Umbryx Wiki

Umbryx is an offensive-security operations platform: reconnaissance, exploitation, evidence and reporting in one place — connected, so operations update the state instead of being logged into it.

Note

Umbryx is developed with AI-assisted tooling. Every release passes an automated test suite and a security review before shipping.

Two editions, one platform:

• Umbryx Core — the full operational platform for your own machines. Source-available, no license key.
• Umbryx EE — adds the infrastructure lifecycle: deploy, integrate and tear down C2 stacks, redirectors, DNS and TLS; workstation provisioning; HA recipe. Signed license.

Where to start

You want to…	Go to
Understand what this is, with screenshots	What is Umbryx, Core concepts
Install and run a first scan	Getting started, Installation
Compare the editions	Core vs EE
Use a feature	User guide — projects, hosts, creds, scans, automation, reporting, …
Configure the deployment	Configuration reference, Security configuration
Operate and maintain	Administration — health, backup, upgrades, users, licensing
Understand security and access	Security, Access control
Study the internals	Architecture, Modules, Database model, API reference
Extend and contribute	Contributing, Module developer guide, Testing
Fix a problem	Troubleshooting, FAQ
See what's planned	Planned features

The short version

• Operations run from the platform — scans and execution happen on attacker machines the platform manages over SSH, not just logged after the fact
• The graph reflects what you know right now — tool output creates hosts, ports, access edges and finding candidates automatically
• Reporting pulls from real data — including attack paths and graph intelligence, not memory
• Security by construction — per-project encrypted secrets, 11-role RBAC, an audit trail with HMAC fingerprints
• Provable teardown (EE) — infrastructure destroyed the same way it was deployed, with a decommission report

Terminology: Glossary.