{"id":181810,"date":"2026-05-30T14:48:13","date_gmt":"2026-05-30T12:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vigolium-v0-1-13-beta"},"modified":"2026-05-30T14:48:13","modified_gmt":"2026-05-30T12:48:14","slug":"vigolium-v0-1-13-beta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vigolium-v0-1-13-beta","title":{"rendered":"Vigolium v0.1.13-beta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><a rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/images\/23496\/original.png\" itemprop=\"contentURL\"><\/p>\n<p>      <img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/05\/6b5dca385b6e09391b374bd74ce93d2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>      <\/a><\/p>\n<p><noindex>      <noindex><\/p>\n<p>Publicada a vers\u00e3o inicial do lan\u00e7amento aberto <strong><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium\/releases\/tag\/v0.1.13-beta\">Vigolium v0.1.13-beta<\/a><\/strong> \u2014 de um scanner de vulnerabilidades para aplica\u00e7\u00f5es web, combinando varredura determin\u00edstica cl\u00e1ssica com uma auditoria baseada em LLM. O projeto est\u00e1 dispon\u00edvel no GitHub e \u00e9 distribu\u00eddo sob a licen\u00e7a <strong>GNU AGPLv3<\/strong>; a parte comercial foi levada para a nuvem <strong>Cloud Console<\/strong>, enquanto o n\u00facleo do scanner \u00e9 declarado como aberto.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p>Vigolium oferece dois modos principais de opera\u00e7\u00e3o: vigolium scan \u2014 uma varredura normal em v\u00e1rias etapas com busca de conte\u00fado, spidering atrav\u00e9s do navegador, auditoria ativa e passiva; e vigolium agent \u2014 modo agenciado, onde LLM seleciona m\u00f3dulos, planeja ataques, gera extens\u00f5es JavaScript personalizadas e combina testes din\u00e2micos com auditoria de c\u00f3digo-fonte.<\/p>\n<p><noindex><\/p>\n<p>De acordo com <a rel=\"nofollow\" href=\"https:\/\/docs.vigolium.com\/native-scan\/modules-reference\">diret\u00f3rio atualizado de m\u00f3dulos<\/a>, Vigolium inclui <strong>251 m\u00f3dulos de verifica\u00e7\u00e3o<\/strong>, dos quais <strong>154 s\u00e3o ativos<\/strong> e <strong>97 s\u00e3o passivos<\/strong>. M\u00f3dulos ativos enviam solicita\u00e7\u00f5es alteradas e aplicam fuzzing, inje\u00e7\u00f5es e an\u00e1lise comportamental, enquanto os passivos analisam pares de solicita\u00e7\u00f5es\/respostas j\u00e1 existentes sem gerar tr\u00e1fego adicional.<\/p>\n<p><\/noindex><\/p>\n<h3><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium#key-features\">Recursos<\/a><\/h3>\n<ul>\n<li>\n<p><strong>Native Scan \u2014 varredura determin\u00edstica normal.<\/strong><br \/>\nO modo vigolium scan \u00e9 projetado para verifica\u00e7\u00f5es r\u00e1pidas e reproduz\u00edveis. Ele passa por v\u00e1rias fases: coleta de dados externa, descoberta de conte\u00fado, browser\/SPA-spidering e auditoria. Este modo \u00e9 conveniente para CI, verifica\u00e7\u00f5es regulares e situa\u00e7\u00f5es em que \u00e9 importante obter um resultado previs\u00edvel sem a participa\u00e7\u00e3o do LLM.<\/p>\n<\/li>\n<li>\n<p><strong>Agentic Scan \u2014 auditoria agenciada com LLM.<\/strong><br \/>\nO modo vigolium agent utiliza um runtime interno <strong>olium<\/strong>. O agente pode procurar endpoints, selecionar m\u00f3dulos, executar verifica\u00e7\u00f5es, analisar c\u00f3digo, realizar SAST e revisar descobertas. Os modos Autopilot, Swarm e Query s\u00e3o suportados: desde a varredura aut\u00f4noma do alvo at\u00e9 solicita\u00e7\u00f5es pontuais para revis\u00e3o de c\u00f3digo, busca de endpoints e descoberta de segredos.<\/p>\n<\/li>\n<li>\n<p><strong>Verifica\u00e7\u00f5es XSS, SQLi, NoSQLi, SSTI, LFI, RCE, XXE e SSRF.<\/strong><br \/>\nO diret\u00f3rio de m\u00f3dulos lista verifica\u00e7\u00f5es de XSS refletido, inje\u00e7\u00f5es SQL por erros e blind SQLi baseado em booleano, inje\u00e7\u00f5es NoSQL, inje\u00e7\u00e3o de template do lado do servidor, inclus\u00e3o de arquivo local, inje\u00e7\u00e3o de comando, XXE, SSRF e vulnerabilidades out-of-band. As descobertas utilizam uma escala de severidade de cr\u00edtica a informa\u00e7\u00e3o e uma escala de confian\u00e7a: certa, firme, tentada.