Unmask the hidden before the world does

An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merged patch, with human oversight at every critical step.

LEGAL DISCLAIMER: This tool is intended for authorized security testing, educational purposes, and research only. Never use this system to scan, probe, or attack any system you do not own or have explicit written permission to test. Unauthorized access is illegal and punishable by law. By using this tool, you accept full responsibility for your actions. Read Full Disclaimer

🏆 Flagship result: RedAmon solves 101 / 104 (97.1%) of the XBOW web-security benchmark fully black-box. Every solve ships a complete, unedited raw agent session and a reproducible, step-by-step walkthrough: open any row and read exactly how the flag fell, tool call by tool call. Auditable, line by line. See the XBOW Validation Benchmark scorecard.

📊 Coverage, measured and self-scored: the Bug Bounty Coverage — The Full Taxonomy Audit (PDF, 124 pages) audits RedAmon against all 397 classes of web bug-bounty finding, one line at a time, naming the exact module, skill or scanner behind every verdict, and scoring the recon pipeline and the agentic system separately against their own remit. It is deliberately self-critical, it records what is missing as plainly as what is covered: 134 classes complete, 210 in the build backlog, 44 deliberately excluded, with one explicit decision for every class.

Dynamic Multi-Tool Parallel Recon Pipeline

RedAmon launches multiple reconnaissance tools in parallel, each feeding results into a shared knowledge graph in real time. Tools spin up, adapt their scope based on live discoveries, and coordinate without manual intervention. The entire attack surface -- subdomains, ports, endpoints, parameters -- materializes in minutes, not hours.

Recon as a Living Knowledge Graph

Industry-standard scanners chained so each tool's output feeds the next, then merged into a single Neo4j knowledge graph. Findings are deduplicated, relationships are explicit, and the agent inherits a structured, fully connected attack surface ready to query in natural language.

Offense meets defense. One pipeline, full visibility.

Reconnaissance ➜ Exploitation ➜ Post-Exploitation ➜ AI Triage ➜ CodeFix Agent ➜ GitHub PR

RedAmon doesn't stop at finding vulnerabilities, it fixes them. The pipeline starts with a 6-phase reconnaissance engine that maps your target's entire attack surface, then hands control to an autonomous AI agent that validates CVE exploitability, tests credential policies, and maps lateral movement paths. Every finding is recorded in a Neo4j knowledge graph. When the offensive phase completes, CypherFix takes over: an AI triage agent correlates hundreds of findings, deduplicates them, and ranks them by exploitability. Then a CodeFix agent clones your repository, navigates the codebase with 11 code-aware tools, implements targeted fixes, and opens a GitHub pull request, ready for review and merge.

Roadmap & Community Contributions

We maintain a public Project Board with upcoming features open for community contributions. Pick a task and submit a PR!

Want to contribute? See CONTRIBUTING.md for how to get started.

Maintainers

Samuele Giampieri: Creator, Maintainer & AI Platform Architect AI Platform Architect & Full-Stack Lead with 15+ years of freelancing experience and more than 30 projects shipped to production, including enterprise-scale AI agentic systems. AWS-certified (DevOps Engineer, ML Specialty) and IBM-certified AI Engineer. Designs end-to-end ML solutions spanning deep learning, NLP, Computer Vision, and AI Agent systems with LangChain/LangGraph. LinkedIn · GitHub · Devergo Labs From the same creator: Pathbreak - Agentic Cloud Security See the attack path. Then break it. Pathbreak is an agentic cloud security platform that discovers and validates the real attack paths a threat actor would exploit across your cloud. It catches the control-plane chains most tools miss. Pathbreak - agentic cloud security pathbreak.io

Ritesh Gohil: Maintainer & Lead Security Researcher Cyber Security Engineer at Workday with over 7 years of experience in Web, API, Mobile, Network, and Cloud penetration testing. Published 11 CVEs in MITRE, with security acknowledgements from Google (4×) and Apple (6×). Secured 200+ web and mobile applications and contributed to Exploit Database, Google Hacking Database, and the AWS Community. Holds AWS Security Specialty, eWPTXv2, eCPPTv2, CRTP, and CEH certifications with expertise in red teaming, cloud security, CVE research, and security architecture review. LinkedIn · GitHub

Anthropic Cyber Verification Program: the team behind RedAmon is approved under Anthropic's Cyber Verification Program.

Quick Start

Prerequisites

• Docker Engine 28.0.0 or newer & Docker Compose v2+ (check with docker version --format '{{.Server.Version}}')

That's it. No Node.js, Python, or security tools needed on your host.

