mirror of
https://github.com/usestrix/strix.git
synced 2026-08-28 05:25:00 +00:00
119 lines
3.2 KiB
Text
119 lines
3.2 KiB
Text
---
|
|
title: "Custom Instructions"
|
|
description: "Guide Strix with custom testing instructions"
|
|
---
|
|
|
|
Use instructions to provide context, credentials, or focus areas for your scan.
|
|
Configured web targets identify hosts, not endpoints. Put exact paths and query
|
|
strings in the instruction so they remain part of the task. Hosts explicitly
|
|
named in the instruction and their descendant subdomains are in prompt-level
|
|
scope. On the interactive start screen, those network references are also
|
|
recorded as canonical targets; each distinct hostname independently authorizes
|
|
that hostname and its descendant subdomains.
|
|
|
|
## Inline Instructions
|
|
|
|
```bash
|
|
strix --target https://app.com --instruction "Focus on authentication vulnerabilities"
|
|
```
|
|
|
|
## File-Based Instructions
|
|
|
|
For complex instructions, use a file:
|
|
|
|
```bash
|
|
strix --target https://app.com --instruction-file ./pentest-instructions.md
|
|
```
|
|
|
|
## Common Use Cases
|
|
|
|
### Authenticated Testing
|
|
|
|
```bash
|
|
strix --target https://app.com \
|
|
--instruction "Login with email: test@example.com, password: TestPass123"
|
|
```
|
|
|
|
### Focused Scope
|
|
|
|
```bash
|
|
strix --target https://api.example.com \
|
|
--instruction "Focus on IDOR vulnerabilities in the /api/users endpoints"
|
|
```
|
|
|
|
### Exclusions
|
|
|
|
```bash
|
|
strix --target https://app.com \
|
|
--instruction "Do not test /admin or /internal endpoints"
|
|
```
|
|
|
|
### API Testing
|
|
|
|
```bash
|
|
strix --target https://api.example.com \
|
|
--instruction "Use API key header: X-API-Key: abc123. Focus on rate limiting bypass."
|
|
```
|
|
|
|
## Instruction File Example
|
|
|
|
```markdown instructions.md
|
|
# Penetration Test Instructions
|
|
|
|
## Credentials
|
|
- Admin: admin@example.com / AdminPass123
|
|
- User: user@example.com / UserPass123
|
|
|
|
## Focus Areas
|
|
1. IDOR in user profile endpoints
|
|
2. Privilege escalation between roles
|
|
3. JWT token manipulation
|
|
|
|
## Out of Scope
|
|
- /health endpoints
|
|
- Third-party integrations
|
|
```
|
|
|
|
<Tip>
|
|
Be specific. Good instructions help Strix prioritize the most valuable attack paths.
|
|
</Tip>
|
|
|
|
## Workspace files
|
|
|
|
Instructions become part of the prompt. To give Strix a file to work with, such
|
|
as a wordlist, an API specification, or notes, use `--workspace-file`. Strix
|
|
places the file into the sandbox workspace before the scan starts.
|
|
|
|
```bash
|
|
strix --target https://app.com --workspace-file ./wordlist.txt
|
|
```
|
|
|
|
The file lands at `/workspace/<file name>`. To choose the destination, write
|
|
`PATH:DEST`. `DEST` is a path inside `/workspace`.
|
|
|
|
```bash
|
|
strix --target https://app.com \
|
|
--workspace-file ./openapi.yaml:specs/openapi.yaml \
|
|
--workspace-file ./notes.md
|
|
```
|
|
|
|
Repeat the option for every file you want to place. Strix lists the files in the
|
|
agent task, so the agent knows where to read them.
|
|
|
|
Rules that apply to every workspace file:
|
|
|
|
- The file is read-only inside the sandbox.
|
|
- The destination must stay inside `/workspace`.
|
|
- The destination must not fall inside a target directory, because target files
|
|
come from the target itself. Strix skips such a file and logs a warning.
|
|
- Two files cannot claim the same destination.
|
|
|
|
<Note>
|
|
A workspace file is data for the agent to use. It is not a scan target, and its
|
|
contents do not change the instructions.
|
|
</Note>
|
|
|
|
<Warning>
|
|
Do not place secrets in a workspace file. The sandbox runs untrusted target
|
|
code, so treat anything you place there as readable by the target.
|
|
</Warning>
|