<\/p>\n<\/li>\n<li>\n<p><strong>Verifica\u00e7\u00f5es OAST para vulnerabilidades 'cegas'.<\/strong><br \/>\nO Vigolium consegue verificar XSS cego, SSRF cego, XXE cego e RCE cego atrav\u00e9s de mecanismos de callback, incluindo o interactsh. Isso \u00e9 necess\u00e1rio para casos em que a vulnerabilidade n\u00e3o se manifesta diretamente na resposta HTTP, mas o servidor faz uma solicita\u00e7\u00e3o externa de DNS\/HTTP ou executa uma a\u00e7\u00e3o atrasada.<\/p>\n<\/li>\n<li>\n<p><strong>Muta\u00e7\u00e3o ciente do valor \u2014 muta\u00e7\u00e3o de par\u00e2metros levando em conta o significado do valor.<\/strong><br \/>\nO scanner classifica os par\u00e2metros por tipo sem\u00e2ntico: n\u00famero, UUID, JWT, e-mail e outras op\u00e7\u00f5es, e em seguida, escolhe muta\u00e7\u00f5es para o contexto. Isso deve reduzir o ru\u00eddo em compara\u00e7\u00e3o com a substitui\u00e7\u00e3o grosseira de payloads iguais em todos os campos.<\/p>\n<\/li>\n<li>\n<p><strong>Suporte a diferentes formatos de entrada.<\/strong><br \/>\nComo entrada, podem ser passados URLs, especifica\u00e7\u00f5es OpenAPI\/Swagger, cole\u00e7\u00f5es Postman, dados do Burp Suite, cURL e Nuclei JSONL. Tamb\u00e9m \u00e9 suportada a entrada de URLs via stdin e a execu\u00e7\u00e3o de fases de varredura separadas.<\/p>\n<\/li>\n<li>\n<p><strong>Varredura autenticada e verifica\u00e7\u00f5es IDOR\/BOLA.<\/strong><br \/>\nO Vigolium suporta v\u00e1rias sess\u00f5es simultaneamente: as sess\u00f5es podem ser passadas inline, carregadas de arquivos ou descritas com fluxos de login completos que extraem tokens. Isso \u00e9 usado para verifica\u00e7\u00f5es de controle de acesso horizontal e vertical, incluindo IDOR\/BOLA e eleva\u00e7\u00f5es de privil\u00e9gio.<\/p>\n<\/li>\n<li>\n<p><strong>Verifica\u00e7\u00f5es de frameworks e vazamentos t\u00edpicos.<\/strong><br \/>\nNa lista de m\u00f3dulos, h\u00e1 verifica\u00e7\u00f5es para Next.js, Spring\/Java, Django, Flask, FastAPI, Laravel, Symfony, Rails, Express e ASP.NET\/IIS. Por exemplo, para Spring, s\u00e3o verificadas endpoints Actuator abertas, Spring Boot Admin, Spring Cloud Config, H2 Console, Jolokia e consoles de servidores de aplica\u00e7\u00f5es Java; para Next.js, vazamentos atrav\u00e9s de \/_next\/data, SSRF no Image Optimizer e contornos de middleware.<\/p>\n<\/li>\n<li>\n<p><strong>Extens\u00f5es JavaScript.<\/strong><br \/>\nO usu\u00e1rio pode escrever seus pr\u00f3prios m\u00f3dulos e hooks em JavaScript atrav\u00e9s do motor JS embutido com API HTTP, que considera sess\u00f5es. Uma limita\u00e7\u00e3o importante: tais extens\u00f5es podem executar comandos arbitr\u00e1rios e n\u00e3o s\u00e3o isoladas em sandbox, portanto, devem ser tratadas como c\u00f3digo execut\u00e1vel comum.<\/p>\n<\/li>\n<li>\n<p><strong>Uma fase separada de triagem para os resultados.<\/strong><br \/>\nNos testes de seguran\u00e7a assistidos por LLM, muitas vezes surge o problema de descobertas plaus\u00edveis, mas n\u00e3o reproduz\u00edveis. O autor do Vigolium descreve a triagem como uma passagem separada: primeiro, o scanner coleta candidatos e, em seguida, uma verifica\u00e7\u00e3o separada reavalia cada descoberta com provas.<\/p>\n<\/li>\n<li>\n<p><strong>Restri\u00e7\u00f5es or\u00e7ament\u00e1rias para o modo agente.<\/strong><br \/>\nPara a varredura agendada, \u00e9 poss\u00edvel limitar os tokens, o n\u00famero de chamadas de ferramentas, o n\u00famero de itera\u00e7\u00f5es de triagem e o tempo total de execu\u00e7\u00e3o. Isso \u00e9 importante para CI e pentests com tempo fixo: o agente n\u00e3o deve escavar indefinidamente um \u00fanico alvo e queimar o or\u00e7amento em hip\u00f3teses pouco \u00fateis.<\/p>\n<\/li>\n<li>\n<p><strong>Relat\u00f3rios, fila e escalonamento.