Minimum System Requirements

| Resource | Without OpenVAS | With OpenVAS (full stack) | |----------|----------------|--------------------------| | CPU | 2 cores | 4 cores | | RAM | 4 GB | 8 GB (16 GB recommended) | | Disk | 80 GB free | 110 GB free |

Without OpenVAS runs 7 containers: webapp, postgres, neo4j, agent, kali-sandbox, recon-orchestrator, and docker-broker (a filtering Docker-socket proxy that the recon orchestrator's spawned scan containers go through, so they can only launch the known tool images).

With OpenVAS adds 4 more runtime containers (gvmd, ospd-openvas, gvm-postgres, gvm-redis) plus ~8 one-shot data-init containers for vulnerability feeds (~170K+ NVTs). First launch takes ~30 minutes for GVM feed synchronization.

Dynamic recon and scan containers are spawned on-demand during operations and require additional resources.

Disk sizing for a real deployment. The figures above are bare minimums to build and run the stack (fixed platform footprint: ~70 GB without OpenVAS, ~95 GB with - measured by true on-disk image size after deduplicating the shared Kali base layers). For an always-on server running real engagements, add ~100 GB of free space for operational data - the Neo4j attack graph, scan artifacts/outputs, Postgres, and container logs all grow with use. That means 200 GB without OpenVAS, 250 GB with OpenVAS, each leaving well over 100 GB free for operations. See the deployment guide for the full breakdown.

1. Clone & Install

git clone https://github.com/samugit83/redamon.git
cd redamon
Without GVM (lighter, faster startup):
./redamon.sh install
With GVM / OpenVAS (full stack, ~30 min first run):
./redamon.sh install --gvm

The script builds all images and starts the services.

2. Create Admin Account

At the end of the install (and on every ./redamon.sh up or ./redamon.sh update if no admin exists), you will be prompted in the terminal:

[WARN] No admin user found. Let's create one.
Admin name: Your Name
  Admin email: [email protected]
  Admin password: **
  Confirm password: **

• Admin name -- display name shown in the UI (e.g. Admin, your name, anything you want).
• Admin email -- used to log in at http://localhost:3000/login.
• Admin password -- minimum 12 characters.

No prompt appeared? On a heavy first boot (especially --gvm, or a small VM) the webapp can take a while to come up, so the automatic prompt may be skipped. Create the admin at any time with:

>

> ./redamon.sh create-admin

> It waits for the webapp, then prompts for the same details. It is safe to re-run: reusing an existing admin's email resets that password, a new email adds another admin.

What the admin can do:

• Switch between all users via the user dropdown in the header (including users without a password).
• Create new users (with or without a password) and assign them admin or standard roles.
• Set or change any user's password.
• Delete users (except themselves).
• Access the Users management page from the header navigation.

If you forget the admin password, reset it from the terminal:

./redamon.sh reset-password   # reset an EXISTING user's password
./redamon.sh create-admin     # create the first admin, or reset an admin by re-entering its email

Use create-admin when no admin exists yet (it upserts on email); reset-password only updates a user that already exists.

3. Configure

Open http://localhost:3000/settings (gear icon in the header) to configure everything. No .env file is needed.

• LLM Providers -- add API keys for OpenAI, Anthropic, OpenRouter, AWS Bedrock, or any OpenAI-compatible endpoint (Ollama, vLLM, Groq, etc.). Each provider can be tested before saving. The model selector in project settings dynamically fetches available models from configured providers.
• API Keys -- Tavily, Shodan, SerpAPI, NVD, Vulners, URLScan, and threat intelligence keys (Censys, FOFA, OTX, Netlas, VirusTotal, ZoomEye, CriminalIP) to enable extended agent capabilities (web search, OSINT, CVE lookups, passive threat intel). Uncover multi-engine search keys (Quake, Hunter, PublicWWW, HunterHow, Google, Onyphe, Driftnet) expand target discovery across 13 search engines -- shared keys (Shodan, Censys, FOFA, etc.) are automatically reused. Supports key rotation -- configure multiple keys per tool with automatic round-robin rotation to avoid rate limits.
• Tunneling -- configure ngrok or chisel for reverse shell tunneling. Changes apply immediately without container restarts.

4. Open the Webapp

Go to http://localhost:3000 -- create a project, configure your target, and start scanning.

For a detailed walkthrough of every feature, check the Wiki.

> Prefer video? Watch the Product Demos playlist on YouTube for step-by-step tutorials.

> Having issues? See the Troubleshooting guide or the Wiki Troubleshooting page.

