EVA — AI Agent 工作流中文教程

🍎 Installation

#### Ollama for local endpoint (required for local models and eva exploit database)

curl -fsSL https://ollama.ai/install.sh | shr

#### pip installation

pip install eva-exploit
eva

#### EVA github installation ```bash git clone https://github.com/ARCANGEL0/EVA.git cd EVA chmod +x eva.py ./eva.py

or if installed via pip:

eva

ㄖ Example of chat session

demonstration video.

USER > I'm on a Windows target at IP 10.10.11.95, what should I enumerate first?

[ANALYSIS] 
Based on the Windows environment, I need to perform comprehensive 
enumeration focusing on:

1. System Information (OS version, patches, architecture)
2. Network Services (ports, services, listening processes)  
3. User Context (current user, groups, privileges)
4. Security Controls (AV, firewall, UAC settings)
5. Potential Attack Vectors (SMB, RDP, IIS, etc.)

Let me start with basic system reconnaissance to understand the target better...

> execute:   nmap -sC -sV -O 10.10.10.10
| [R]un | [S]kip | [A]sk | [G]enerate HTML Report | [V]iew attack map | [Q]uit | 

>  R

</details>

<details> <summary><h2>Ξ AI Backends</h2></summary>

⬢ Configuring EVA.

When starting EVA, it will automatically handle: - ✅ API key setup (According to Model) - ✅ Ollama model download (Default set as whiterabitv2, feel free to change to any other desired model) - ✅ Session directory creation - ✅ Dependencies installation

<strong> If you wish to modify endpoints, ollama models, API Keys or configure EVA, please run: </strong>

eva --config

ꀬ Where to change EVA options

eva --config

<strong> Will display the following configuration: </strong>

API_ENDPOINT = "NOT_SET" 
G4F_MODEL="gpt-oss-120b"   
G4F_URL="https://api.gpt4free.workers.dev/api/novaai/chat/completions"
OLLAMA_MODEL = "ALIENTELLIGENCE/whiterabbitv2" 
SEARCHVULN_MODEL = "gpt-oss:120b-cloud"
SEARCVULN_URL = "https://ollama.com/api/chat"
OLLAMA_API_KEY = "NOT_SET" 
OPENAI_API_KEY = "NOT_SET" 
ANTHROPIC_API_KEY = "NOT_SET" 
GEMINI_API_KEY = "NOT_SET" 
ANTHROPIC_MODEL = "claude-3-5-sonnet-latest"
GEMINI_MODEL = "gemini-2.0-flash"
OLLAMA_CLOUD_TIMEOUT = 45
CONFIG_DIR = Path.home() / "EVA_data" #
SESSIONS_DIR = CONFIG_DIR / "sessions"
REPORTS_DIR = CONFIG_DIR / "reports"
MAPS_DIR = CONFIG_DIR / "attack_maps"
TERMS_ACCEPTEDTHING = CONFIG_DIR / ".confirm"
CONFIG_DIR.mkdir(parents=True, exist_ok=True)
SESSIONS_DIR.mkdir(parents=True, exist_ok=True)
REPORTS_DIR.mkdir(parents=True, exist_ok=True)
MAPS_DIR.mkdir(parents=True, exist_ok=True)
username = os.getlogin()
MAX_RETRIES = 10 ### maximum retries for fetching requests
RETRY_DELAY = 10 ### delay between requests to avoid rate limit error

</details>

<details> <summary><h2>🖴 Usage Guide</h2></summary>

open config.py in your default editor

eva --config

configure custom api and payload handler

eva --custom-api

This tool is for allowed environment only!

#### ✅ APPROVED USE CASES > CTF (Capture The Flag) competitions <br> > Authorized penetration testing <br> > Security research and laboratory environments <br> > Systems you own or have explicit permission to test <br>

#### 🚫 PROHIBITED USE > Unauthorized access to any system <br> > Illegal or malicious activities <br> > Production systems without explicit authorization <br> > Networks you do not own or control

After making a request, commands will be provided and the pentest workflow will start, use commands below as reference.

⟅ Custom API

• Endpoint: Configurable API to use your own as you wish. Please run eva --custom-api to set API handler and payload
• About:
• ✅ Custom model integration
• ✅ Modifiable as you wish