{"id":181810,"date":"2026-05-30T14:48:13","date_gmt":"2026-05-30T12:48:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vigolium-v0-1-13-beta"},"modified":"2026-05-30T14:48:13","modified_gmt":"2026-05-30T12:48:14","slug":"vigolium-v0-1-13-beta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/vigolium-v0-1-13-beta","title":{"rendered":"Vigolium v0.1.13-beta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><a rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/images\/23496\/original.png\" itemprop=\"contentURL\"><\/p>\n<p>      <img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/05\/6b5dca385b6e09391b374bd74ce93d2c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>      <\/a><\/p>\n<p><noindex>      <noindex><\/p>\n<p>Objavljen je po\u010detni javni izdanak <strong><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium\/releases\/tag\/v0.1.13-beta\">Vigolium v0.1.13-beta<\/a><\/strong> \u2014 skener ranjivosti za web-aplikacije koji kombinuje klasi\u010dno deterministi\u010dko skeniranje sa agentnim auditem na bazi LLM. Projekt je dostupan na GitHubu i distribuira se pod licencom <strong>GNU AGPLv3<\/strong>; komercijalni deo je iznet u oblak <strong>Cloud Console<\/strong>, dok je jezgro skenera deklarisano kao otvoreno.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p>Vigolium nudi dva osnovna re\u017eima rada: vigolium scan \u2014 uobi\u010dajeno vi\u0161ekratno skeniranje sa pretragom sadr\u017eaja, spideringom putem pregleda\u010da, aktivnim i pasivnim audito; i vigolium agent \u2014 agentski re\u017eim gde LLM bira module, planira napade, generi\u0161e korisni\u010dke JavaScript-ekstenzije i kombinuje dinami\u010dko testiranje sa auditom izvornog koda.<\/p>\n<p><noindex><\/p>\n<p>Prema podacima <a rel=\"nofollow\" href=\"https:\/\/docs.vigolium.com\/native-scan\/modules-reference\">aktuarnog imenika modula<\/a>, Vigolium uklju\u010duje <strong>251 modul provere<\/strong>, od \u010dega je <strong>154 aktivnih<\/strong> in <strong>97 pasivnih<\/strong>. Aktivni moduli \u0161alju izmenjene zahteve i primenjuju fuzzing, injekcije i pona\u0161ajnu analizu, dok pasivni analiziraju ve\u0107 dostupne parove zahteva\/odgovora bez generisanja dodatnog saobra\u0107aja.<\/p>\n<p><\/noindex><\/p>\n<h3><a rel=\"nofollow\" href=\"https:\/\/github.com\/vigolium\/vigolium#key-features\">\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438<\/a><\/h3>\n<ul>\n<li>\n<p><strong>Native Scan \u2014 uobi\u010dajeno deterministi\u010dko skeniranje.<\/strong><br \/>\nRe\u017eim vigolium scan je namenjen brzim i ponovljivim proverama. Prolazi kroz vi\u0161e faza: spolja\u0161nje prikupljanje podataka, otkrivanje sadr\u017eaja, browser\/SPA-spidering i audit. Ovaj re\u017eim je zgodan za CI, redovne provere i situacije kada je va\u017eno dobiti predvidljiv rezultat bez uklju\u010divanja LLM.<\/p>\n<\/li>\n<li>\n<p><strong>Agentic Scan \u2014 agentski audit sa LLM.<\/strong><br \/>\nRe\u017eim vigolium agent koristi ugra\u0111eni runtime <strong>olium<\/strong>. Agent mo\u017ee samostalno tra\u017eiti endpoints, birati module, pokretati provere, analizirati kod, izvoditi SAST i ponovo proveravati nalaze. Podr\u017eani su scenariji Autopilot, Swarm i Query mode: od autonomnog skeniranja cilja do jednokratnih zahteva za reviziju koda, pronala\u017eenje endpoints i otkrivanje tajni.<\/p>\n<\/li>\n<li>\n<p><strong>Provere XSS, SQLi, NoSQLi, SSTI, LFI, RCE, XXE i SSRF.<\/strong><br \/>\nU imeniku modula su navedene provere reflektovanog XSS, SQL-injekcija kroz gre\u0161ke i boolean-based blind SQLi, NoSQL-injekcija, server-side template injection, local file inclusion, command injection, XXE, SSRF i out-of-band ranjivosti. Za nalaze se koristi skala ozbiljnosti od critical do info i skala sigurnosti certain, firm, tentative.