Management Commands

All lifecycle management is handled by a single script:

| Command | Description | |---------|-------------| | ./redamon.sh install | Build + start lightweight (no GVM, no Knowledge Base, Tavily-only web search) | | ./redamon.sh install --kbase | Build + start with the local Knowledge Base (~4.4 GB heavier) | | ./redamon.sh install --gvm | Build + start with GVM/OpenVAS |

Flags can be combined: ./redamon.sh install --gvm --kbase

| Command | Description | |---------|-------------| | ./redamon.sh update | Pull latest version, smart-rebuild only changed services (preserves your install-time GVM/KB choice) | | ./redamon.sh up | Start services (auto-detects GVM and KB mode from install) | | ./redamon.sh up dev | Start in dev mode with hot-reload (auto-detects GVM and KB mode) | | ./redamon.sh down | Stop services (preserves data) | | ./redamon.sh status | Show running services, version, GVM mode, KB state, plugin platform state (and why it cannot run on this host, when it cannot) | | ./redamon.sh clean | Remove containers + images, keep data | | ./redamon.sh create-admin | Create the admin login (or reset it) -- use if no prompt appeared at install | | ./redamon.sh reset-password | Reset an existing user's password from the terminal | | ./redamon.sh supply-chain-sync [ecosystems] | Populate the offline OSV database for the supply-chain feature (default: npm; e.g. npm PyPI Go) | | ./redamon.sh purge | Remove everything including all data |

Updating to a New Version

Just run:

./redamon.sh update

The script pulls the latest code from GitHub, detects which Dockerfiles and source files changed, rebuilds only the affected images, and restarts the updated services. Your databases, scan results, and reports are preserved -- volumes are never deleted.

One-time note when a release adds a new background service. update re-execs the freshly-pulled script so new build/start rules apply automatically -- but only for the script version you are updating from. When updating from a version that predates this self-heal (i.e. your first update onto it), run ./redamon.sh up once right after update so any newly added core service is started:

>

> ./redamon.sh update && ./redamon.sh up

> up is idempotent -- it starts only what is missing and leaves running containers untouched. After this one-time step, plain ./redamon.sh update handles everything on its own.

Upgrading across 6.9 (repository reorganization). 6.9 grouped the top-level directories under scanners/, services/, testing/, tooling/ and docs/. git pull moves only tracked files, so data that git does not track -- the knowledge-base index, past scan outputs, and the single-host deploy .env and TLS material -- would otherwise be left behind at the old paths. update (and up/status) migrate it for you automatically and print what moved. If any file was written by a container as root and could not be moved, finish it with:

>

> sudo ./redamon.sh migrate-layout

The webapp also checks for updates automatically and shows a notification in the UI when a new version is available.

Deploy to a Server (Production)

The Quick Start above runs RedAmon locally on localhost. To run a shared, internet-reachable instance on a Linux server (EC2, DigitalOcean, Hetzner, or bare metal), use the single-host deploy in tooling/deploy/single-host/. It drives redamon.sh over SSH from your laptop and wraps the stack in the internet-facing security layer RedAmon omits by default: nginx + TLS (Let's Encrypt), a host firewall, SSH hardening, and fail2ban, with a single public HTTPS origin so only the login page is reachable and everything else stays bound to loopback.

cd tooling/deploy/single-host
cp .env.example .env      # set HOST_IP, DOMAIN, SSH_KEY_PATH, OPERATOR_ALLOW_CIDRS,
                          # LETSENCRYPT_EMAIL, ADMIN_* ...
./deploy.sh init          # first build takes 30-60 min, then log in at https://<domain>/

Full walkthrough: Wiki: Deploying to a Server. Complete reference: tooling/deploy/single-host/README.md.

Development Mode

For contributors and active development with Next.js fast refresh:

./redamon.sh up dev           # auto-detects GVM mode from install

Tool images are built automatically on first run if they don't exist yet. The dev override swaps the production webapp image for a dev container with your source code volume-mounted. Every file save triggers instant hot-reload in the browser.

