Get started
Dapper is a fully autonomous, white-box AI penetration tester. You point it at a running web application and that application’s source code; it reasons over the code to find candidate vulnerabilities, then drives a real browser and HTTP client to prove each one by exploiting it live, and finally writes a pentest-grade report containing only verified findings with copy-paste proof-of-concepts.
This section takes you from a clean checkout to your first complete run. The whole pipeline executes in Docker — there is no language toolchain to install and nothing to deploy into your environment. Everything runs locally; the only traffic that leaves your machine is the LLM API calls.
Read the pages in order:
- Overview — what Dapper does, what you feed it, what comes back, and how it differs from a scanner.
- Installation — prerequisites,
.envsetup, and the./repos/layout. - Quickstart — a full end-to-end run against a deliberately vulnerable target.
The first build pulls the Temporal server image and compiles the worker, so budget a few extra minutes the first time around.
Dapper is an active tool — its exploitation agents create, modify, and delete data to confirm findings. Run it against staging, sandbox, or local environments only. Never against production.