<\/strong><br \/>\nNo Native Scan, s\u00e3o anunciados um pool de workers concorrentes, limita\u00e7\u00e3o de taxa por host, fila h\u00edbrida em mem\u00f3ria, em disco ou no Redis, al\u00e9m de relat\u00f3rios HTML autossuficientes. As op\u00e7\u00f5es de sa\u00edda dispon\u00edveis incluem console, JSONL e HTML.<\/p>\n<\/li>\n<li>\n<p><strong>Modo servidor, API e integra\u00e7\u00e3o com Burp Suite.<\/strong><br \/>\nO Vigolium pode ser executado como servidor API, aceitar tr\u00e1fego, incluir um proxy HTTP transparente e escanear automaticamente os dados recebidos. Para o Burp Suite, h\u00e1 uma extens\u00e3o separada chamada burp-vigolium, que permite o envio de tr\u00e1fego ao vivo para o servidor Vigolium.<\/p>\n<\/li>\n<li>\n<p><strong>Workbench e Console.<\/strong><br \/>\nAl\u00e9m do CLI, o projeto descreve <strong>Workbench<\/strong> \u2014 um painel auto-hospedado para visualiza\u00e7\u00e3o de resultados, gerenciamento de projetos e rastreamento de descobertas. <strong>Console<\/strong> \u2014 uma camada comercial em nuvem para varredura gerenciada, relat\u00f3rios centralizados, colabora\u00e7\u00e3o e agendamento de verifica\u00e7\u00f5es.<\/p>\n<\/li>\n<\/ul>\n<h3>Instala\u00e7\u00e3o<\/h3>\n<p>O projeto oferece instala\u00e7\u00e3o por meio de script shell, npm, Docker, Homebrew, Bun e constru\u00e7\u00e3o a partir do c\u00f3digo-fonte. Para a constru\u00e7\u00e3o a partir do c\u00f3digo-fonte, s\u00e3o especificados os requisitos no README <strong>Go 1.26+<\/strong> e <strong>bun 1.3.11+<\/strong>.<\/p>\n<p>curl -fsSL https:\/\/vigolium.com\/install.sh | bash<\/p>\n<p>npm install -g @vigolium\/vigolium<\/p>\n<p>docker pull j3ssie\/vigolium:latest<br \/>\ndocker run \u2014rm j3ssie\/vigolium:latest scan -h<\/p>\n<p>Os desenvolvedores alertam separadamente que o Vigolium \u00e9 uma ferramenta de seguran\u00e7a ofensiva: o modo agente \u00e9 executado sem sandbox e recebe acesso total ao shell, ao sistema de arquivos e \u00e0 rede do host, e as extens\u00f5es tamb\u00e9m podem executar comandos arbitr\u00e1rios. Portanto, recomenda-se que as verifica\u00e7\u00f5es do agente sejam realizadas em um cont\u00eainer descart\u00e1vel ou em uma m\u00e1quina virtual limitada ao escopo de um teste espec\u00edfico.<\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18304531\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Vigolium v0.1.13-beta \u2014 \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u043e\u0432\u043c\u0435\u0449\u0430\u044e\u0449\u0435\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0430\u0433\u0435\u043d\u0442\u043d\u044b\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 LLM. \u041f\u0440\u043e\u0435\u043a\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GNU AGPLv3; \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 Cloud Console, \u0442\u043e\u0433\u0434\u0430 \u043a\u0430\u043a \u044f\u0434\u0440\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043e \u043a\u0430\u043a \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0435. Vigolium \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0434\u0432\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u044b: vigolium scan \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":181811,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181810","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/vigolium-v0-1-13-beta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/vigolium-v0-1-13-beta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-30T12:48:14+00:00","article:modified_time":"2026-05-30T12:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/181810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=181810"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/181810\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/181811"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=181810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=181810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=181810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}