<\/p>\n<\/li>\n<li>\n<p><strong>OAST-provere za 'slepe' ranjivosti.<\/strong><br \/>\nVigolium lahko preverja slepi XSS, slepi SSRF, slepi XXE in slepi RCE prek povratnih mehanizmov, vklju\u010dno z interactsh. To je potrebno v primerih, ko ranljivost ni neposredno izra\u017eena v HTTP-odgovoru, ampak stre\u017enik izvede zunanji DNS\/HTTP-poizvedbo ali izvr\u0161i zamudo.<\/p>\n<\/li>\n<li>\n<p><strong>Mutacija, zavedajo\u010da se vrednosti \u2014 mutacija parametrov ob upo\u0161tevanju pomena vrednosti.<\/strong><br \/>\nSkener klasificira parametre po semanti\u010dnem tipu: \u0161tevilka, UUID, JWT, e-po\u0161ta in druge mo\u017enosti, nato pa izbere mutacije glede na kontekst. To naj bi zmanj\u0161alo \u0161um v primerjavi z grobo zamenjavo enakih payloadov v vseh poljih zaporedno.<\/p>\n<\/li>\n<li>\n<p><strong>Podpora razli\u010dnim vhodnim formatom.<\/strong><br \/>\nKot vhod lahko predate URL, specifikacije OpenAPI\/Swagger, zbirke Postman, podatke iz Burp Suite, cURL in Nuclei JSONL. Podprta je tudi dostava URL preko stdin in zagon posameznih faz skeniranja.<\/p>\n<\/li>\n<li>\n<p><strong>Avtentificirano skeniranje in preverjanje IDOR\/BOLA.<\/strong><br \/>\nVigolium podpira ve\u010d sej hkrati: seje je mogo\u010de posredovati inline, nalo\u017eiti iz datotek ali opisati celotne prijavne tokove z izvle\u010dkom \u017eetonov. To se uporablja za preverjanje horizontalne in vertikalne kontrole dostopa, vklju\u010dno z IDOR\/BOLA in povi\u0161anjem privilegijev.<\/p>\n<\/li>\n<li>\n<p><strong>Preverjanje okvirov in tipi\u010dnih izpostavitev.<\/strong><br \/>\nSeznam modulov vklju\u010duje preverjanja za Next.js, Spring\/Java, Django, Flask, FastAPI, Laravel, Symfony, Rails, Express in ASP.NET\/IIS. Na primer, za Spring se preverjajo odprti Actuator endpoints, Spring Boot Admin, Spring Cloud Config, H2 Console, Jolokia in konzole Java application servers; za Next.js \u2014 uhajanja skozi \/_next\/data, SSRF v Image Optimizer in obhod middleware.<\/p>\n<\/li>\n<li>\n<p><strong>JavaScript raz\u0161iritve.<\/strong><br \/>\nUporabnik lahko pi\u0161e lastne module in hooks na JavaScriptu preko vgrajenega JS motorja s HTTP API, ki upo\u0161teva seje. Pomembna omejitev: tak\u0161ne raz\u0161iritve lahko izvajajo poljubne ukaze in niso izolirane v peskovniku, zato jih je treba obravnavati kot navadno izvr\u0161ljivo kodo.<\/p>\n<\/li>\n<li>\n<p><strong>Lo\u010dena faza triage za rezultate.<\/strong><br \/>\nPri testiranju varnosti, podprtih s LLM, se pogosto pojavi te\u017eava verjetnih, a neponovljivih ugotovitev. Avtor Vigolium opisuje triage kot lo\u010deno fazo: najprej skener zbere kandidate, nato pa posebna preveritev ponovno preveri vsako ugotovitev z dokazi.<\/p>\n<\/li>\n<li>\n<p><strong>Omejitve prora\u010duna za agenta.<\/strong><br \/>\nZa agencijsko skeniranje se lahko omeji \u0161tevilo tokenov, klicev orodij, \u0161tevilo iteracij triage in skupni \u010das izvajanja. To je pomembno za CI in penteste z dolo\u010denim \u010dasom: agent ne sme neskon\u010dno 'kopati' ene cilje in zgubljati prora\u010dun na malo koristnih hipotezah.<\/p>\n<\/li>\n<li>\n<p><strong>Poro\u010dila, vrsta in skaliranje.<\/strong><br \/>\nV Native Scan so navedeni konkuren\u010dni delovni bazeni, omejevanje hitrosti na posameznem gostitelju, hibridna vrsta v spominu, na disku ali v Redis ter samostojni HTML-izvodi. Na voljo so izhodi v obliki konzole, JSONL in HTML.<\/p>\n<\/li>\n<li>\n<p><strong>Stre\u017eni\u0161ki na\u010din, API in integracija z Burp Suite.