Gimorra - an autonomous offensive security agent
Point it at a target and it runs the engagement end to end: recon → scan → propose PoC → prove → report.
- Auto-detects the target: URL, host, domain, IP, CIDR, repo, or a prose brief.
- One dial for aggressiveness:
passive · lite · balanced · aggressive. - Steerable: hand it a brief (
-p "focus on IDOR"), a target list, an API spec, or captured proxy traffic. - Proves its own findings: every candidate is replayed non-destructively before it lands.
- Source audit too: point it at a repo instead of (or alongside) a live target.
- Reads back: findings, markdown/HTML reports, and a hash-chained chain of custody.
gimorra scan acme.test
gimorra scan acme.test -p "focus on IDOR and broken access control" --intensity aggressive
gimorra findings <id> -f mdGimorra is crafted with ♥ by @j3ssie