When to Rebuild vs Restart

| What changed | Action needed | |-------------|---------------| | webapp/src/ (frontend code) | Nothing -- Next.js hot-reload handles it in dev mode | | agentic/*.py (agent Python code) | docker compose build agent && docker compose up -d agent (source is baked into the image, so restart alone won't pick up .py changes) | | recon_orchestrator/*.py | docker compose restart recon-orchestrator | | mcp/servers/*.py (MCP servers) | docker compose restart kali-sandbox | | agentic/Dockerfile or agentic/requirements.txt | docker compose build agent && docker compose up -d agent | | recon_orchestrator/Dockerfile or its requirements.txt | docker compose build recon-orchestrator && docker compose up -d recon-orchestrator | | mcp/kali-sandbox/Dockerfile | docker compose build kali-sandbox && docker compose up -d kali-sandbox | | webapp/Dockerfile or webapp/package.json | docker compose build webapp && docker compose up -d webapp | | recon/Dockerfile | docker compose --profile tools build recon | | scanners/gvm_scan/Dockerfile | docker compose --profile tools build vuln-scanner | | scanners/github_secret_hunt/Dockerfile | docker compose --profile tools build github-secret-hunter | | scanners/trufflehog_scan/Dockerfile (Secret Multiscanner) | docker compose --profile tools build trufflehog-scanner | | scanners/baddns_scan/Dockerfile or scanners/baddns_scan/entrypoint.sh | docker compose --profile tools build baddns-scanner | | scanners/wcvs/Dockerfile (web cache poisoning engine) | docker compose --profile tools build wcvs | | scanners/supply_chain_scan/Dockerfile (L1 scanner) | docker compose --profile tools build supply-chain | | scanners/supply_chain_analyzer/ (DIRTY analyzer; entrypoint is baked) | docker compose --profile tools build supply-chain-analyzer | | docker-compose.yml | docker compose up -d (re-creates affected containers) | | prisma/schema.prisma | docker compose exec webapp npx prisma db push |

Rebuild a single service:

docker compose build <service>                    # Rebuild one image
docker compose up -d --no-deps <service>          # Restart only that service

Common dev commands:

docker compose ps                                 # Check service status
docker compose logs -f <service>                  # Follow logs for a service
docker compose down                               # Stop all (preserves volumes)
docker compose --profile tools down --rmi local   # Remove built images
docker compose --profile tools down --rmi local --volumes --remove-orphans  # Full cleanup

Reclaim disk space:

docker system df                                  # Show Docker disk usage (add -v for per-image breakdown)
docker image prune -f                             # Remove dangling images (auto-run by ./redamon.sh install and update)
docker builder prune -f                           # Drop unused build cache (auto-run after every successful build; opt out with REDAMON_NO_AUTO_PRUNE=1)
docker builder prune -af                          # Drop ALL build cache, including what the current images reuse -- frees no extra disk and makes the next rebuild cold
docker container prune -f                         # Remove stopped containers

For a complete development reference -- hot-reload rules, common commands, important rules, and AI-assisted coding guidelines -- see the Developer Guide.

Knowledge Base (RAG-Enhanced Web Search)

The agent's web_search tool includes a local Knowledge Base -- a RAG pipeline that searches curated security datasets (GTFOBins, LOLBAS, OWASP WSTG, NVD CVEs, ExploitDB, Nuclei templates, and agent skill docs) before falling back to Tavily web search. When the KB returns a high-confidence match, Tavily is skipped entirely for faster, offline-capable results.

How it works: When the KB is enabled, install / up / update builds a lightweight KB index (~1,200 chunks in 10-15 min on CPU). At query time, the agent runs a hybrid retrieval pipeline (FAISS vector search + Neo4j fulltext), reranks with a cross-encoder, and checks a confidence threshold. If the score is high enough, results come from the local KB. Otherwise, it falls back to Tavily or merges both.

Default behavior: The KB is opt-in. ./redamon.sh install produces a lightweight install (~4.4 GB lighter, Tavily-only web search). To enable the local KB, pass --kbase:

./redamon.sh install --kbase

On first install with --kbase, RedAmon detects your hardware (GPU / CPU / API) and offers a quick-start profile. The choice is persisted, so subsequent update / up commands respect it without re-passing the flag.

Speed up ingestion with API embeddings: By default, embeddings run locally on CPU/GPU. On CPU-only machines, large datasets (ExploitDB, NVD) can take hours. You can offload embedding to an external API by creating a .env file from the template:

cp .env.example .env

Then configure the embedding API in .env:

| Variable | Default | Description | |----------|---------|-------------| | KB_EMBEDDING_USE_API | false | Set to true to use API-based embeddings instead of local model | | KB_EMBEDDING_API_BASE_URL | (empty = OpenAI) | Any OpenAI-compatible endpoint (Ollama, vLLM, LiteLLM, Together AI, Azure) | | KB_EMBEDDING_API_KEY | (empty) | API key for the embedding provider | | KB_EMBEDDING_API_MODEL | text-embedding-3-small | Model name (provider-specific) | | NVD_API_KEY | (empty) | Free NVD API key for 10x faster CVE ingestion |

Example with Ollama (free, local, no API key cost):

