Skip to content

Use cases

Workflows the current implementation supports end-to-end. Each step names the UI surface involved; screenshots referenced exist in the Product tour.

Organize an engagement

Create the project → define scope entries and ROE → invite members with roles → work across Recon/Exploit/Output tabs → close with the Closure Wizard (decommission report) or export the project as a password-protected ZIP. Everything any member does lands in the timeline.

Run scans that update the map themselves

  1. Register an attacker machine (Infra → Connections, or a pool workstation with the executor flag — both editions)
  2. Recon → Scans → Nmap (or nuclei / NetExec / httpx / ffuf / DonPAPI); pick an intensity profile and, optionally, execute through a pivot listener
  3. Results create/updates hosts, ports, services, finding candidates — automatically
  4. Watch re-runs light scans on a schedule and diffs new hosts/ports

Validate credentials into an access graph

Creds → add or bulk-paste → select a cred → Validate against hosts (SMB/WinRM/SSH/LDAP/MSSQL/RDP). Successful checks mark access edges on the graph, update host status, and generate finding candidates. The Cred matrix and reuse views show coverage; {{USER}}/{{PASS}} placeholders in commands substitute from creds.

Import third-party evidence

  • Nessus .nessus, Burp XML → findings and hosts
  • BloodHound ZIP → hosts, creds, and MemberOf/AdminTo/HasSession access edges
  • nmap XML / NetExec output / firewall configs (nine vendors) via the importers — firewall imports also enrich the network map
  • Bulk host import from IP/CIDR lists

Maintain and prove infrastructure state (EE)

Platform Ops → Catalog → pick a template (C2, redirector, dropper, pivot) → Builder → deploy the stack. The post-deploy pipeline wires links, generates admin credentials (encrypted, shown on the project Access tab), registers C2 integrations, pushes listeners, sets up DNS and VPN. Tear-down is the same pipeline in reverse — with a decommission report proving what was destroyed.

Automate the repetitive parts

  • Build a playbook once (recon chain, AD enumeration, spray+validate) and batch-run it across hosts or schedule it
  • Trigger automations on events (new cred, job finished, watch diff) with conditions and branching; dry-run before trusting them
  • The Commands tab runs saved snippets on the attacker box with project variables substituted

Report from real data

Output → Report builds the engagement report from live project state (scope, hosts, findings with proof/recommendations, cracked creds, attack paths, graph intel) and exports PDF/HTML/Markdown. The Purple view produces a MITRE-coverage report for the blue team.

Collaborate with an audit trail

Simultaneous editing with presence indicators and live sync (WebSocket); every secret reveal, export and privileged action is audit-logged with actor and timestamp; snapshots capture and restore project state groups; host claims keep operators from colliding.