{"id":181810,"date":"2026-05-30T14:48:13","date_gmt":"2026-05-30T12:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vigolium-v0-1-13-beta"},"modified":"2026-05-30T14:48:13","modified_gmt":"2026-05-30T12:48:14","slug":"vigolium-v0-1-13-beta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/vigolium-v0-1-13-beta","title":{"rendered":"Vigolium v0.1.13-beta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><a rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/images\/23496\/original.png\" itemprop=\"contentURL\"><\/p>\n<p>      <img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/05\/6b5dca385b6e09391b374bd74ce93d2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>      <\/a><\/p>\n<p><noindex>      <noindex><\/p>\n<p>Objavljen je po\u010detni otvoreni izdanak <strong><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium\/releases\/tag\/v0.1.13-beta\">Vigolium v0.1.13-beta<\/a><\/strong> \u2014 skenera ranjivosti za web-aplikacije, koji kombinira klasi\u010dno deterministi\u010dko skeniranje s agencijskim revizijama temeljenim na LLM-u. Projekt je dostupan na GitHubu i licenciran je pod <strong>GNU AGPLv3<\/strong>; komercijalni dio premje\u0161ten je u oblak <strong>Cloud Console<\/strong>, dok je jezgra skenera izjavila da je otvorena.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p>Vigolium nudi dva glavna na\u010dina rada: vigolium scan \u2014 obi\u010dna vi\u0161efazna skeniranja s tra\u017eenjem sadr\u017eaja, spideringom kroz preglednik, aktivnim i pasivnim revizijama; i vigolium agent \u2014 agentski na\u010din, gdje LLM bira module, planira napade, generira prilago\u0111ene JavaScript-ekstenzije i kombinira dinami\u010dko testiranje s revizijom izvornog koda.<\/p>\n<p><noindex><\/p>\n<p>Prema podacima <a rel=\"nofollow\" href=\"https:\/\/docs.vigolium.com\/native-scan\/modules-reference\">trenutnog vodi\u010da modula<\/a>, Vigolium uklju\u010duje <strong>251 modul za provjeru<\/strong>, od kojih su <strong>154 aktivna<\/strong> i <strong>97 pasivnih<\/strong>. Aktivni moduli \u0161alju izmijenjene zahtjeve i primjenjuju fuzzing, injekcije i analizu pona\u0161anja, dok pasivni \u2014 analiziraju ve\u0107 postoje\u0107e parove zahtjev\/odgovor bez generiranja dodatnog prometa.<\/p>\n<p><\/noindex><\/p>\n<h3><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium#key-features\">Mogu\u0107nosti<\/a><\/h3>\n<ul>\n<li>\n<p><strong>Native Scan \u2014 obi\u010dna deterministi\u010dka skeniranja.<\/strong><br \/>\nNa\u010din vigolium scan namijenjen je brzim i ponovljivim provjerama. Prolazi kroz nekoliko faza: vanjsko prikupljanje podataka, otkrivanje sadr\u017eaja, browser\/SPA-spidering i reviziju. Ovaj na\u010din je prikladan za CI, redovite provjere i slu\u010dajeve kada je va\u017eno dobiti predvidljiv rezultat bez sudjelovanja LLM-a.<\/p>\n<\/li>\n<li>\n<p><strong>Agentic Scan \u2014 agentska revizija s LLM-om.<\/strong><br \/>\nNa\u010din vigolium agent koristi ugra\u0111eni runtime <strong>olium.<\/strong>Agent mo\u017ee sam tra\u017eiti endpoint-e, birati module, pokretati provjere, analizirati kod, provoditi SAST i ponovo provjeravati otkri\u0107a. Podr\u017eani su scenariji Autopilot, Swarm i Query mode: od autonomnog skeniranja ciljeva do jednokratnih zahtjeva za recenziju koda, tra\u017eenje endpoint-a i otkrivanje tajni.<\/p>\n<\/li>\n<li>\n<p><strong>Provjere XSS, SQLi, NoSQLi, SSTI, LFI, RCE, XXE i SSRF.