Homebrew, Bun, and building from source. The README specifies requirements for building from source <strong>Go 1.26+<\/strong> and <strong>bun 1.3.11+<\/strong>.<\/p>\n<p>curl -fsSL https:\/\/vigolium.com\/install.sh | bash<\/p>\n<p>npm install -g @vigolium\/vigolium<\/p>\n<p>docker pull j3ssie\/vigolium:latest<br \/>\ndocker run --rm j3ssie\/vigolium:latest scan -h<\/p>\n<p>Developers specifically warn that Vigolium is an offensive security tool: agent mode runs without a sandbox and gains full access to the shell, file system, and host network, while extensions can also execute arbitrary commands. Therefore, agent checks are recommended to be run in a disposable container or a virtual machine, limited to the scope of the specific testing.<\/p>\n<p>Source: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18304531\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Vigolium v0.1.13-beta \u2014 \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u043e\u0432\u043c\u0435\u0449\u0430\u044e\u0449\u0435\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0430\u0433\u0435\u043d\u0442\u043d\u044b\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 LLM. \u041f\u0440\u043e\u0435\u043a\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GNU AGPLv3; \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 Cloud Console, \u0442\u043e\u0433\u0434\u0430 \u043a\u0430\u043a \u044f\u0434\u0440\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043e \u043a\u0430\u043a \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0435. Vigolium \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0434\u0432\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u044b: vigolium scan \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":181811,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181810","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/vigolium-v0-1-13-beta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/vigolium-v0-1-13-beta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-30T12:48:14+00:00","article:modified_time":"2026-05-30T12:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=181810"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181810\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/181811"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=181810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=181810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=181810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}