{"id":181810,"date":"2026-05-30T14:48:13","date_gmt":"2026-05-30T12:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vigolium-v0-1-13-beta"},"modified":"2026-05-30T14:48:13","modified_gmt":"2026-05-30T12:48:14","slug":"vigolium-v0-1-13-beta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/news\/vigolium-v0-1-13-beta","title":{"rendered":"Vigolium v0.1.13-beta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><a rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/images\/23496\/original.png\" itemprop=\"contentURL\"><\/p>\n<p>      <img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/05\/6b5dca385b6e09391b374bd74ce93d2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>      <\/a><\/p>\n<p><noindex>      <noindex><\/p>\n<p>Den f\u00f8rste \u00e5pne utgivelsen er publisert <strong><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium\/releases\/tag\/v0.1.13-beta\">Vigolium v0.1.13-beta<\/a><\/strong> \u2014 av s\u00e5rbarhetsskanneren for webapplikasjoner, som kombinerer klassisk deterministisk skanning med agentbasert revisjon basert p\u00e5 LLM. Prosjektet er tilgjengelig p\u00e5 GitHub og distribueres under lisensen <strong>GNU AGPLv3<\/strong>; den kommersielle delen er flyttet til skyen <strong>Cloud Console<\/strong>, mens kjernen av skanneren er erkl\u00e6rt som \u00e5pen.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p>Vigolium tilbyr to hoveddriftsmodi: vigolium scan \u2014 vanlig flerstegs skanning med innholds\u00f8kting, spidering via nettleser, aktiv og passiv revisjon; og vigolium agent \u2014 agentmodus, der LLM velger moduler, planlegger angrep, genererer brukerdefinerte JavaScript-utvidelser og kombinerer dynamisk testing med revisjon av kildekoden.<\/p>\n<p><noindex><\/p>\n<p>If\u00f8lge <a rel=\"nofollow\" href=\"https:\/\/docs.vigolium.com\/native-scan\/modules-reference\">oppdatert modulkatalog<\/a>, Vigolium inkluderer <strong>251 valideringsmoduler<\/strong>, av dem <strong>154 aktive<\/strong> og <strong>97 passive<\/strong>. Aktive moduler sender endrede foresp\u00f8rsel og benytter fuzzing, injeksjoner og atferdsanalyse, passive \u2014 analyserer allerede eksisterende foresp\u00f8rsel\/tilbud-par uten \u00e5 generere ekstra trafikk.<\/p>\n<p><\/noindex><\/p>\n<h3><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium#key-features\">Funksjoner<\/a><\/h3>\n<ul>\n<li>\n<p><strong>Native Scan \u2014 vanlig deterministisk skanning.<\/strong><br \/>\nModus vigolium scan er ment for raske og reproduserbare kontroller. Den g\u00e5r gjennom flere faser: ekstern datainnsamling, innholdsopdagelse, browser\/SPA-spidering og revisjon. Denne modus er praktisk for CI, regelmessige kontroller og tilfeller der det er viktig \u00e5 f\u00e5 et forutsigbart resultat uten LLM-deltakelse.<\/p>\n<\/li>\n<li>\n<p><strong>Agentic Scan \u2014 agentrevisjon med LLM.<\/strong><br \/>\nModus vigolium agent bruker innebygd runtime <strong>olium<\/strong>. Agenten kan selv finne endpoints, velge moduler, kj\u00f8re kontroller, analysere kode, utf\u00f8re SAST og revidere funn. Scenarier for Autopilot, Swarm og Query-modus st\u00f8ttes: fra autonom skanning av m\u00e5l til engangsforesp\u00f8rsel for kodegjennomgang, finne endpoints og oppdage hemmeligheter.<\/p>\n<\/li>\n<li>\n<p><strong>Sjekker XSS, SQLi, NoSQLi, SSTI, LFI, RCE, XXE og SSRF.<\/strong><br \/>\nI modulkatalogen listes tester for reflektert XSS, SQL-injeksjoner med feil og boolean-basert blind SQLi, NoSQL-injeksjoner, server-side template injection, lokal filinkludering, kommandoinjeksjon, XXE, SSRF og out-of-band-s\u00e5rbarheter. For funn brukes en alvorlighetsgradsskala fra kritisk til info og en tillitsniv\u00e5-skala certain, firm, tentative.<\/p>\n<\/li>\n<li>\n<p><strong>OAST-sjekker for 'blinde' s\u00e5rbarheter.<\/strong><br \/>\nVigolium kan sjekke blind XSS, blind SSRF, blind XXE og blind RCE gjennom callback-mekanismer, inkludert via interactsh. Dette er n\u00f8dvendig i situasjoner der s\u00e5rbarheten ikke vises direkte i HTTP-svaret, men serveren gj\u00f8r eksterne DNS\/HTTP-foresp\u00f8rsel eller utf\u00f8rer utsettelser.<\/p>\n<\/li>\n<li>\n<p><strong>Verdi-bevisst mutasjon \u2014 mutasjon av parametere med hensyn til betydningen av verdien.<\/strong><br \/>\nSkanneren klassifiserer parametere etter semantisk type: tall, UUID, JWT, e-post og andre alternativer, f\u00f8r den tilpasser mutasjoner til konteksten. Dette skal redusere st\u00f8y sammenlignet med grov substitusjon av identiske payloads i alle felt.<\/p>\n<\/li>\n<li>\n<p><strong>St\u00f8tte for ulike inngangsformater.<\/strong><br \/>\nSom inngang kan man sende URL-er, OpenAPI\/Swagger-spesifikasjoner, Postman-samlinger, data fra Burp Suite, cURL og Nuclei JSONL. Det st\u00f8ttes ogs\u00e5 \u00e5 sende URL-er via stdin og starte separate faser med skanning.<\/p>\n<\/li>\n<li>\n<p><strong>Autentisert skanning og kontroller for IDOR\/BOLA.<\/strong><br \/>\nVigolium st\u00f8tter flere sesjoner samtidig: sesjoner kan overf\u00f8res inline, lastes opp fra filer eller beskrives som komplette login-flows med token-uttrekk. Dette brukes for \u00e5 sjekke horisontal og vertikal tilgangskontroll, inkludert IDOR\/BOLA og heving av privilegier.<\/p>\n<\/li>\n<li>\n<p><strong>Sjekker for rammeverk og typiske lekkasjer.