KB_EMBEDDING_USE_API=true
KB_EMBEDDING_API_BASE_URL=http://host.docker.internal:11434/v1
KB_EMBEDDING_API_KEY=ollama
KB_EMBEDDING_API_MODEL=nomic-embed-text

Important: Ingestion and query must use the same model. If you switch models, rebuild the index: make -C services/knowledge_base kb-rebuild-lite MODE=docker

Manage the KB:

./redamon.sh kb build lite          # Build with lite profile (~30-60s with API)
./redamon.sh kb build standard      # Add NVD CVEs
./redamon.sh kb update nvd          # Incremental NVD refresh
./redamon.sh kb stats               # Show index statistics
./redamon.sh kb rebuild lite        # Wipe and rebuild from scratch

For full technical documentation -- query pipeline, data sources, ingestion profiles, scoring, security model -- see the Knowledge Base Technical Reference or the Wiki: Knowledge Base & Web Search.

Table of Contents

• Full Wiki Documentation
• Overview
• Built for Enterprise, Secure by Design
• Security & Threat Model
• Feature Highlights
• System Architecture
• Components
• Documentation
• Troubleshooting
• RedAmon HackLab
• Community Showcase
• Legal

Overview

RedAmon is a modular, containerized penetration testing framework that chains automated reconnaissance, AI-driven exploitation, and graph-powered intelligence into a single, end-to-end offensive security pipeline. Every component runs inside Docker (no tools installed on your host) and communicates through well-defined APIs so each layer can evolve independently.

The platform is built around six pillars:

| Pillar | What it does | |--------|-------------| | Reconnaissance Pipeline | A parallelized fan-out / fan-in scanning pipeline that maps your target's entire attack surface (starting from a single domain, IP addresses / CIDR ranges, or a Domain batch of many domains scanned in turn) from subdomain discovery (5 concurrent tools) through port scanning, Nmap service detection and NSE vulnerability scripts, HTTP probing, resource enumeration, and vulnerability detection. Independent modules run concurrently via ThreadPoolExecutor, graph DB updates happen in a background thread, and results are stored as a rich, queryable graph. Complemented by standalone GVM network scanning, GitHub secret hunting, and Secret Multiscanner deep secret scanning modules. | | AI Agent Orchestrator | A LangGraph-based autonomous agent that reasons about the graph, selects security tools via MCP, transitions through informational / exploitation / post-exploitation phases, and can be steered in real-time via chat. | | Attack Surface Graph | A Neo4j knowledge graph with 17 node types and 20+ relationship types that serves as the single source of truth for every finding, and the primary data source the AI agent queries before every decision. | | EvoGraph | A persistent, evolutionary attack chain graph in Neo4j that tracks every step, finding, decision, and failure across the attack lifecycle, bridging the recon graph and enabling cross-session intelligence accumulation. | | CypherFix | Automated vulnerability remediation pipeline: one triage run scores every finding from the graph with a fixed risk model, groups the ones that share a fix, has an LLM check the evidence behind each, and writes one fix item per group. A CodeFix agent then clones the target repository, implements a fix using a ReAct loop with 11 code tools, and opens a GitHub pull request. | | Project Settings Engine | 500+ per-project parameters (exposed through the webapp UI) that control every tool's behavior, from Naabu thread counts to Nuclei severity filters to agent approval gates. |

Built for Enterprise, Secure by Design

RedAmon is engineered to drop into a real security organization, not just a researcher's laptop.

• Secure by design, STRIDE threat-modeled. The whole platform is assessed end to end under STRIDE and hardened in independently verified waves: code-level privilege separation, a filtering Docker broker in front of the host socket, fail-closed auth, SSRF egress guards, secret redaction, append-only audit trails, and a non-disableable guardrail that blocks government, military, and intergovernmental targets. See the Security Posture and Threat Model.
• Fully isolated and containerized. Every tool, scanner, and agent runs in its own container with no host-level execution. Scan jobs are spawned as ephemeral sibling containers with their own filesystem and network namespace, then torn down on completion, keeping the host clean and containing the blast radius of any exploit.
• Governed and multi-tenant. Multi-user / multi-project tenancy with admin and standard roles, DB-level user_id + project_id scoping on every node, Rules-of-Engagement enforcement, human-in-the-loop approval gates, and 500+ per-project settings give teams the control an enterprise engagement requires.

cd tooling/deploy/single-host
cp .env.example .env      # set DOMAIN, HOST_IP, SSH_KEY_PATH, ADMIN_* ...
./deploy.sh init          # builds the full stack and brings it up over SSH

Full walkthrough: Wiki: Deploying to a Server.

