From aa4418752a4a085c25527ae491e2f4aa76b0a6a5 Mon Sep 17 00:00:00 2001 From: sandiyochristan Date: Fri, 7 Aug 2026 05:28:19 +0530 Subject: [PATCH 1/2] docs: add safe first-run guide with local vulnerable targets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a Getting Started page showing how to verify a Strix setup safely using OWASP Juice Shop, DVWA, or a local codebase — so new users don't have to point the tool at a real application before understanding scope and permissions. Addresses #972 --- docs/docs.json | 3 +- docs/quickstart-safe-target.mdx | 103 ++++++++++++++++++++++++++++++++ 2 files changed, 105 insertions(+), 1 deletion(-) create mode 100644 docs/quickstart-safe-target.mdx diff --git a/docs/docs.json b/docs/docs.json index de23c158..5df4a58f 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -17,7 +17,8 @@ "group": "Getting Started", "pages": [ "index", - "quickstart" + "quickstart", + "quickstart-safe-target" ] }, { diff --git a/docs/quickstart-safe-target.mdx b/docs/quickstart-safe-target.mdx new file mode 100644 index 00000000..597e7671 --- /dev/null +++ b/docs/quickstart-safe-target.mdx @@ -0,0 +1,103 @@ +--- +title: "Safe First Run" +description: "Verify your Strix setup safely using a local vulnerable demo app" +--- + +Strix is an autonomous pentesting tool — it actively probes, submits forms, and sends requests to its target. Before pointing it at anything you care about, verify your setup against a **local intentionally vulnerable application** where no real damage is possible. + + +**Only scan systems you own or are explicitly authorized to test.** Unauthorized scanning is illegal in most jurisdictions. When in doubt, use the local targets described on this page. + + +## Option 1: OWASP Juice Shop (Recommended) + +[Juice Shop](https://owasp.org/www-project-juice-shop/) is OWASP's intentionally vulnerable web application with 100+ challenges covering the OWASP Top 10. It runs locally in Docker — same as Strix's sandbox. + +### Setup + +```bash +# Pull and run Juice Shop (runs on port 3000) +docker run --rm -d --name juice-shop -p 3000:3000 bkimminich/juice-shop + +# Verify it's running +curl -s http://localhost:3000 | head -5 +``` + +### Run Strix Against It + +```bash +# Quick scan — fastest way to verify your setup works +strix --target http://host.docker.internal:3000 --scan-mode quick + +# Standard scan — broader coverage +strix --target http://host.docker.internal:3000 --scan-mode standard +``` + + +Use `host.docker.internal` (not `localhost`) so the Strix sandbox container can reach the Juice Shop container on your host machine. + + +### What to Expect + +A quick scan against Juice Shop typically finds: +- SQL injection in the login and search endpoints +- XSS in user-facing input fields +- Broken authentication (weak password policies) +- Information disclosure (error stack traces, directory listings) + +Results are saved to `strix_runs//`. Run `strix view` to see the interactive report. + +### Cleanup + +```bash +docker stop juice-shop +``` + +## Option 2: DVWA (Damn Vulnerable Web Application) + +A simpler target for quick setup verification. + +```bash +# Pull and run DVWA (runs on port 8080) +docker run --rm -d --name dvwa -p 8080:80 vulnerables/web-dvwa + +# Default credentials: admin / password +# Run Strix +strix --target http://host.docker.internal:8080 --scan-mode quick +``` + +## Option 3: Local Codebase (White-Box) + +If you want to test Strix's source-aware scanning without any network target: + +```bash +# Clone an intentionally vulnerable codebase +git clone https://github.com/OWASP/NodeGoat.git /tmp/nodegoat + +# Run Strix in white-box mode +strix --target /tmp/nodegoat --scan-mode quick +``` + +This analyzes the source code directly — no running application needed. + +## Verifying Your Setup + +After your first scan completes, check: + +1. **Results directory exists**: `ls strix_runs/` +2. **Report generated**: Check for `penetration_test_report.md` in the run directory +3. **Findings present**: `cat strix_runs//vulnerabilities.json | python3 -m json.tool | head -20` +4. **Interactive viewer**: `strix view` opens a local dashboard showing findings, severity, and agent activity + +## Next Steps + +Once your setup is verified against a safe local target: + + + + Point Strix at your own application or codebase. + + + Choose the right scan depth for your use case. + + From 661199128fdaacf7e1cea3166adedd1b6ba26c6b Mon Sep 17 00:00:00 2001 From: sandiyochristan Date: Fri, 7 Aug 2026 05:39:30 +0530 Subject: [PATCH 2/2] docs: warn that local source targets are mounted writable Adds a warning to the white-box scanning example advising users to use a fresh clone or commit/stash changes before scanning, since Strix mounts the target directory live and writable. --- docs/quickstart-safe-target.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/quickstart-safe-target.mdx b/docs/quickstart-safe-target.mdx index 597e7671..28a090ae 100644 --- a/docs/quickstart-safe-target.mdx +++ b/docs/quickstart-safe-target.mdx @@ -80,6 +80,10 @@ strix --target /tmp/nodegoat --scan-mode quick This analyzes the source code directly — no running application needed. + +Strix mounts the target directory **live and writable**. The agent may create or modify files during scanning. Always use a fresh clone (as shown above) or commit/stash your changes before scanning an existing working directory. + + ## Verifying Your Setup After your first scan completes, check: