01
mcp surface
The tool surface an MCP client sees
The complete set of tools an MCP client sees. needle is the
master dispatcher for every security operation; scan_async
is its background-task variant. The rest is the infrastructure those
operations run against, grouped below.
Dispatch
2 tools
needleMaster dispatcher. needle(operation, args) runs any of the 190+ operations listed below. Synchronous; suitable for fast tools.
scan_asyncSame surface as needle, but enqueued as a background task; returns a task_id immediately. Use for floods, large fuzzers, and anything that would otherwise block the MCP call.
Background tasks
4 tools
task_pollGet status, partial output, and final result for a background task by task_id.
task_cancelCancel a running background task. No-op if already finished.
task_listList all background tasks for the current user, running and recently completed.
tool_result_readRead a chunk of a spilled tool result by result_handle. Used when a prior call returned status: ok_spilled because the result was too large to inline; each read lands in the on-chain tool_runs audit trail.
Out-of-band callbacks
10 tools
oob_callbackReturn the callback domain + URLs for the active engagement under *.oobd.io. One minted token answers on DNS, HTTP/S, LDAP/LDAPS, SMTP/SMTPS, FTP/FTPS, and SMB. The ldap field is a ready ldap://<token>.oobd.io/<token> string for JNDI / Log4Shell (${jndi:ldap://...}) confirmation — drop it in whole, the token must ride the DN path for attribution. The smtp field is a callback@<token>.oobd.io recipient for mail-vector OOB (SSRF-to-SMTP, "notify this address", RCPT injection).
oob_callback_pollFetch captured hits for the active engagement. Each hit carries kind = dns / http / ldap / smtp / ftp / ntlm plus qname or host for correlation; coerced SMB and HTTP authentication lands as a ntlm hit with the captured NetNTLMv2 material rather than a bare log line. Cursor-paginated via since_id.
oob_callback_flushDrain all pending callbacks from the queue.
oob_canaryMint a correlation-tagged canary under *.oobd.io for confirming indirect prompt injection and LLM data exfiltration — exfil rides HTTP paths or DNS labels.
oob_canary_checkConfirm an injection canary by its OOB callbacks; filters recorded hits by marker and decodes data exfiltrated through DNS labels or HTTP paths. Optionally records a verified finding.
oob_responder_setMake the active engagement's minted *.oobd.io callback URL return an attacker-chosen HTTP response — status, headers, body (or body_b64 for binary). For SSRF redirect-follow / content-read confirmation, open-redirect chains, OAuth redirect_uri exfil, web-delivered prompt injection. Inbound hits still logged first; framing / hop-by-hop headers rejected.
oob_responder_statusCurrent OOB HTTP responder config for the active engagement — status_code, headers, body_bytes; {responder_configured: false} if unset.
oob_responder_resetClear the OOB HTTP responder; the callback URL reverts to logging-only (empty 200).
oob_placement_setChoose where this engagement's callbacks are collected. public (default) collects at oobd.io across the full protocol range. runner binds an HTTP listener on a named runner's own network segment — for a target that is air-gapped or egress-filtered, where oobd.io is unreachable and a blind callback that never arrives is indistinguishable from "not vulnerable". Every OOB-consuming primitive is unchanged; the URL from oob_callback is used exactly as before. Requires the runner's local_callback capability. Bounded by construction: unprivileged port, hard expiry (1–480 min), hit ceiling, optional source CIDRs.
oob_placement_statusWhere callbacks are currently collected and, under runner placement, the live listener: bound address and port, hits against ceiling, source restrictions, hard expiry. A runner placement with no listener means callbacks are landing nowhere — re-arm or switch back to public.
OOB DNS
6 tools
dns_rebind_setupConfigure DNS rebinding on the engagement's OOB subdomain — phase1 IP for N hits, then flip to phase2.
dns_rebind_statusCurrent rebind config, hit count, and flip state.
dns_rebind_resetTear down the active rebind config; subdomain reverts to normal resolution.
oob_dns_record_setSet a static custom record on the engagement's OOB subdomain, answering <label>.<token>.oobd.io (label @ = token apex) with a chosen A / AAAA / CNAME / MX / TXT. value accepts a cloud-metadata alias (aws / gcp / azure / alibaba / oracle / localhost) expanded to that provider's metadata IP, for SSRF-to-metadata confirmation. Also CNAME-chain and SSRF filter-follow probes, and MX-routing vectors — plain mail delivery needs no record, the default MX already points at our mail host. Internal/reserved values require the operator-granted internal-ssrf-target trust class. Replaces any same-type record at that label.
oob_dns_recordsList the static custom DNS records set on the active engagement's OOB subdomain.
oob_dns_records_clearRemove all static custom records; OOB DNS reverts to default (A → callback host, default MX).
Proxy observations
4 tools
proxy_observationsStream proxy-observed requests for the active engagement; filter by decision, host (incl. exclude), method, path regex, and status range. Cursor-paginated via since_id.
proxy_observation_detailFull request + response bytes for one proxy observation by event_id. Wrapped in a severance envelope flagging the bytes as external observed data; auth-bearing header values (Cookie, Set-Cookie, Authorization, x-*-token/key/auth) redacted to ***.
proxy_observations_aggregateAggregate proxy observations into groups (by host, method, status, path prefix, etc.) with counts — find the shape of traffic before drilling into individual events.
proxy_llm_surfacesScan observed proxy traffic for LLM-input surfaces (prompt/messages keys, model path tokens, streaming responses); returns candidate surfaces with a host/path rollup. Signals, not verdicts.
Passive network
1 tool
responder_observationsList passive broadcast name-resolution observations — mDNS, LLMNR, NBT-NS — seen by a runner's link-layer listener: queried names, protocols, source IPs, and resolved addresses.
Captured identities
3 tools
captured_sessions_listList captured proxy session-state slots for the active engagement. Pass the capture_id as as_session=<id> on any subsequent tool to deterministically run that tool as the captured identity.
captured_session_inspectInspect one captured slot's parsed identity material — decoded JWT claims (sub / username / role / scope / exp / aud), cookie + header structure. Inspection only; raw values never returned, no replay.
totp_codeGenerate the current TOTP code for an operator-stored seed (stored via dashboard per engagement.label). For scripted re-auth flows behind MFA — token refresh, OAuth replay sequences, post-MFA chain steps.
Findings & engagement
7 tools
insightCreate a structured finding (title, detail, repro_steps, remediation, evidence, severity, CVSS, CWE) in the per-VM findings store.
insight_updateUpdate fields on an existing finding; passed fields replace current values, unset fields are untouched. The audit chain captures the before/after diff.
findings_getReturn the full content of a single finding — detail, repro_steps, evidence, tags, attack_chain, code_refs — for read-before-update enrichment.
findings_in_scopeList the active engagement's findings in compact form (id, target, title, severity, status) — a de-dup check before bulk-logging.
findings_recentPre-scan lookup — surface prior tool runs + recorded findings against a target. Call BEFORE expensive scans (nmap_scan, sqlmap_scan, force_browse, crawl) to avoid duplicate work; the reasoner reads recent coverage instead of burning tokens re-probing.
engagement_configRead the active engagement's authorization config: in-scope targets and the engagement-wide headers injected into every in-scope request the platform makes, read from the same provider that feeds egress. Use it to confirm a configured header actually rode a request by diffing against the Wire block from http_request(verbosity="raw"). Read-only — both are mutated only via the dashboard, never by the agent.
site_mapRead back the durable attack-surface map for the active engagement — URLs accumulated across prior crawl + openapi_ingest runs by kind (page / form / api / link). Call BEFORE re-crawling a walked target to reuse known surface; cursor-paginated via since_id, compact projection by default.