Security & Threat Model

RedAmon is offensive software, so we hold it to the standard it tests others by. It is engineered secure by design and has been assessed end to end under the STRIDE methodology (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege), with findings remediated in sequenced, independently verified waves.

This is not a marketing claim. It is grounded in a published, evidence-based analysis you can read:

• Security Posture - the full defense-in-depth control catalog: every layer implemented, mapped to the code.
• Threat Model - the assets, trust boundaries, data flows, entry points, and network surface the analysis was built on.

• Code-level privilege separation. The target-facing worker is the least trusted component and holds no secrets; a filtering docker-broker stands between the orchestrator and the host Docker socket (image allowlist, denies --privileged, host-root binds, dangerous capabilities).
• Two deployment postures, one trust model. Local (backends bound to loopback) and a hardened public-internet deploy that adds nginx + TLS, an operator gate, login rate-limiting, and a single public origin.
• Fail-closed by default. Unset auth tokens reject rather than serve, default database credentials are refused and rotated, WebSockets require a signed ticket plus a server-side same-origin check, and every request is scoped to its authenticated owner (per-user access control with anti-enumeration 404s).
• Defense in depth. SSRF egress guards, secret redaction in logs, append-only audit trails, container-escape hardening, decompression and concurrency caps, and supply-chain pinning (sha256 + commit pins).
• A non-disableable hard guardrail blocks government, military, and intergovernmental targets regardless of configuration.
• Third-party plugins are contained, not trusted. The plugin platform installs only from an Ed25519-signed catalog, runs each plugin under its own UID in a runner with no internet and no database or LLM credentials, reaches the stack only through a two-route proxy that re-authorizes every call, and lets a plugin change the agent's instructions only through text a person approves.
• Verified, release-gated remediation. Fixes ship in sequenced waves, each independently verified with live exploit reproduction before and after the patch. See the Changelog security entries.

Feature Highlights

Reconnaissance Pipeline

A fully automated, end-to-end external attack-surface mapper running inside a Kali Linux container. Give it one input (a root domain, a subdomain list, IP/CIDR ranges, or a Domain batch: a list of hostnames grouped by domain and scanned one group after another into a single graph) and the pipeline returns a complete, structured picture of the target: every subdomain, every live host, every open port, every HTTP service with its technology stack, every crawled endpoint and discovered parameter, every CVE the target is likely vulnerable to, plus dedicated scanners for GraphQL APIs, subdomain takeovers, hidden virtual hosts behind reverse proxies, web cache poisoning & deception, and an Adversarial AI Surface layer that tags AI runtimes / vector DBs / LLM frontends / proxies / MCP servers / chat / completion / embedding / RAG endpoints and prompt-injectable parameters using header / favicon / title / path / parameter-name signatures, then actively confirms them with a dedicated AI Surface Recon module (benign chat-shape probes, MCP handshake + tool-poisoning scan, vector-DB reads — no LLM calls).

Everything runs on a fan-out / fan-in architecture: each phase fires as many tools in parallel as the work allows, then converges before the next phase begins. 40+ industry tools integrate into one coordinated workflow, wildcard DNS poisoning is filtered out automatically with puredns, and stealth mode keeps the entire pipeline running on passive sources only when active probing is off-limits. Findings stream into the Neo4j knowledge graph on a background thread so the scan never blocks on database writes, and the raw JSON is preserved for download. The detailed tool-by-tool breakdown is in the matrix below.