<\/strong><br \/>\nVigolium se lahko za\u017eene kot API-stre\u017enik, sprejema promet, vklju\u010duje prosojni HTTP-proxy in samodejno skenira prejeti promet. Za Burp Suite je omenjena lo\u010dena raz\u0161iritev burp-vigolium, ki omogo\u010da po\u0161iljanje \u017eivega prometa na stre\u017enik Vigolium.<\/p>\n<\/li>\n<li>\n<p><strong>Delovni prostor in konzola.<\/strong><br \/>\nPoleg CLI projekt opisuje <strong>Delovni prostor<\/strong> \u2014 samostojna nadzorna plo\u0161\u010da za vizualizacijo rezultatov, upravljanje projektov in sledenje ugotovitvam. <strong>Konzola<\/strong> \u2014 obla\u010dna komercialna plast za upravljano skeniranje, centralizirano poro\u010danje, sodelovanje in na\u010drtovanje pregledov.<\/p>\n<\/li>\n<\/ul>\n<h3>Namestitev<\/h3>\n<p>Projekt ponuja namestitev preko shell-skripte, npm, Docker, Homebrew, Bun in sestavljanje iz izvora. Za sestavljanje iz izvora so v README navedene zahteve <strong>Go 1.26+<\/strong> in <strong>bun 1.3.11+<\/strong>.<\/p>\n<p>curl -fsSL https:\/\/vigolium.com\/install.sh | bash<\/p>\n<p>npm install -g @vigolium\/vigolium<\/p>\n<p>docker pull j3ssie\/vigolium:latest<br \/>\ndocker run \u2014rm j3ssie\/vigolium:latest scan -h<\/p>\n<p>Razvijalci posebej opozarjajo, da je Vigolium orodje za ofenzivno varnost: na\u010din agenta se za\u017eene brez peskovnika in pridobi popoln dostop do lupine, datote\u010dnega sistema in omre\u017eja gostitelja, raz\u0161iritve pa lahko izvajajo poljubne ukaze. Zato se priporo\u010da, da se agentska preverjanja izvajajo v enkratnem vsebniku ali virtualnem stroju, omejenem na specifi\u010dno testiranje.<\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18304531\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Vigolium v0.1.13-beta \u2014 \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u043e\u0432\u043c\u0435\u0449\u0430\u044e\u0449\u0435\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441 \u0430\u0433\u0435\u043d\u0442\u043d\u044b\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 LLM. \u041f\u0440\u043e\u0435\u043a\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GNU AGPLv3; \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u0430 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 Cloud Console, \u0442\u043e\u0433\u0434\u0430 \u043a\u0430\u043a \u044f\u0434\u0440\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043e \u043a\u0430\u043a \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0435. Vigolium \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0434\u0432\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0440\u0435\u0436\u0438\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u044b: vigolium scan \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":181811,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181810","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/vigolium-v0-1-13-beta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-30T12:48:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/vigolium-v0-1-13-beta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Vigolium v0.1.13-beta | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/vigolium-v0-1-13-beta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-30T12:48:14+00:00","article:modified_time":"2026-05-30T12:48:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/181810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=181810"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/181810\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/181811"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=181810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=181810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=181810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}