<\/strong><br \/>\nI modullisten finnes det sjekker for Next.js, Spring\/Java, Django, Flask, FastAPI, Laravel, Symfony, Rails, Express og ASP.NET\/IIS. For eksempel for Spring sjekkes \u00e5pne Actuator-endepunkter, Spring Boot Admin, Spring Cloud Config, H2 Console, Jolokia og konsoller for Java-applikasjonsservere; for Next.js \u2014 lekkasjer gjennom \/_next\/data, SSRF i Image Optimizer og omg\u00e5elser av middleware.<\/p>\n<\/li>\n<li>\n<p><strong>JavaScript-utvidelser.<\/strong><br \/>\nBrukeren kan skrive sine egne moduler og hooks p\u00e5 JavaScript via den innebygde JS-motoren med HTTP API som tar hensyn til sesjoner. Et viktig begrensning: slike utvidelser kan utf\u00f8re vilk\u00e5rlige kommandoer og er ikke isolert av en sandkasse, s\u00e5 de m\u00e5 betraktes som vanlig kj\u00f8rbar kode.<\/p>\n<\/li>\n<li>\n<p><strong>En egen triage-fase for resultater.<\/strong><br \/>\nI LLM-assistert sikkerhetstesting oppst\u00e5r ofte problemet med plausible, men ikke-reproduserbare funn. Forfatteren av Vigolium beskriver triage som et eget gjennoml\u00f8p: f\u00f8rst samler skanneren kandidater, deretter kontrolleres hvert funn p\u00e5 nytt mot bevis.<\/p>\n<\/li>\n<li>\n<p><strong>Budsjettbegrensninger for agentmodus.<\/strong><br \/>\nFor agent-based scanning, it is possible to limit tokens, the number of tool calls, the number of triage iterations, and total execution time. This is important for CI and pentests with a fixed time: the agent should not endlessly \"dig\" into one target and waste the budget on low-value hypotheses.<\/p>\n<\/li>\n<li>\n<p><strong>Reports, queue, and scaling.<\/strong><br \/>\nIn Native Scan, a competitive worker pool, per-host rate limiting, a hybrid queue in memory, on disk, or in Redis, as well as self-sufficient HTML reports are declared. Output options include console, JSONL, and HTML.<\/p>\n<\/li>\n<li>\n<p><strong>Server mode, API, and integration with Burp Suite.<\/strong><br \/>\nVigolium can be launched as an API server, take traffic, include a transparent HTTP proxy, and automatically scan the received data. A separate burp-vigolium extension is mentioned for Burp Suite, allowing live traffic to be sent to the Vigolium server.<\/p>\n<\/li>\n<li>\n<p><strong>Workbench and Console.<\/strong><br \/>\nIn addition to the CLI, the project describes <strong>Workbench<\/strong> \u2014 a self-hosted dashboard for visualizing results, managing projects, and tracking findings. <strong>Console<\/strong> \u2014 a cloud commercial layer for managed scanning, centralized reporting, collaboration, and planning audits.<\/p>\n<\/li>\n<\/ul>\n<h3>Installasjon<\/h3>\n<p>The project offers installation via shell script, npm, Docker, Homebrew, Bun, and building from source. Requirements for building from source are indicated in the README <strong>Go 1.26+<\/strong> og <strong>bun 1.3.11+<\/strong>.<\/p>\n<p>curl -fsSL https:\/\/vigolium.com\/install.sh | bash<\/p>\n<p>npm install -g @vigolium\/vigolium<\/p>\n<p>docker pull j3ssie\/vigolium:latest<br \/>\ndocker run \u2014rm j3ssie\/vigolium:latest scan -h<\/p>\n<p>Developers specifically warn that Vigolium is an offensive security tool: the agent mode starts without a sandbox and gains full access to the shell, file system, and host network, and extensions can also execute arbitrary commands. Therefore, it is recommended to run agent checks in a disposable container or virtual machine limited to the specific testing parameters.<\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18304531\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Vigolium v0.1.13-beta \u2014 \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u043e\u0432\u043c\u0435\u0449\u0430\u044e\u0449\u0435\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0430\u0433\u0435\u043d\u0442\u043d\u044b\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 LLM. \u041f\u0440\u043e\u0435\u043a\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GNU AGPLv3; \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 Cloud Console, \u0442\u043e\u0433\u0434\u0430 \u043a\u0430\u043a \u044f\u0434\u0440\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043e \u043a\u0430\u043a \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0435. Vigolium \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0434\u0432\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u044b: vigolium scan \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":181811,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181810","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/no\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"nn_NO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/no\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/no\/blog\/news\/vigolium-v0-1-13-beta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/no\/blog\/news\/vigolium-v0-1-13-beta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-30T12:48:14+00:00","article:modified_time":"2026-05-30T12:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/181810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=181810"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/181810\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media\/181811"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=181810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=181810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=181810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}