Wiki: Running Reconnaissance | Technical: README.RECON.md

Recon Pipeline Tool Matrix

| Settings Tab | Phase | Tools | Type | Execution | |:-----:|-------|-------|:----:|-----------| | Discovery & OSINT | Subdomain Discovery | crt.sh, HackerTarget, Subfinder, Amass, Knockpy | Passive* | 5 tools parallel | | | Wildcard Filtering | Puredns | Active | Sequential | | | WHOIS + URLScan | python-whois, URLScan.io API | Passive | Parallel | | | DNS Resolution | dnspython | Passive | 20 parallel workers | | | OSINT Enrichment | Shodan / InternetDB | Passive | Parallel with port scan | | | Uncover Expansion | ProjectDiscovery Uncover (13 engines: Shodan, Censys, FOFA, ZoomEye, Netlas, CriminalIP, Quake, Hunter, PublicWWW, HunterHow, Google, Onyphe, Driftnet) | Passive | Before port scan (GROUP 2b) | | | Threat Intel Enrichment | Censys, FOFA, OTX (AlienVault), Netlas, VirusTotal, ZoomEye, CriminalIP | Passive | 7 tools parallel (GROUP 3b) | | Port Scanning | Port Scanning | Masscan, Naabu | Active / Passive | Both parallel (Naabu supports passive InternetDB mode) | | Nmap Service Detection | Service Version Detection | Nmap (-sV, --script vuln) | Active | Sequential per target | | Port Scanning | TLS Certificate Grab | tlsx: one handshake per open non-HTTP port (SMTPS 465, IMAPS 993, POP3S 995, LDAPS 636, FTPS 990, and any odd TLS port the port scan found), capturing issuer / SAN / validity / posture where httpx only reaches the five HTTPS ports it dials. In-scope SAN hostnames feed back as scan targets (apex-scoped, resolve-checked); optional JARM / JA3 fingerprints and TLS version / cipher enumeration | Active | After Nmap, before HTTP probing so discovered hostnames become probe targets (GROUP 3.6) | | HTTP Probing | HTTP Probing | httpx | Active | Internal parallel | | | Tech Detection | Wappalyzer | Passive | Sequential (post-probe) | | | Banner Grabbing | Custom (Python sockets: SSH, FTP, SMTP, MySQL, etc.) | Active | Parallel workers | | Resource Enum | Web Crawling | Katana, Hakrawler | Active | Parallel | | | Archive Discovery | GAU (Wayback, CommonCrawl, OTX) | Passive | Parallel with crawlers | | | Parameter Mining | ParamSpider (Wayback CDX) | Passive | Parallel with crawlers | | | JS Analysis | jsluice | Active | Sequential (post-crawl) | | | Directory Fuzzing | FFuf | Active | Sequential (post-jsluice) | | | Browser Crawling | ZAP Ajax Spider | Active | Sequential (post-FFuf), per-seed Docker containers in parallel | | | Parameter Discovery | Arjun | Active / Passive | Methods parallel (GET/POST/JSON/XML) | | | API Discovery | Kiterunner | Active | Sequential per wordlist | | | Endpoint AI Classifier | Path + parameter classifier — tags Endpoint.ai_interface_type (llm-chat, llm-completion, llm-embedding, llm-tool-call, sse-stream, mcp, llm-graphql), is_ai_rag_ingest, Parameter.is_ai_prompt_injectable against catalogued AI signatures | Passive | Sequential (post-crawl) | | JS Recon | JS Secret Detection | 100 regex patterns + custom uploads | Passive | Parallel per file | | | Key Validation | 21 service validators (AWS, GitHub, Stripe, etc.) | Active | Rate-limited (1/sec/svc) | | | Source Map Discovery | Comment, header, path probing | Active | Per JS file | | | Dependency Confusion | npm registry check | Passive | Per scoped package | | | Endpoint Extraction | REST, GraphQL, WebSocket, router patterns | Passive | Per JS file | | | Framework Fingerprinting | 12 built-in + custom signatures | Passive | Per JS file | | | DOM Sink Detection | 17 XSS/prototype pollution patterns | Passive | Per JS file | | Serialized Object Scan | Serialized-Object Detection | Passive, in-memory detection of insecure-deserialization sinks across every major family (native Java rO0/aced, Jackson/FastJSON/XMLDecoder/XStream/SnakeYAML/Hessian, PHP O:/a: + PHAR, Python pickle, .NET BinaryFormatter + ASP.NET ViewState, Ruby Marshal) in response headers, Set-Cookie, enumerated parameters and crawled form fields; bomb-safe decode-and-recurse normalizer that never deserializes. Writes info-severity :Vulnerability candidates (needs_agent_confirmation) that the Insecure Deserialization agent skill then confirms with a non-destructive OOB oracle. Disabled by default | Passive | GROUP 5b (beside JS Recon) | | Supply Chain Recon | Malicious Package Detection | Black-box harvest of the npm package set the target serves (source-map node_modules mining + import/require + Wappalyzer technologies), synthesized into a CycloneDX SBOM and verdicted against the offline OSV database. Writes Package + MalPackageFinding nodes, anchored to BaseURL via DEPENDS_ON. No new fetches (parses JS-recon output) | Passive (offline) | Post-JS-recon (GROUP 5.5) | | AI Surface Recon | AI/LLM/MCP/Vector-DB Fingerprinting | Active confirmation of the surfaces the classifier flagged — chat-shape probes (dialect/streaming/latency), MCP handshake + tools/list + Cisco YARA