Reporting & analysis
4 tools
attack_graphExecution data-dependency DAG for the active engagement — producer→consumer edges where one primitive's discovered output (url / host / path / secret) fed a later one's input. Each edge carries both ends' anchored primitive.invoked ids, so the attack path is verifiable against the audit chain. w_min drops weak ubiquitous-host links.
remediation_rankingDeterministic remediation prioritization — ranks findings by leverage over the execution DAG: for each finding, how many other findings sit downstream on paths through it. Pure graph reachability, no LLM. downstream_count orders fixes (not a guaranteed break-set); unlinked findings can't be leverage-ranked.
report_executive_summaryWrite the engagement-level executive summary — the across-engagement narrative (scope, posture, headline issues) distinct from per-finding text. Rendered verbatim into the delivered report with no reasoner attribution; skips with operator-authored if the operator hand-edited it in the dashboard.
report_remediation_strategyWrite the optional fix-order prose wrapping the report's computed remediation prioritization — recommended sequence, which top items are upstream enablers, what collapses when each is fixed. Author it after reading remediation_ranking; operator edits are protected.
11
operations catalog
Every operation, dispatched via needle()
Every entry below is invoked as needle("<op_name>", { ... }). Each row carries a taxonomy chip: protocol parameterizes the technique space within an invariant protocol, technique generalizes a technique across protocols within a class, flaw-specific targets a CVE- or framework-frozen flaw.
A row says what an operation does. What a given run is entitled to claim rides the emission: every emit has room for a verdict strength — CONFIRMED_EFFECT, OBSERVED, INFERRED, INCONCLUSIVE — and the primitives that have been through the detection-oracle audit set it per finding, with the rule named when a rule was applied. INCONCLUSIVE is its own state: the probe ran and could not separate the hypotheses, which is not a clean result. A reference that failed in transport is one route there — a dead baseline is not a zero, and a comparison drawn against one is refused rather than scored. How that lands in an emit.
A response can also fail to be a measurement. Anti-automation challenges from Cloudflare, Turnstile, hCaptcha, reCAPTCHA, DataDome, PerimeterX, Akamai, Fastly and F5 ASM are recognised on the proxy path and the primitive path from one shared signature table, and labelled on the envelope that carries the response. The cost of not doing this is in the negative direction: a challenge page is a 200 with HTML in it, and a route_fuzz, param_fuzz, force_browse or crawl run that gets challenged mid-sweep returns a uniform baseline that is byte-identical in meaning to a genuine negative, after which the surface is written off as ruled out. Labelling is where this stops. There is no solver and no bypass in the box; retrying, solving it by hand, or skipping the surface is the operator's call.
What a run claims is one thing; what it does to the target is another. Every primitive declares before dispatch what it can do — write, create, delete, spend a credential, submit failed logins, make the target send mail, hold load — how long that outlives the call, and whether anything here can undo it. Where the reach is set by the caller's arguments rather than by the primitive, http_request among them, the dispatcher makes the caller declare it instead. Afterwards the record says what was actually done, per object, whether the undo ran, and whether it was verified against the target. Anything left changed is named above the findings.
What the target sees of us is one profile rather than a per-primitive accident. Every non-browser primitive egresses through a single client identity applied at one choke point, so two primitives asking the same question of the same URL are the same client, and one can be used to corroborate the other's negative. The browser primitives take a browser_identity parameter whose default is the real Chromium build's own identity with the automation tells removed, which is not a disguise: an override that contradicts the browser is a stronger tell than the one it was meant to hide, because a page reads the WebGL renderer, the font list and the platform client hint as well as the string you set. A per-engagement, program-identifying header rides every request regardless. Nothing here hides who we are from anyone entitled to ask.
Reconnaissance & Discovery
41 ops
http_requestSend an arbitrary HTTP request; return status, headers, and body.protocol
http_diffFire two requests in parallel; return a structured diff of status and content-length.protocol
dns_infoQuery DNS records for a hostname or IP, grouped by type: A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT. Types are auto-selected when omitted (PTR for an address, A / AAAA / MX / NS / TXT for a hostname). Underscored node names (RFC 8552) are queryable, so _dmarc, selector._domainkey, _sip._tcp and _acme-challenge resolve here instead of failing input validation; these names normally hold no address record, which is expected rather than an error. Uses the system resolver by default, so split-horizon and internal DNS answer naturally. nameserver= pins a specific public resolver, which is how a local-resolver problem gets separated from public DNS state.protocol
whois_lookupWHOIS registration and netblock data for an IP or domain.protocol
subdomain_discoverUnified subdomain enumeration via a source= axis — ct (Certificate Transparency logs), brute (wordlist), axfr (zone transfer), nsec_walk (DNSSEC NSEC walk); or sources=[...] to aggregate.protocol
banner_grabConnect to a TCP port and read the service banner.protocol
nmap_scanPort scan a target; return open ports, services, and raw output.technique
tls_probeInspect a TLS service via a mode= axis — cert (certificate + negotiated cipher, flag weaknesses), protocols (which TLS/SSL versions the server accepts, flag deprecated), jarm (active TLS-stack fingerprint for stack-ID / infra-reuse). Connect-only, no raw scan.protocol
egress_infoReport how the active egress path appears from outside. mode=ip (default) returns the source IP the platform edge sees, plus region and forwarded headers, which is what a target will attribute traffic to. mode=fingerprint returns what the path presents on the wire: JA4, JA3 with the full JA3 string, negotiated version, ALPN offer, cipher and extension counts, and where h2 is negotiated the frame layer under it (SETTINGS in wire order, the connection WINDOW_UPDATE, pseudo-header order) as one S|WU|P|PS print. via= chooses which egress stack to measure, and the platform has two that present different ClientHellos: http_client is the plain HTTP client on the L3 tun that http_request uses, browser is the runner uTLS stack that re-originates browser_open traffic. Neither mode contacts a target.protocol
local_interfacesSnapshot the runner's own network interfaces, addresses, and default route — local self-knowledge for scope bootstrapping. No target probing, no egress.protocol
fingerprintSignature-driven technology + version fingerprinting (web server, language, framework, CMS, JS framework, proxy/CDN). Emits detected stack + raw signals — no verdict; composes into cve_lookup.technique
cve_lookupCorrelate a product + version against the locally-synced CVE corpus; emits matched records (id, affected range, fixed_in, severity, references). Evidence, not a verdict; no egress.technique
auth_detectIdentify auth mechanisms in use at a URL.protocol
crawlBreadth-first crawl from a seed URL; return URLs, endpoints, and forms. A stop with pages still queued reports the frontier it left, so route_fuzz and force_browse downstream do not sweep a partial surface and call it whole.protocol
rsc_treeExtract the Next.js App Router route tree from a page's inline RSC payload.flaw-specific
next_chunks_walkEnumerate the full JS chunk graph of a Next.js app via BFS from a seed page.flaw-specific
