Skip to content

Core concepts

The entities the platform is built from — all verified against the implementation. Availability: both editions unless noted.

Project (engagement)

The unit of work: one red-team engagement or assessment.

  • Attributes: name, status (active/paused/done), client IP/OS summary, description, intensity profile, environment variables, webhook token, optional organization link
  • Relationships: owns every entity below; membership grants access
  • Interaction: create → set scope → invite members → work → close (Closure Wizard) or export/archive
  • The creator becomes the project owner; the last owner cannot be removed

Scope and ROE

  • Scope entries — CIDR / hostname / domain / URL, each in_scope or excluded, optionally an entry point or reachable via a compromised host. Scans and targets are checked against scope.
  • ROE (Rules of Engagement) — allowed/forbidden activity types, activities requiring approval, work hours, max scan rate. Enforced in the job runner: violating jobs finish as failed or pause for approval (awaiting_approval).

Hosts and infrastructure assets

  • Hosts — IP/hostname/OS/status (unknown … full control), ports/services, tags, risk score, scan history/diffs; can be marked attacker-side; "burn" marks compromise with an OPSEC checklist
  • Networks / network map — manual maps with nodes, edges, regions; Smart Build infers them from operational data
  • Pivot observations — SOCKS/route/port-forward tunnels with route CIDRs; usable as execution sources for scans
  • Deconfliction claims — advisory "who is working on this host"

Credentials and secrets

  • Creds — username/secret/type/service, linkable to hosts and domains; cracked flag; validation jobs produce access edges. Secrets are encrypted with a per-project DEK and revealed only to roles holding credentials.read_secret.
  • Project secrets (vault) — named secrets with revoke, SSH-key generation, download

Activities, jobs, and tooling

  • Host activities — recorded actions with command/output
  • Jobs — every scan/exec/validation run: status, live output (SSE), structured results (created hosts/findings/creds), ROE approvals, cancellation
  • Scans — nmap / nuclei / NetExec / httpx / ffuf / DonPAPI, executed on attacker machines over SSH
  • Watch — scheduled light scans diffing the attack surface

Findings, notes, loot, knowledge

  • Findings — severity/CVSS/CVE, proof, recommendation, statuses, approval workflow, templates, scanner candidates
  • Notes — markdown by phase, tags, attachments, confidential tags (encrypted content)
  • Loot — files and text artifacts (hashes, secrets), encrypted on disk, linked to the producing job
  • KB — markdown articles (project or global scope) incl. MITRE ATT&CK material
  • Objectives — flags/BAS/objectives with points and statuses

Attack paths and graphs

  • Attack paths — manual trees of steps (action/condition/ milestone/pivot) with MITRE techniques and confidence
  • Attack graph — the canonical auto-graph of cred links, access edges and pivots; privilege paths and tier zones

Automation

  • Playbooks — DAGs of connector steps with dependencies, branching, single/batch/scheduled runs; operation packs
  • Automations — trigger-driven rules (event/schedule/cascade) with conditions, dry-run, kill-all

Users, roles, organizations

  • Global roles (platform_admin, user, legacy global viewer) and 11 project roles; organizations with teams and org-level fallback access — see Access control
  • Workstations — operator machines; key grant/revoke with audit (both editions), provisioning (EE)

Infrastructure (EE)

  • Providers / nodes / templates / blueprints / stacks / services / links / deploy steps — the Platform Ops object model
  • Managed instances — k8s pool of template services with claim/release
  • DNS zones/records, SSL certificates — managed external presence