Vigolium

Installation

Quick Install (Recommended)

curl -fsSL https://vigolium.com/install.sh | bash

Docker

docker pull j3ssie/vigolium:latest
docker run --rm j3ssie/vigolium:latest scan -h

Build from Source

git clone https://github.com/vigolium/vigolium.git
cd vigolium
make build         # build and install to $GOPATH/bin

Requires Go 1.26+ and bun 1.3.11+. See HACKING.md for prerequisites and build details.

</details>

Quick Start: Native Scan

```bash

Swarm: AI-guided targeted or full-scope vulnerability scanning

vigolium agent swarm -t https://example.com/api/users --vuln-type sqli vigolium agent swarm -t https://example.com --discover # full-scope vigolium agent swarm -t https://example.com --source ./src --discover # source-aware full-scope vigolium agent swarm --input "curl -X POST https://example.com/api/login -d '{\"user\":\"admin\"}'"

Scan from an OpenAPI spec

vigolium scan -T openapi.yaml -I openapi

Start API server with authentication

vigolium server -k my-secret-key

Ingest an OpenAPI spec

vigolium ingest -s http://localhost:9002 -i api.yaml -I openapi ```

See docs.vigolium.com/server-mode/running-the-server for server setup, docs.vigolium.com/server-mode/ingestion for ingestion workflows, and docs.vigolium.com/api-overview for the full REST API reference.

Burp Suite integration: forward live Burp Suite traffic to a running Vigolium server with the burp-vigolium extension.

Inline session via CLI flag (name:Header:value)

vigolium scan -t https://example.com \ --auth "admin:Cookie:session_id=abc123" \ --auth "user:Cookie:session_id=xyz789"

CLI Reference

<details> <summary>Expand the full commands & flags reference</summary>

[npm](https://www.npmjs.com/package/@vigolium/vigolium)

npm install -g @vigolium/vigolium

<details> <summary>Other method like Docker or Build from source</summary>

Scan specific modules only

vigolium scan -t https://example.com -m xss-reflected,sqli-error

Manage extensions

vigolium ext ls # list loaded extensions vigolium ext docs --example # browse API with code examples vigolium ext preset # install starter scripts

The JS engine exposes session-aware HTTP APIs for authenticated testing:

// Automated login flow with token extraction let authed = vigolium.http.login({ url: "https://app.example.com/api/auth", method: "POST", body: JSON.stringify({ username: "admin", password: "pass" }), extract: [{ source: "json", path: "$.token", apply_as: "Authorization: Bearer {value}" }] });

// IDOR/BOLA testing across multiple sessions let results = vigolium.http.authTest({ sessions: { admin: adminSession, user: userSession }, requests: [{ method: "GET", url: "https://app.example.com/api/users/1" }] });

// Multi-step authentication sequences let result = vigolium.http.sequence([ { url: "/csrf", extract: [{ source: "cookie", name: "csrf_token", as: "token" }] }, { url: "/login", method: "POST", body: "csrf={token}&user=admin" } ]);

// Parallel request batching (race conditions, IDOR) let responses = vigolium.http.batch([req1, req2, req3], { concurrency: 10 });

// CSRF token extraction let csrf = vigolium.http.csrf("https://app.example.com/form");

// HTTP request replay with variations let varied = vigolium.http.replay(rawRequest, [ { headers: { "Authorization": "Bearer admin_token" } }, { headers: { "Authorization": "Bearer user_token" } } ]); ```

See docs.vigolium.com/customization/writing-extensions for the extension authoring guide and pkg/jsext/vigolium.d.ts for the full TypeScript API definitions.