trufflehog_scanScan a remote git repo for leaked secrets across full commit history.technique
subdomain_takeover_scanResolve each subdomain's CNAME chain and fingerprint the target against a registry of static-hosting, CDN, CMS, helpdesk, and form-builder providers. Where the CNAME hands the hostname to a domain that is not its own, also check whether the edge behind it holds a binding for that hostname. Four axes reported separately: dangling_dns (the CNAME target does not resolve), sni_unbound (the edge serves no certificate for this hostname, or one whose names do not cover it, which is how a dangling name behind a resolving CNAME surfaces), provider_unclaimed_marker (the served page is the provider's own nothing-is-deployed page), and claimable, which is always UNKNOWN — whether a released name can be re-registered is not visible from the wire. More than one observable axis agreeing is the strongest result; nothing here reports a confirmed takeover. A hostname whose handshake never completes is reported as probe_unavailable rather than cleared, since no request budget fixes a subject that would not answer on the layer the conclusion rests on.technique
sourcemap_secretsCrawl a page for JS source maps; scan sourcesContent for secrets, API keys, and credentials.technique
param_fuzzDiscover hidden HTTP parameters via chunk-then-bisect with multi-signal anomaly detection (status, body, text, headers, redirect, reflection). GET / POST / JSON / XML; self-calibrating baseline.technique
json_param_discoverFind JSON body keys that produce a response signal, via bulk-then-bisect probing. A signal is not acceptance: this tool never reads state back, so validation_error means the parser recognized and refused the key — the field exists, and that is positively not acceptance. Keys naming authority (role, tenant, ownership) are called out for a mass_assign_scan chain, which re-reads the object. A search the budget cut short reports what it never got to.technique
api_route_probeProbe routes with a method × auth matrix; classify anonymous vs authenticated access. When the input cap cuts the list, submitted and visited are reported separately — a route rejected for being off-host was examined, one past the cap was not.technique
route_fuzzDiscover API routes via concurrent multi-method fuzzing with per-prefix wildcard-baseline filtering and quarantine-based early stop. Bundled wordlist; caps at 8000 requests. Each path is classified from one probe fired inside the concurrency pool, so an edge that sheds or re-challenges concurrent requests can answer with its generic 404 and have that recorded as a confident miss. After each prefix group the sweep re-probes a bounded random sample of its own misses serially and re-judges them. A path that answers differently the second time is surfaced and the disagreement rate is reported; any disagreement at all sets coverage.complete: false, because the sampled misses are not the point and the unsampled ones are.technique
route_enumProbe a base URL for sensitive, admin, and debug paths; classify each response.technique
force_browseCurated forceful browsing for unlinked sensitive paths. quick / standard / deep modes (~200 / ~800 / ~2000 paths). Hard caps (max 5000 reqs, max 10 recursive subdirs), wildcard-storm abort, and re-run guard via the engagement tool-run ledger.technique
server_action_enumEnumerate Next.js Server Actions reachable from a page; extract action IDs and field shapes.flaw-specific
action_enum_renderedDiscover Server Actions by rendering the page post-React hydration in a real browser.flaw-specific
url_sink_discoverScore and rank candidate fields for SSRF testing by name, type, value, and bundle signals.technique
trpc_probeDetect tRPC endpoints, enumerate procedures from a wordlist, and identify ones callable without authentication.flaw-specific
upload_fuzzProbe a file upload endpoint with 16 test cases: polyglot shells, extension bypasses, path-traversal and zip-slip filenames, htaccess overrides. A benign control file uploads first — an endpoint that refuses that too is refusing everything, and every per-file result comes back INCONCLUSIVE rather than as a defense. Each dangerous file carries a per-run canary: STORED_AND_RETRIEVABLE requires the bytes to come back from the storage URL, fetched with a clean unauthenticated client first; a 2xx alone is NOT_REJECTED. Whether a stored file is interpreted in its serving context is a separate claim this primitive does not make. Stored artifacts, the benign controls included, are removed through an operator-supplied cleanup_url_template with the removal confirmed by re-reading the storage URL; cleanup="required" refuses before the first upload, and anything left behind is named.technique
wordpress_probeWordPress-aware recon across six surfaces: detect / plugin_enum / theme_enum / xmlrpc / rest_api / core. Plugin + theme version extraction from readme.txt + style.css headers; xmlrpc.php system.listMethods + pingback / multicall amplification axes; /wp-json/wp/v2/users JSON-parsed user enum; author-id redirect leak via /?author=N → /author/<slug>/.technique
coldfusion_probeColdFusion / Lucee recon across four surfaces: detect (Server + CFID/CFTOKEN cookies + version regex) / admin (6 /CFIDE/administrator/ case+path variants with title + version per path) / cfm_paths (12 common CF debug paths) / cfide_api (9 /CFIDE/adminapi/*.cfc endpoints WSDL + plain probes).technique
iis_probeIIS / ASP.NET recon across five surfaces: detect (Server + X-AspNet-Version) / short_name (8.3 tilde-disclosure via four wildcard probes; differentiated response codes = vulnerable) / webdav (OPTIONS Allow + DAV class + PROPFIND) / ntlm_leak (Type 1 send → Type 2 AV-pair decode: NetBIOS computer / NetBIOS / DNS domain / DNS tree / OS version) / aspnet_handlers (.axd / .asmx / elmah / Trace.axd info disclosure).technique
endpoint_probeExhaust a single known endpoint in one call — method sweep, ~80-param hidden-query fuzz, body-field fuzz on write methods, content-negotiation flips, and per-segment path traversal with sibling follow-up. Composes the param-coverage + path_traversal_scan primitives; dimensions individually disableable.technique
openapi_ingestThe REST analogue of GraphQL introspection — parse an OpenAPI 3.x / Swagger 2.0 spec (spec_url or inline spec_content) into typed endpoints: method, resolved URL with path template, and path / query / header / cookie / body params each with type + required flag + local $ref resolution. Emitted into the engagement site_map (kind=api). Enumeration only.protocol
git_dumpReconstruct from an exposed .git/ directory — parse .git/index for the tracked-file inventory + blob SHAs, .git/config for remotes, logs/HEAD + refs for history, and with fetch_objects pull + zlib-inflate loose blobs to recover file contents. Goes beyond force_browse (which only finds it); packed-only repos report pack paths for follow-on.technique
bundle_analyzeStatic SAST-slice extraction over an unpacked mobile bundle (APK / IPA) resolved from a bundle_id — goal= selects passes: declared permissions, exported components + intent filters, hardcoded endpoints, embedded credential residue, third-party SDK fingerprints, network-security posture. Binary AXML parsed in-process; iOS plists via plistlib. Structural + string-level, not dex dataflow.technique
dependency_inventoryExtract a shipped-dependency inventory (package + version) from JavaScript source maps recovered off a page or bundle. Discovers maps the way sourcemap_secrets does (sourceMappingURL → fetch the .map), then derives which third-party packages the bundle ships from node_modules/<pkg> paths in sources, with best-effort version resolution. Feeds cve_lookup against what a target actually ships rather than what it declares.technique
dependency_confusion_checkCheck whether internal or scoped package names are unclaimed on a public registry (npm / PyPI) and therefore dependency-confusable. A 404 means the name is UNCLAIMED — anyone could publish it, so a private dependency of that name is confusable; 200 means it is already taken. Read-only against the public registry; nothing is published.technique
Authentication & Authorization
20 ops
jwt_probeAnalyze a JWT and probe attack variants (alg:none, weak secret, kid injection) against a protected endpoint.protocol
jwt_derive_pubkeyDerive the RSA public key from two RS256 JWTs via the sig2n algorithm.protocol
oauth_probeProbe OAuth 2.0 for redirect_uri bypass, missing state enforcement, and PKCE downgrade.protocol
oauth_flowExchange OAuth tokens, analyze issued tokens, optionally run JWT attacks. Refresh rotation is off by default: the test re-submits a superseded refresh token, and a server that detects reuse answers by revoking the whole family, session under test included. Skipping it reads as UNMEASURED, not as rotation holding.protocol
oauth_complete_flowDrive an interactive OAuth authorization flow. Stops at the consent screen by default and returns its action URL, the scopes it would grant, and its fields without accepting — consenting grants real scopes on a real account and burns the single-use code. auto_consent=True submits it and extracts the code or token.protocol
oauth_discover_from_pageScan page HTML and inline JS for OAuth flow initiation patterns; extract parameters.protocol
oauth_fetch_userinfoFetch the OIDC userinfo endpoint with a bearer token; return decoded profile claims.protocol
oauth_redirect_uri_probeFocused redirect_uri bypass probe; follow bypasses and confirm delivery to unregistered destinations.protocol
oidc_discoverFetch OIDC/OAuth AS discovery documents; flag dangerous configurations.protocol
saml_probeAnalyze a SAML response; probe for signature wrapping (8 canonical XSW variants per Somorovsky 2012; xsw_variants="all" sweeps every position). Acceptance is a session, not a status: ACS endpoints are browser-facing and render errors instead of returning 4xx, so the probe first posts the same assertion with a corrupted signature — a document every conforming SP must refuse — and ACCEPTED requires a cookie that control did not receive, or the subject echoed back. Anything else is INCONCLUSIVE. Which variants accept is what reveals the validator's tree-walk strategy, XXE injection, and replay.protocol
webauthn_probeWebAuthn / FIDO2 ceremony probe with phase= axis: register (CBOR + COSE decode of attestationObject; RP-ID inference via SHA-256 over origin-domain chain; origin↔RP-ID registrable-suffix validity check — loose RP-ID is the most common WebAuthn flaw) / assert (authenticatorData flag + counter parse) / introspect_rp_config (JS API + inline RP config scan) / replay (counter / challenge consumption probe).protocol
cross_session_scanDiff responses across two identity contexts for IDOR, privilege escalation, and tenant-isolation gaps, with the verdict bound to ownership of the object rather than to response equality. Object-level shape (url_template + ids) or endpoint-level shape (urls list); comparison_mode selects horizontal (same-tier IDOR) vs vertical (cross-tier privesc) verdict semantics. A subject= axis moves the same mechanic onto ordered request sequences: agent_task replays a captured agent transcript as A, then as B reusing the references A established, so a step where B reaches the same resource is the confused-deputy signal; state_machine runs one identity twice with a single step dropped, reordered, refired, or replayed stale, and diffs an invariant observation of the final state. Six named outcomes there — DIVERGED, INVARIANT_STEP_ABSENT, REJECTED, IDEMPOTENT, NO_EFFECT, UNOBSERVED — because identical final states never read as enforcement.technique
session_security_scanTest session cookie attributes, entropy, fixation, post-logout validity, concurrency, and idle timeout. Reports the sessions it mints and the ones its logout invalidates.technique
account_enum_scanDetect account enumeration by comparing response classes for a value known to exist, one known not to, and a second non-existing control_value, interleaved samples times each. The control is what makes the result mean anything: a signal that also separates two accounts that both do not exist is noise on that endpoint and is discounted. Status, semantic message, and redirect target support the claim; body length and post-normalization body differences are reported and do not. The submitted identifier is normalized out of every response before anything is hashed, so a login form re-rendering the attempted address is not a signal. The failed logins it spends against the known-valid account are counted against the engagement rather than the call, so the same scan aimed at login, then reset, then register accumulates.technique
mass_assign_scanInject 25 privileged fields (role, isAdmin, permissions, price) into PATCH/PUT/POST bodies and read the object back. Password fields have no readable prior value, so they are refused unless allow_unrestorable=True; identity and security fields (email, MFA, banned, ownership) run only when named. CONFIRMED requires read_back_url to show the field holding the injected value after the write and something else before it; a response that merely echoes name and value is REFLECTED, which an API returning the created object does too, and is capped well below the probe table's severity. Each CONFIRMED write is put back from the pre-read, and whatever could not be is named above the findings. Whether a persisted field changes what the principal can do is a further axis this primitive does not test.technique
token_validateIntrospect a captured credential against its issuer for validity + scope evidence. Severance redacts the raw secret to prefix + last4 + length; the issuer response is the evidence. On the generic bearer class a control call repeats the introspection with a deliberately corrupted credential — an endpoint that answers both the same way is not an oracle, and its acceptance is reported as that rather than as validity. Operator-gated (credential-issuer trust class).technique
auth_profile_setStore a named credential profile (bearer, basic, api_key, header, cookie) for reuse across all tools.protocol
auth_profile_listList all stored auth profiles and their types.protocol
auth_profile_clearDelete one or all stored auth profiles.protocol
iam_enumRead-only post-compromise AWS IAM privilege walk over credentials the engagement already obtained — sts:GetCallerIdentity for identity, then iam:SimulatePrincipalPolicy (evaluate-only) over the privesc action catalog. With role_arns it reads both sides of each AssumeRole decision — the caller's identity policy by simulation, the role's own trust policy via iam:GetRole — because a role is assumable only when both hold. An unreadable trust policy is INCONCLUSIVE rather than assumable, and trust conditions (ExternalId, PrincipalOrgID, MFA, source IP) are reported without being evaluated. A simulation that stopped while the service still had pages says so, because an absent decision is not a denied one. Never mutates or assumes; emits the command for edges the operator wants to take. Credential-issuer trust class, dispatcher-gated; secret key never echoed.technique
Injection
22 ops
sqli_detectDetect SQL injection in URL params and cookies; fingerprint the backend DBMS.technique
sqli_union_dumpExploit UNION-based SQLi to extract arbitrary query results via reflected output.technique
sqli_oob_probeFire a DB-specific OOB SQLi payload to confirm out-of-band connectivity.technique
sqli_stacked_executeExecute stacked DML/DDL (UPDATE, INSERT, DELETE, CREATE…) via a confirmed SQLi point — post-exploitation rather than extraction.technique
sqlmap_scanRun sqlmap against a URL to detect and exploit SQL injection.technique
ssrf_probeFire a curated SSRF payload set at one injection point. Only a fingerprint the probe introduced — present in the probe response, absent from the baseline — confirms; the same signature sitting in the baseline is a property of the endpoint and is reported without confirmation. Status and length deltas are flagged as worth a second look, not as evidence the server fetched anything. Blind cases ride a per-injection-point correlator, so a later OOB callback is attributable to this probe rather than to the listener generally.technique
ssrf_cloud_chainWalk cloud IMDS credential chains through a confirmed SSRF injection point.technique
sspp_probeProbe a JSON endpoint for server-side prototype pollution behind two controls: a clean baseline, so output that already pretty-prints is distinguishable from output that became pretty-printed, and an echo control whose value cannot reach the prototype — if it comes back, the endpoint echoes its input and the reflection gadgets prove nothing there. A returned value is reported as reflection, not as inheritance.technique
sspp_rce_exfilExploit server-side prototype pollution to execute a command and return its output.technique
ssti_detectProbe URL parameters for Server-Side Template Injection across common engine syntaxes.technique
ssti_exploitExploit a confirmed SSTI vulnerability to execute OS commands.technique
cmdi_detectProbe URL params, body fields, and headers for OS command injection via time-delay and OOB payloads across unix and Windows variants. The timing threshold is built from a baseline that answered; with no usable sample there is no threshold rather than a fabricated one.technique
cmdi_captureExecute a command via a confirmed injection point and capture output via OOB HTTP, OOB DNS, or filesystem-writeback fallback.technique
path_traversal_scanInject path traversal sequences into parameters to read /etc/passwd, win.ini, .env, and web config files.technique
path_probeTest which filesystem paths are readable over HTTP from the target's web root, measured against a soft-404 baseline so a custom error page doesn't make every guessed URL look served. Writability is not measured: the primitive writes nothing and reads nothing back, so it emits name-derived hints about where a write might land and labels them as hints, for planning file-based exploitation chains.protocol
path_resolveResolve a relative path against a base in filesystem, web-root, or application-cwd context.protocol
crlf_scanInject CRLF sequences into query params, path, and headers; detect response splitting via injected headers in the response. The injected-header arm needs no reference and always runs; the status arm is scored only against a baseline that came back.technique
injection_probeConfirm LDAP or XPath injection in a web parameter via error + boolean differential (grammar=ldap|xpath) — break the filter / expression to surface a parser error, then compare TRUE / FALSE injection pairs against baseline (same oracle shape as sqli_detect boolean mode). Detection only; distinct from the ldap_probe / ldap_search network-protocol tools.technique
hpp_probeResolve a server's duplicate-parameter precedence (HTTP Parameter Pollution) — fires single-A, single-B, and both duplicate-orderings, then diffs to classify first / last / merge (PHP-array / comma-join) / unknown. A front-end / back-end precedence split is what slips a value past a validator.technique
Client-Side Security
18 ops
reflect_scanProbe URL query parameters for server-side reflection; classify the injection context.technique
dom_sink_scanStatic pattern scan of a page and its same-origin JS bundles for client-side gadgets: DOM-XSS source/sink pairs plus prototype pollution, unsafe deserialization, client-side template injection, and framework raw-HTML bindings. Verdicts say what a lexical scan knows — SOURCE_IN_SINK_EXPRESSION (the source sits inside the sink's own operand, INFERRED), SOURCE_NEARBY (INCONCLUSIVE, and explicitly not a flow, since in minified code that distance spans unrelated functions), SINK_PRESENT, GADGET_PRESENT. It never emits an observed flow; dom_taint_trace and browser_xss_probe run one.protocol
xss_payloadGenerate a context-appropriate XSS payload for a given sink and trigger combination — feeds browser_xss_probe.protocol
browser_xss_probeInject an XSS payload via URL parameter; confirm execution via dialog interception or console.protocol
dom_events_inspectInstrument a live page to capture every addEventListener call; return registered listeners.protocol
prototype_pollution_probeDetect and confirm client-side prototype pollution; find PP-vulnerable parser gadgets.protocol
csp_analyzeAnalyze the effective policy per CSP Level 3: first occurrence of a repeated directive wins, fetch directives resolve along their real fallback chain, and an empty source list means 'none' rather than missing. Findings carry a verdict strength, and an exact host reads as a scoped grant rather than as arbitrary origins. Framing is governed by frame-ancestors and X-Frame-Options together, so pass the XFO value or framing comes back INCONCLUSIVE instead of guessed either way.protocol
cors_probeTest a URL for CORS misconfiguration across five origin variants plus the preflight channel, scored against what a browser would actually do. Origin acceptance, credential willingness, and the preflight are separate axes: a reflected origin with Allow-Credentials is a credentialed cross-origin read, while wildcard plus credentials is a configuration signal, because browsers refuse that pair outright. An approved preflight is scored on delivery, never on which headers it lists.protocol
postmessage_probeScan a page's inline and external JS for unsafe postMessage patterns, each finding bound to one call's own arguments or one handler's body rather than to text sitting nearby. Sender side: the wildcard target origin and the sensitive payload have to belong to the same call. Receiver side, where the findings usually are: a handler that reads event.data and reaches a sink with no origin comparison, or a substring one that example.com.evil.net satisfies. Static only — the handlers are not probed.protocol
open_redirect_scanCrawl a page for open redirect candidates and actively probe each one.protocol
server_action_invokeInvoke a Next.js Server Action directly over HTTP by action ID.flaw-specific
clickjack_probeCheck whether a URL is iframeable (X-Frame-Options + CSP frame-ancestors) and measure a target element for clickjacking PoC construction.protocol
form_prefill_scanDetect which form fields accept URL query-parameter prefill — for clickjacking pre-armed payloads and CSRF pre-fill gadgets.protocol
navigate_and_measureClick an element, follow the resulting navigation, and measure a target on the post-nav page — for multi-step UI-redress flows.protocol
csrf_probeDetect + bypass-probe the anti-CSRF defenses on one authenticated state-changing request — baseline replay then orthogonal mutations (token removed / empty / foreign / garbage, POST→GET, form→JSON / multipart flips, cross Origin / Referer, header strip); an accepted mutation means the defense it strips is not load-bearing. Acceptance is a claim about server state, so it needs a state oracle: pass a read-back URL or success/failure indicators, or the axis reports INCONCLUSIVE rather than guessing from body length. Server-side acceptance becomes CSRF exposure only where a browser can deliver that request with the victim's credentials attached, so the probe classifies the credential channel — cookies are ambient, bearer and custom headers are not — and reads the session cookie's SameSite. Token auto-discovered; never fused into a score.technique
client_side_probeBrowser-driven client-side probes on one technique= axis — csti (Angular / Vue {{7*7}} rendered-DOM eval), mxss (mutation-XSS polyglots confirmed by an init-script sentinel), dom_clobbering (id / name attrs that clobber a global), cspt (client-side path traversal in a fetch / XHR URL, separating a traversal that changed the request destination from one absorbed without moving it), tabnabbing (rel="opener", which restores the opener reference current browsers withhold; a bare target=_blank with no rel=noopener is reported as legacy-browser hygiene, not as a vulnerability). Playwright.technique
dom_taint_traceRuntime DOM-XSS taint trace — seeds a canary into each source channel (location.hash / search / window.name), hooks every dangerous sink (innerHTML, document.write, eval, setTimeout(str), script.src…) at document-start, and reports each observed source→sink flow with captured value + JS stack. The dynamic complement to dom_sink_scan for minified SPAs.protocol
xsleak_probeCross-origin information-leak oracles (XS-Leaks / XS-Search) against a victim origin from an attacker page, the victim's session bridged in via session_id — frame_count (window.length subframe oracle), load_events (onload / onerror across element types), timing (credentialed no-cors fetch distribution). Calibrate with true_url / false_url.technique
GraphQL
6 ops
graphql_detectProbe common GraphQL endpoint paths on a target.protocol
graphql_introspectExtract the full GraphQL schema via introspection.protocol
graphql_queryExecute a GraphQL query or mutation with optional auth headers.protocol
graphql_batch_probeProbe for array batching and alias stacking, reported as capabilities rather than as rate-limit findings — whether batching defeats a limiter depends on where the limiter counts, and deployments commonly count per operation precisely because batching exists. Uncalibrated, the rate-limit verdict is LIMITER_UNTESTED. calibrate_rate_limit settles it: fire the protected operation sequentially until the limiter answers, then send that same count in one batched request and compare. That step deliberately trips the limiter and is visible in the target's logs and metrics.protocol
graphql_alias_attackStamp a field template with N values into one aliased operation; send in one request; scan each alias's JSON slice for a success regex. Collapses a 100-alias brute-force pattern into a single call.technique
graphql_field_fuzzEnumerate GraphQL fields via server-side suggestion errors, for targets with introspection disabled. max_wall_s bounds the whole run and is distinct from timeout, which bounds one request: 100 requests against a blackholing endpoint is not 100 timeouts, it is the entire idle window spent for nothing. The run also stops once the target has failed to return error text several probes in a row. Whatever was harvested when either bound is reached comes back as a partial.technique
XXE
3 ops
xxe_detectProbe an XML endpoint for XXE, or map what its edge lets through. goal=detect (default) tries reflected file entities, OOB regular and parameter entities, XInclude, and content-type switches, then reports which produced evidence that an external entity resolved. Delivery is judged from the response that came back, not from the request that went out. goal=ladder asks the other question: which payload shapes reach the origin, and where the edge stops the rest. Send it when detect returns blocked or inconclusive, since a negative from an endpoint nothing reached is not a negative.technique
xxe_file_readExploit a confirmed XXE to read a file from the target server.technique
xxe_upload_probeGenerate a malicious file and upload it to probe for XXE in file parsers (docx, xlsx, svg).technique
Deserialization
2 ops
deserialize_detectProbe an endpoint for Java, PHP, Python pickle, and .NET deserialization (BinaryFormatter, DataContractSerializer, ASP.NET ViewState via LosFormatter). Every payload is measured against a control of the same content type, the same exact size and the same envelope (raw body, form field, or header) that is deliberately not a serialized object, because malformed bytes draw a status change and a stack trace on their own. DESERIALIZER_REACHED needs the response to name a deserialization API the control did not produce; when the control names the same one, that is DISPATCH_DESERIALIZES — the endpoint deserializes bodies of that content type before validating them, which is reachability, not silence. A control that never answers is INCONCLUSIVE, never a negative. Per-language keyword flags stay separate axes, signal count is not evidence quality, and RCE is never claimed inline.technique
deserialize_payloadGenerate a deserialization exploit payload ready for injection.technique
Cryptographic Attacks
4 ops
padding_oracle_detectProbe a ciphertext parameter for a CBC padding oracle. Detection counts distinct response classes, so failed probes are named rather than fingerprinted — one dropped connection among 32 is not a class of its own.technique
padding_oracle_decryptExploit a confirmed CBC padding oracle to decrypt ciphertext byte-by-byte.technique
ecb_detectDetect AES/DES in ECB mode by submitting repeated-block plaintext and inspecting output.technique
hash_length_extendCompute forged MACs and padded messages for hash length extension attacks.technique
Cache Attacks
5 ops
cache_poison_probeProbe for unkeyed inputs — headers (~25 candidates) or query/fat-GET params — that change the cached response without entering the cache key. Optional OOB polling for blind server-side fetches. A no_signal result requires a baseline that came back — without one the run says that, not that the target has no unkeyed inputs.technique
cache_poison_detectProbe for unkeyed headers and URL-normalization quirks that affect the cached response without entering the cache key.technique
cache_poison_exploitDeliver a poisoned response to the cache and confirm victim requests receive it; supports header, raw-path, and fat-GET body variants. Confirmation needs a clean follow-up request whose response carries cache provenance (Age, X-Cache: HIT), plus a check that the value was not already present before the poison — so a reflected value, or an endpoint nothing caches, does not read as a poisoned cache.technique
cache_poison_param_fuzzEnumerate unkeyed query parameters — fat-GET params that affect response content.technique
cache_deception_probeProbe for web cache deception: origin path-terminator chars + cache-normalization rules that cause private user responses to be stored under attacker-supplied URLs. The retrieval that decides it carries no session and none of the operator's headers, so CONFIRMED means an anonymous requester pulled the private response back out of the cache. Private content served to anonymous callers, and a cached-but-not-private response, are reported as their own outcomes instead of counting as the finding.technique
Request Smuggling & Protocol Attacks
7 ops
request_smuggleExploit HTTP request smuggling via raw TCP sockets, bypassing HTTP library normalisation. Supports CL.TE, TE.CL, H2.CL, H2.TE, and h2_crlf variants.technique
h2_sendSingle-shot HTTP/2 primitive with full pseudo-header override (:method / :path / :scheme / :authority) for H2 :path-CRLF cache-poison and tunnel attacks. Supports {PAD:N} template expansion so 8 KB+ padding strings are materialized in-runner, not sent over MCP.protocol
smuggle_loopUnified multi-shot smuggle dispatcher across H1.1 / H2, keyed on goal + http_version: capture (CL.TE / H2.CRLF / H2.TE victim-request capture with auto-tuned CL sweep and CSRF refresh), cache_poison, cache_deception, queue_poison (H2 response-queue displacement with stream-1/3/h1 harvest), tunnel_poison (H2 :path-CRLF cache poison through FE proxy timeout).technique
raw_sendSend arbitrary raw bytes over TCP/TLS; return raw responses. Pipeline mode (paired-smuggle + follow-up) with unpaired-smuggle guard.protocol
websocket_openOpen a persistent WebSocket session; return a session_id for subsequent frames.protocol
websocket_sendSend WebSocket frames one-shot or via an open session.protocol
websocket_closeClose and discard a WebSocket session.protocol
Race Conditions
1 op
race_sendFire N HTTP requests with sub-millisecond synchronization. HTTP/2 single-packet and HTTP/1 last-byte-sync; trigger-then-flood for partial-construction races; per-stream distinct session cookies for PHP / Rails session-lock bypass; response-timing concurrency detection; stateful hint engine that walks back its own prior suggestions.technique
gRPC
3 ops
grpc_reflectEnumerate gRPC services and methods via the Server Reflection API.protocol
grpc_invokeCall a gRPC method with a manually constructed protobuf message.protocol
grpc_fuzzFuzz a gRPC method by injecting payloads into a string field.technique
Mail Protocols
5 ops
smtp_probeProbe an SMTP server: banner, EHLO capabilities, AUTH mechanisms, STARTTLS with a re-enumeration on the encrypted channel, VRFY, and relay. The relay test stops before DATA by default, so the strongest result available is ENVELOPE_ACCEPTED, which is not an open-relay finding: a 250 to RCPT TO is acceptance at that point, and relay policy is commonly enforced after DATA, at queue time, or by post-acceptance rejection. Pass a relay_sink on infrastructure you own plus confirm_delivery to complete the transaction — that sends mail through the target, and it is the only path to QUEUED_FOR_DELIVERY.protocol
mail_protocol_probeCapability + SASL AUTH-mechanism + STARTTLS enumeration across SMTP / POP3 / IMAP via a unified protocol= axis. Implicit-TLS supported (SMTPS:465 / POP3S:995 / IMAPS:993). Post-STARTTLS capability re-enum surfaces pre-vs-post-TLS capability/auth differences. Anonymous-login probe on pop3 / imap. POP3 APOP-timestamp + IMAP LOGINDISABLED axes preserved separately.protocol
password_reset_poisonTest password reset poisoning via Host header injection. Ten submissions, one per host-override variant plus a baseline, each a real reset that may send mail and mint a token; reset_accounts spreads them over separate inboxes instead of ten on one. The counts and the accounts they land on are declared before the call and reported after.technique
email_posture_scanDNS-only audit of SPF, DMARC, DKIM (9 common selectors), MTA-STS, DNSSEC, and BIMI for a domain.protocol
Headless Browser
8 ops
browser_openRender a URL in headless Chromium; return status, title, visible text, HTML, and console errors.protocol
browser_evalEvaluate JavaScript in the context of a loaded page.protocol
browser_form_submitFill and submit a form with CSRF token preservation; return the resulting page.protocol
browser_screenshotRender a URL and save a PNG screenshot for visual inspection.protocol
browser_click_atDispatch a real coordinate-based mouse click at (x, y) on a loaded page.protocol
measure_elementReturn getBoundingClientRect() for a CSS selector on a rendered page.protocol
session_cookie_setInject cookies into a named session jar for subsequent browser_* and http_* calls.protocol
image_ocrDownload an image and extract text via Tesseract OCR.protocol
Fuzzing & Brute Force
6 ops
http_fuzzWordlist fuzzing with a response oracle — passwords, usernames, paths, or any string space.technique
macro_fuzzMulti-step macro-driven brute-forcer — chains requests with CSRF token extraction between steps and applies a wordlist to a chosen step input.technique
timing_enumTiming side-channel enumeration; detect valid accounts via response-time outliers. Source-IP rotation is off by default: a rate limit that stops the enumeration is the target working, and switching it off is the operator's call rather than a default.technique
otp_bruteforceConcurrent brute-force over a numeric or alphanumeric OTP/2FA code space.technique
cookie_forgeBrute-force a predictable weak cookie by constructing candidates from a wordlist and testing.protocol
cookie_analyzeDecode a cookie value; identify weak encoding/hashing patterns; suggest forge format.protocol
Cloud Security
5 ops
cloud_storage_scanProbe S3, GCS, and Azure Blob Storage for public listing and unauthenticated write access; derive bucket name candidates from a domain. The write probe deletes what it wrote and reads it back to settle whether it went — permitting PUT and denying DELETE is a common pairing — and objects still there are named in the summary.technique
baas_probeExtract Firebase / Supabase / Pocketbase config from a page and probe the detected backends without credentials. Provider detection via opportunistic page-source scan. Reading a Supabase table with the anon key is not reported as a misconfiguration — that key ships in client bundles by design — so the read emits role, operation, collection, row count, and column names, and leaves classification to the operator. Severity attaches to anon write, and to a read whose column names name personal data. test_anon_write attempts one insert per table and is off by default: an accepted row is removed immediately and the emit reports whether removal succeeded. Firebase Realtime Database is unchanged — an unauthenticated read or write there is the rules failing open, with no public-key ambiguity.flaw-specific
imds_probeIMDS-direct probe (AWS / GCP / Azure) — first-class metadata-service primitive callable without an SSRF chain wrapping. Four goals: enum (walk metadata categories), creds (extract attached-role / managed-identity credentials with severance: raw values in audit-ingest, shape-only in operator output), role_chain (AWS sts:GetCallerIdentity command emitted for operator out-of-band run), hop_limit_probe (IMDSv2 enforcement posture: v1_allowed_v2_available / v2_enforced / imds_unreachable / mixed). IMDSv2 PUT-token dance handled internally.technique
hashicorp_probeUnauthenticated status probe for HashiCorp Vault and Consul (service=auto resolves from port: 8500 → consul, else vault). Vault: /v1/sys/health for initialized / sealed / standby / version, plus reachable-and-unsealed posture. Reports evidence only — version, seal and ACL status, what was readable without credentials — never a fused vulnerable y/n verdict, and never reads secret material beyond status endpoints.protocol
docker_api_probeProbe a Docker Engine remote API for unauthenticated reachability and inventory. Queries /version (engine + API version, OS/arch), /info (container and image counts, name), and /containers/json (running list), tolerating per-endpoint failure. Read-only: enumeration of an exposed engine socket, not container creation.protocol
SOAP / WS-Security
1 op
soap_probeSingle primitive parameterized by mode= axis across four SOAP-envelope surfaces: wsdl_discover (probe ~10 common WSDL discovery paths) / operation_enum (parse WSDL → operations + SOAPAction + xsd:import SSRF surface) / action_fuzz (POST per operation × SOAPAction variant; classify by status + SOAP Fault) / ws_security_probe (classify <wsse:Security> token class: UsernameToken / BinarySecurityToken / SAML token / X.509 / Kerberos). SOAP 1.1 + 1.2 envelopes. XSW signature-wrapping shared with saml_probe through a unified helper.protocol
Kubernetes
1 op
k8s_probeExternal-attacker view of a K8s cluster — single primitive with surface= axis across four components: apiserver (13 endpoints including /api/v1/namespaces → anonymous NamespaceList disclosure; per-endpoint auth_class anonymous_allowed / requires_auth / forbidden / endpoint_absent), etcd (v2 KV + v3 grpc-gateway range + metrics + version), kubelet (anonymous /pods → per-pod secret-via-env-ref leak detection), admission (validating + mutating webhookconfiguration parse → per-webhook failurePolicy / sideEffects / timeoutSeconds — failurePolicy=Ignore is the bypass class).technique
AI Infrastructure
1 op
ai_infra_probeEngagement-bound AI-infrastructure recon — single primitive with surface= axis across six AI stacks: detect (vendor fingerprint) / mcp (JSON-RPC initialize → tools/list + prompts/list + resources/list with per-tool danger-class axis: exec / file_read / file_write / http_fetch / db_query / send_email — orthogonal, never fused into a score) / ollama (/api/tags model enum + uncensored-model heuristics) / openai_compat (/v1/models + auth-mode classify + one-shot system-prompt extraction probe + CORS check) / langserve (route × playground + schema endpoint enum) / webui (Gradio / Streamlit / Open-WebUI / LibreChat / ComfyUI / TGI fingerprint).technique
Network Protocols
13 ops
snmp_walkWalk an OID subtree on a target host across SNMP v1 / v2c / v3. v1+v2c uses community auth; v3 uses USM credential dict (HMAC-MD5 / SHA / SHA224 / SHA256 / SHA384 / SHA512 with optional DES or AES privacy). A truncated walk reports what it covered and no remaining total, since the OID space below the cut is unbounded.protocol
snmp_credential_enumDiscover valid SNMP credentials across versions. v1+v2c sweeps community strings via sysDescr.0 GetRequest; v3 enumerates USM usernames via Report-PDU classification (no crypto required).protocol