tool-poisoning scan, OpenAPI/model-listing discovery, Julius YAML probe-pack engine, vector-DB confirmation reads (qdrant/chroma/weaviate/milvus). Writes Endpoint.ai_ / ai_mcp_, Parameter.is_ai_prompt_injectable, confirmed Technology(ai-*), and MCP tool-poisoning Vulnerability nodes | Active (benign, no LLM calls) | Hosts parallel, workloads sequential (GROUP 5c / Phase 4.5) | | AI Gauntlet | Broad LLM Scan | garak — 40 probe families (prompt injection, DAN jailbreaks, encoding bypass, data-leak replay, system-prompt extraction, toxicity, malware / exploit generation, package hallucination) | Active (offensive) | Offensive follow-up to recon; one-shot per probe, ASR per family, local-judge graded | | | Multi-Turn Jailbreaks | PyRIT — bounded conversational attacks (crescendo, skeleton-key, TAP, many-shot) | Active (offensive) | Multi-turn escalation, local attacker / judge model | | | Quality + Safety Scan | Giskard — app-tailored detectors (prompt injection, information disclosure, hallucination, harmfulness, stereotypes, sycophancy, output formatting) | Active (offensive) | Test set generated from the app purpose, local judge | | | Red-Team Eval | promptfoo — public attack datasets (Pliny, BeaverTails, HarmBench) + encoding strategies (base64, rot13, leetspeak, morse, pig latin) | Active (offensive) | Dataset eval, ASR per plugin, local judge | | Vulnerability Scanning | Vulnerability Scanning | Nuclei (9,000+ templates + DAST + custom template upload) | Active | Parallel with GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) | | GraphQL Security | GraphQL Security Testing | Endpoint discovery, introspection test, schema extraction, sensitive-field detection, graphql-cop (12 misconfig checks: alias/batch/directive DoS, GraphiQL, trace mode, GET/POST CSRF, field suggestions) | Active / Passive | Parallel with Nuclei + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) | | Subdomain Takeover | Subdomain Takeover Detection | Subjack (Apache-2.0 DNS-first fingerprints) + Nuclei takeover templates (http/takeovers/ + dns/) + BadDNS (AGPL-3.0 isolated sidecar: CNAME, NS, MX, TXT, SPF, DMARC, wildcard, NSEC, references, zonetransfer). Cross-tool dedup, 12+ auto-exploitable providers, confidence-scored confirmed / likely / manual_review verdicts | Active / Passive | Parallel with Nuclei + GraphQL Scan + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) | | VHost & SNI Enumeration | Hidden Virtual Host Discovery | Curl-only dual-layer probing: L7 Host-header overrides + L4 TLS SNI swaps via --resolve, baseline-comparison anomaly detection, 4-tier severity ladder (high for L7/L4 routing inconsistency, medium for internal-keyword matches, low/info for status/size deltas), 2,471-entry default wordlist + custom + graph-derived candidates, discovery feedback loop into httpx | Active | Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) | | Web Cache Poisoning | Web Cache Poisoning & Deception | Two-engine detection: WCVS (Hackmanit, Docker-in-Docker) breadth sweep across 10+ technique classes (unkeyed-header poisoning, parameter cloaking, path/cache-key normalization, cache-key injection, web cache deception) then a RedAmon-native 5-phase confirmation (cache oracle with silent-cache frozen-Date fallback, isolated cache-buster, fingerprint-gated framework packs for Next.js/Nuxt/Remix, baseline→poison→clean persistence check, verified against a never-poisoned control slot and reproduced on fresh slots, reflected + non-reflective differential detection). Confidence-scored Confirmed/Strong/Tentative tiers, min-confidence gate; benign .invalid canaries + isolated cache buckets so the real cache is never poisoned. Disabled by default | Active | Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Origin Discovery (GROUP 6 Phase A) | | Origin Discovery | Origin-IP Discovery (CDN/WAF unmasking) | Finds the real origin server hidden behind a CDN/WAF by pivoting on the fingerprints the origin leaks: 44 non-CDN subdomain names, SPF/MX record IPs, crt.sh SANs, the favicon hash (mmh3), internet-wide scanners (Shodan/Censys/FOFA/ZoomEye/OTX/VirusTotal), and passive-DNS history (SecurityTrails/ViewDNS). It then confirms each candidate by fetching it directly and with a forged Host: header, scoring HTML 60% + TLS cert 25% + headers 15% (± status) against the fronted site. Fail-closed SSRF / CDN-range / current-resolution / RoE filters before any probe; per-scan keyed-search budget; per-target cache; never-raise; converges with the WAF-bypass finding via a tenant-scoped id. Disabled by default | Active / Passive | Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning (GROUP 6 Phase A) | | Security Checks | Security Checks | WAF bypass, direct IP access, TLS expiry, missing headers, cache-control | Active | Parallel workers | | CVE & MITRE | CVE Enrichment | NVD API, Vulners API | Passive | Sequential | | | *

... (README truncated for length)