<\/strong><br \/>\nU vodi\u010du modula navedene su provjere odra\u017eenog XSS-a, SQL injekcija temeljenih na pogre\u0161kama i boolean-based blind SQLi, NoSQL injekcija, server-side template injection, local file inclusion, command injection, XXE, SSRF i out-of-band ranjivosti. Za otkri\u0107a koristi se skala ozbiljnosti od critical do info i skala povjerenja certain, firm, tentative.<\/p>\n<\/li>\n<li>\n<p><strong>OAST provjere za 'slijepu' ranjivost.<\/strong><br \/>\nVigolium mo\u017ee provjeravati blind XSS, blind SSRF, blind XXE i blind RCE putem callback mehanizama, uklju\u010duju\u0107i interactsh. To je potrebno za slu\u010dajeve kada ranjivost nije evidentna u HTTP odgovoru, ali server izvr\u0161ava vanjski DNS\/HTTP zahtjev ili izvodi odlo\u017eenu akciju.<\/p>\n<\/li>\n<li>\n<p><strong>Mutacija svjesna vrijednosti \u2014 mutacija parametara uzimaju\u0107i u obzir zna\u010denje vrijednosti.<\/strong><br \/>\nSkener klasificira parametre prema semanti\u010dkom tipu: broj, UUID, JWT, email i druge varijante, nakon \u010dega prilago\u0111ava mutacije kontekstu. To bi trebalo smanjiti \u0161um u odnosu na grubo umetanje istih payload-a u sva polja bez reda.<\/p>\n<\/li>\n<li>\n<p><strong>Podr\u0161ka za razli\u010dite ulazne formate.<\/strong><br \/>\nKao ulaz mo\u017eete prenijeti URL, specifikacije OpenAPI\/Swagger, Postman kolekcije, podatke iz Burp Suite, cURL i Nuclei JSONL. Tako\u0111er se podr\u017eava slanje URL-a putem stdin i pokretanje pojedinih faza skeniranja.<\/p>\n<\/li>\n<li>\n<p><strong>Autentificirano skeniranje i provjere IDOR\/BOLA.<\/strong><br \/>\nVigolium podr\u017eava vi\u0161e sesija istovremeno: sesije se mogu prenositi inline, u\u010ditavati iz datoteka ili opisivati cjeloviti login tokovi s izvla\u010denjem tokena. Ovo se koristi za provjere horizontalne i vertikalne kontrole pristupa, uklju\u010duju\u0107i IDOR\/BOLA i podizanje privilegija.<\/p>\n<\/li>\n<li>\n<p><strong>Provjere okvira i tipi\u010dne curenja.<\/strong><br \/>\nNa popisu modula postoje provjere za Next.js, Spring\/Java, Django, Flask, FastAPI, Laravel, Symfony, Rails, Express i ASP.NET\/IIS. Na primjer, za Spring se provjeravaju otvoreni Actuator endpoints, Spring Boot Admin, Spring Cloud Config, H2 Console, Jolokia i konzole Java aplikacijskih servera; za Next.js \u2014 curenja putem \/_next\/data, SSRF u Image Optimizeru i zaobila\u017eenja middleware.<\/p>\n<\/li>\n<li>\n<p><strong>JavaScript ekstenzije.<\/strong><br \/>\nKorisnik mo\u017ee pisati vlastite module i hookove na JavaScriptu putem ugra\u0111enog JS engine-a s HTTP API-em koji uzima u obzir sesije. Va\u017eno ograni\u010denje: takve ekstenzije mogu izvr\u0161avati proizvoljne komande i nisu izolovane sandbox-om, stoga ih treba smatrati obi\u010dnim izvr\u0161ivim kodom.<\/p>\n<\/li>\n<li>\n<p><strong>Odvojena faza triage za rezultate.<\/strong><br \/>\nU LLM-assisted security testing \u010desto se javlja problem uvjerljivih, ali neponovljivih nalaza. Autor Vigolium opisuje triage kao zaseban prolaz: prvo skener prikuplja kandidate, zatim zasebna provjera ponovo potvr\u0111uje svaku nalaz s dokazima.<\/p>\n<\/li>\n<li>\n<p><strong>Ograni\u010denja bud\u017eeta za agentni na\u010din.<\/strong><br \/>\nZa agentsko skeniranje mogu\u0107e je ograni\u010diti tokene, broj poziva alata, broj iteracija triage i ukupno vrijeme izvr\u0161enja. To je va\u017eno za CI i pentestove s fiksnim vremenom: agent ne smije neprekidno 'kopati' jednu metu i tro\u0161iti prora\u010dun na slabo korisne hipoteze.<\/p>\n<\/li>\n<li>\n<p><strong>Izvje\u0161taji, redovi i skaliranje.<\/strong><br \/>\nU Native Scan navedeni su konkurentni worker pool, per-host rate limiting, hibridni red u memoriji, na disku ili u Redis-u, kao i samodostatni HTML-izvje\u0161taji. Za izlaz su dostupni console, JSONL i HTML.