snmp_set_probeDetect writable communities (rwcommunity) via state-preserving GET-then-SET-back-to-itself. High-severity finding.protocol
snmp_lootWalk curated high-value OIDs in one call: running processes (incl. cmdline cred leaks), installed software, ARP cache, IP/route tables, TCP listeners, Windows users, SMB shares.protocol
snmp_sweepSingle-socket UDP fan-out across a CIDR; report every host that responds to a sysDescr.0 GetRequest. Up to 4094 hosts.protocol
snmp_cisco_config_copyTrigger a Cisco device to copy its running- or startup-config to an attacker server (TFTP/HTTP/SCP/SFTP) via CISCO-CONFIG-COPY-MIB SETs. The ccCopyEntry row is destroyed afterwards and only a noError reply counts as destroyed; a surviving row is a live config-copy operation on the device, reported with its index.flaw-specific
ssh_probeSSH-2.0 banner + KEXINIT exchange; report identification line, kex/host-key/cipher/MAC algorithms, and flag deprecated entries (ssh-rsa SHA-1, CBC ciphers, hmac-md5).protocol
ipmi_probeThree-stage BMC probe over UDP/623: v1.5 Get Channel Auth (version + auth modes), v2 cipher-suite-0 acceptance (Farmer 2013), and RAKP Message 1+2 username enumeration via differential status codes.protocol
ldap_probeLDAPv3 anonymous-bind probe + rootDSE enumeration. Extracts naming contexts and Active Directory specifics (defaultNamingContext, ldapServiceName, dnsHostName, domainFunctionality). LDAP and LDAPS.protocol
ftp_probeFTP control-channel probe (RFC 959): read the 220 banner, attempt anonymous login (USER anonymous / PASS), capture server type and advertised features via FEAT. A 230 is an accepted authentication, not a readable filesystem: LIST and RETR are untested and no data channel is opened. check_writable is the one completed operation here — it creates a short random directory, so a 257 is an effect observed directly rather than inferred from a login. Removal is held to the same bar: only a 250 to RMD counts, and a directory left behind is named with its identifier.protocol
nfs_probeEnumerate NFS exports over ONC RPC, the showmount -e equivalent, in two TCP stages: portmapper (program 100000 v2, PMAPPROC_DUMP on port 111) returns every registered (program, version, protocol, port) mapping and discovers the mountd port; mountd then yields the export list with its allowed-host entries.protocol
kafka_probeEnumerate an Apache Kafka broker over its native binary protocol without authentication. ApiVersions (api_key 18) confirms the endpoint speaks Kafka; Metadata (api_key 3, all-topics) enumerates brokers with host:port and node id, the controller id, and the topic namespace. Single plaintext TCP connection.protocol
mqtt_probeProbe an MQTT broker (3.1.1 / protocol level 4) for anonymous access, then sample the topic namespace. An unauthenticated CONNECT returning CONNACK 0x00 means anonymous connect is accepted; with sample_seconds > 0 it subscribes to the # wildcard and listens, surfacing what an unauthenticated client can read off an IoT or telemetry bus.protocol
Active Directory
11 ops
ldap_searchAuthenticated LDAP search with canned queries (spn_users, asrep_users, domain_admins, unconstrained_delegation, machine_quota, gpos, trusts) or raw LDAPv3 filters. Decodes userAccountControl flags and surfaces kerberoast / asreproast pivot candidates inline.protocol
kerberos_asreproastRequest AS-REPs for users with the DONT_REQUIRE_PREAUTH UAC bit; output hashcat-mode-18200-ready hashes. Auto-discovers candidates via LDAP when domain creds are provided.technique
kerberos_kerberoastAcquire a TGT (password / NT-hash / AES-key) and request TGS-REPs for every SPN; output hashcat 13100 (RC4) and 19700 (AES256) hashes. Auto-discovers SPNs via LDAP.technique
smb_enumMulti-aspect SMB enumeration: shares + read-test, RID cycling via SAMR, domain password policy + lockout, signing posture (relay candidate flag), dialect + OS fingerprint. Null / guest / authenticated.protocol
adcs_auditAD CS comprehensive audit — sweeps for ESC1 / ESC2 / ESC3 / ESC4 / ESC5 / ESC7 / ESC8 misconfigurations in one pass; ESC6 (CA EditFlags EDITF_ATTRIBUTESUBJECTALTNAME2 via remote registry) opt-in with check_esc6=True. Each finding is annotated with the certipy command line that exploits it.technique
zerologon_checkCVE-2020-1472 non-destructive probe via NetrServerAuthenticate3 with all-zero challenge over MS-NRPC. Detects unpatched DCs (1/256 chance per attempt) without calling NetrServerPasswordSet2 — no domain trust damage.flaw-specific
petitpotam_coerceMS-EFSR EfsRpcOpenFileRaw coerce: trigger a Windows DC / file server to authenticate outbound to a disquiet_oob hostname. Tries lsarpc / efsrpc / samr / netlogon / lsass pipes; pairs with oob_callback + oob_poll for verification. Relay-prep primitive.flaw-specific
ad_acl_auditActive Directory ACL discovery: pull nTSecurityDescriptor for users / groups / computers / domain-root, parse DACLs, surface dangerous ACEs (GenericAll, WriteDACL, WriteOwner, DCSync = GetChanges + GetChangesAll combo, ForceChangePassword, AddSelf-on-group, RBCD, shadow-credentials, targeted-kerberoast). Resolves trustee SIDs to sAMAccountNames and emits attack one-liners.technique
winrm_probeWinRM auth-method fingerprint on TCP/5985 (HTTP) and TCP/5986 (HTTPS). Reports advertised auth (Negotiate / Kerberos / CredSSP / Basic / Digest), WSMAN protocol version, and optionally validates a credential via Basic auth (high-severity finding when accepted on plain HTTP).protocol
msrpc_epmapMSRPC endpoint-mapper dump on TCP/135. Enumerates registered RPC interfaces; labels well-known UUIDs (samr, drsuapi, efsr, spoolss, netlogon, srvsvc, atsvc, etc.) so the model can pivot directly into pipe-specific attacks (PetitPotam, PrintNightmare, ZeroLogon, secretsdump).protocol
dcsync_dumpDCSync via DRSUAPI MS-DRSR replication: dump NTDS credential hashes for every account (or a single user, e.g. krbtgt for golden-ticket seeding). Auth via password / NT-hash / AES key. Output is hashcat-mode-1000 ready (NTLM) plus Kerberos-key + cleartext-password lines when present. Requires DS-Replication-Get-Changes + GetChangesAll rights.technique
Database Probes
6 ops
redis_probeRESP PING / AUTH / INFO; classify open vs auth-required, walk a default-password wordlist on auth-required servers, scrape redis_version + role + mode.protocol
mongo_probeMongoDB OP_MSG hello + buildInfo + listDatabases. Flags open MongoDB instances (the 2017 ransom-target shape) and reports version + replica-set + writable-primary state.protocol
postgres_probeStartupMessage + AuthenticationRequest classifier; full MD5 password spray (user × password matrix) on MD5-auth servers, classify SCRAM-SHA-256 / Trust / Cleartext / Kerberos.protocol
mysql_probeHandshakeV10 parse (version, default plugin, capability flags). Spray for both mysql_native_password and caching_sha2_password including full RSA-OAEP pubkey exchange against modern MySQL.protocol
mssql_probeTDS PreLogin (type 0x12) version + encryption posture (off / required / not-supported). Optional SQL Browser UDP/1434 instance discovery alongside.protocol
elastic_probeElasticsearch / OpenSearch HTTP probe. Anonymous root + cluster info, default-cred spray on 401 (elastic / kibana / admin × common passwords), index list when accessible.protocol
Utilities
9 ops
parallel_httpFire N HTTP requests in parallel; return a status-code histogram and flag outliers.protocol
response_diffClassify a list of responses into baseline and outliers.protocol
form_submitDiscover and submit an HTML form, automatically extracting hidden fields.protocol
poll_untilPoll a URL repeatedly until its response matches a regex pattern.protocol
sleepSleep for a specified number of seconds within the MCP tool flow.protocol
hash_computeCompute cryptographic hash digests for a given input string.protocol
decode_bytesDecode encoded bytes (base64, hex, url, jwt) back to a readable string.protocol
encode_bytesEncode bytes (base64, base64url, hex, url, etc.) for use in payloads and OOB exfiltration.protocol