<\/p>\n<\/li>\n<li>\n<p><strong>Serverski na\u010din, API i integracija s Burp Suite.<\/strong><br \/>\nVigolium se mo\u017ee pokretati kao API-server, prihva\u0107ati promet, uklju\u010divati transparentni HTTP-proxy i automatski skenirati primljene podatke. Za Burp Suite spominje se posebno pro\u0161irenje burp-vigolium, koje omogu\u0107ava slanje live prometa na Vigolium server.<\/p>\n<\/li>\n<li>\n<p><strong>Radna povr\u0161ina i konzola.<\/strong><br \/>\nPored CLI-a, projekt opisuje <strong>Radna povr\u0161ina<\/strong> \u2014 self-hosted alatna plo\u010da za vizualizaciju rezultata, upravljanje projektima i pra\u0107enje otkri\u0107a. <strong>Konzola<\/strong> \u2014 obla\u010dni komercijalni sloj za upravljano skeniranje, centralizirano izvje\u0161tavanje, suradnju i planiranje provjera.<\/p>\n<\/li>\n<\/ul>\n<h3>Instalacija<\/h3>\n<p>Projekt nudi instalaciju putem shell skripte, npm-a, Dockera, Homebrewa, Buna i izgradnje iz izvora. Za gradnju iz izvora u README su navedeni zahtjevi <strong>Go 1.26+<\/strong> i <strong>bun 1.3.11+<\/strong>.<\/p>\n<p>curl -fsSL https:\/\/vigolium.com\/install.sh | bash<\/p>\n<p>npm install -g @vigolium\/vigolium<\/p>\n<p>docker pull j3ssie\/vigolium:latest<br \/>\ndocker run \u2014rm j3ssie\/vigolium:latest scan -h<\/p>\n<p>Programeri posebno upozoravaju da je Vigolium alat za ofenzivnu sigurnost: agentski na\u010din radi bez sandbox-a i dobiva potpuni pristup shell-u, datote\u010dnom sustavu i mre\u017ei doma\u0107ina, a pro\u0161irenja tako\u0111er mogu izvoditi proizvoljne naredbe. Stoga se preporu\u010duje pokretanje agentskih provjera u jednokratnom kontejneru ili virtualnoj ma\u0161ini, ograni\u010denoj okvirom konkretne provjere.<\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18304531\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Vigolium v0.1.13-beta \u2014 \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u043e\u0432\u043c\u0435\u0449\u0430\u044e\u0449\u0435\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0430\u0433\u0435\u043d\u0442\u043d\u044b\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 LLM. \u041f\u0440\u043e\u0435\u043a\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GNU AGPLv3; \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 Cloud Console, \u0442\u043e\u0433\u0434\u0430 \u043a\u0430\u043a \u044f\u0434\u0440\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043e \u043a\u0430\u043a \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0435. Vigolium \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0434\u0432\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u044b: vigolium scan \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":181811,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181810","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/vigolium-v0-1-13-beta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/vigolium-v0-1-13-beta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-30T12:48:14+00:00","article:modified_time":"2026-05-30T12:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/181810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=181810"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/181810\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/181811"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=181810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=181810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=181810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}