phantom-ethical-redteam - An autonomous agent that acts as a DEF CON-level C

项目说明

Phantom - Ethical RedTeam

> ARCHIVED — 2026-04-03
> This project has been discontinued. It successfully demonstrated that AI can automate complex offensi tasks autonomously. The approach has since been superseded by AI agents with dedicated skills, which achie results with less custom infrastructure. The code is preserved here as a proof-of-concept.

---

> An autonomous AI red team agent that thinks, adapts, and hacks like a real attacker.

!Phantom in action

Phantom is an open-source autonomous offensi agent. Point it at an authorized target, and it reasons through the entire attack chain on its own — no predefined phases, no hand-holding, no fixed script. It forms its own attack hypotheses, pursues multiple simultaneously, writes custom tools when it needs them, and delivers a full debrief when it's done.

This project exists to prove one thing: AI can do offensi autonomously.

> Legal notice: Use only on systems you own or ha authorization to test. Nothing in this repository grants permission to target third-party systems.

---

Why Phantom?

Most security tools run a checklist. Phantom doesn't. It:

Reasons like an attacker — forms concurrent hypotheses, pursues the highest-impact ones first, abandons dead ends and spawns new

Chains findings — combines into real exploitation paths (SSRF + internal metadata = cloud credentials = RCE)

Writes its own tools — when built-in tools aren't enough, it generates and executes custom Python scripts on the fly

Ne on its own — missions run until all attack are exhausted, not until a timer goes off

Debriefs with precision — timeline, attack graph, full chain reconstruction, nothing left out

---

Quick Start

One-liner install

Linux / macOS:

Windows (PowerShell):

Manual install

Run a mission (v3 autonomous engine)

Resume a mission

---

Supported LLM Pro

Phantom works with any of these out of the box. Local models are fully supported — no cloud required.

| Provider | Default Model | API Key Env Var |
|---|---|---|
| Anthropic (Claude) | claude-sonnet-4-6 | ANTHROPIC_API_KEY |
| OpenAI (ChatGPT) | gpt-5.4 | OPENAI_API_KEY |
| xAI (Grok) | grok-4-20-beta | XAI_API_KEY |
| Google (Gemini) | gemini-3.0-pro | GEMINI_API_KEY |
| Mistral | mistral-large-latest | MISTRAL_API_KEY |
| DeepSeek | deepseek-chat-v3.2 | DEEPSEEK_API_KEY |
| Ollama (local) | deepseek-v3.2:cloud | *(none)* |

---

What's in the Toolbox

Reconnaissance

Subdomain discovery — passi via crt.sh + HackerTarget

Port scanning — Nmap with quick, service, full, and vuln scan modes

Tech fingerprinting — WhatWeb with Python fallback

Auto recon — single call that runs nmap + whatweb + sensitive file probing and generates attack hypotheses from results

Scanning & Fuzzing

C — Nuclei for known and misconfigurations

WordPress scanner — , users, plugins, xmlrpc, debug.log, config backups

Directory fuzzing — ffuf for hidden endpoints

SQL injection — sqlmap detection and exploitation

Payload library — PayloadsAllTheThings integration (13 attack categories)

Dynamic tool forge — LLM writes and executes targeted Python scripts for anything not covered

Exploitation & Network

Auto exploit — takes a confirmed finding and immediately generates + runs a targeted exploit script

Credential brute force — Hydra for HTTP, SSH, FTP, MySQL, RDP

Metasploit — module search, exploit execution, auxiliary scanning

JWT attacks — HS256 brute force, alg=none, claim tampering, token forging

GraphQL enumeration — introspection, schema dump, sensiti discovery

Pri escalation — Linux/Windows enumeration (SUID, sudo, Docker, SeImpersonate)

Network MITM — ARP probing (Linux only)

E & Stealth

Screenshots — Playwright / wkhtmltoimage / Chromium capture

Auth management — bearer, basic, cookie, custom headers per target

Stealth profiles — 4 modes (silent / stealthy / normal / aggressive) with UA rotation and proxy support

Reporting

Report generation — Markdown + HTML + optional PDF

Mission diff — compare sessions to track remediation (new / resolved / persistent)

Risk scoring — aggregate CVSS from findings

Scope check — hard boundary enforced before every network action

Log reader — parse Nuclei JSONL, ffuf JSON, and other tool outputs

---

How It Works

Phantom v3 runs a Plan-Act-Obser loop driven by a hypothesis priority queue — not a turn counter.

Every confirmed finding automatically generates follow-up hypotheses:

Injection finding → blind SQLi + time-based + SSTI

Exposed config file → credential read + backup file search

Auth weakness → pri escalation + password reuse

Open DB port → default credentials + external access test

Admin panel → default creds + auth bypass + privesc

The mission ends when the queue is exhausted — not when a timer runs out.

---

What a mission looks like

---

Configuration

Scope file (`scopes/current_scope.md`)

---

Project Structure

---

Mission Diff (Remediation Tracking)

Compare two sessions to see what got fixed and what's still open:

---

Changelog

v3.2.0

Parallel execution enforced — LLM is required to call a minimum of 3 tools per response; if it returns only 1, the orchestrator auto-nudges with the top pending hypotheses and forces a parallel batch

Turn-based UX eliminated — "Turn X" messages moved to debug log; operator sees tool execution ([*] Executing 4 tools in parallel: ...) and findings ([!] [CRITICAL] ...) only

Burst launch mode — mission start seeds 12 tiered hypotheses per target (injection, exposure, auth, C, fuzzing, recon) via HypothesisEngine.burst_launch()

fetch_exploit tool — searches ExploitDB (searchsploit) and GitHub PoC repos for CVEs and known ; downloads and executes exploit scripts against authorized targets

Bug fixes — fixed dead-code _check_mission_complete hypothesis path; fixed stale finding injection on text-only turns; updated 7 stale tests to match current output format

253 unit tests (up from 246)

v3.1.0

Hypothesis-dri — missions are driven by a priority queue of attack hypotheses, not a turn counter. The mission ends when all attack are exhausted.

Auto follow-up generation — every confirmed finding automatically spawns targeted follow-up hypotheses (injection → blind SQLi + SSTI; auth weakness → privesc; exposed port → targeted service attack)

Fixed reflection pipeline — the reflect phase was a stub that did nothing; now parses <reflection> blocks and dri pi

Strategist feedback loop — strategic analysis results are now injected back into the LLM con as guidance messages

Real tool output parsing — finding extraction now handles actual nmap/nuclei/whatweb/ffuf output formats (not just [CRITICAL] tags that tools never emit)

Aggressi prompt — rewritten from 53 lines of passi to 137 lines of attacker-mindset reasoning, co SSTI, SSRF, prototype pollution, JWT forgery, deserialization, 0-day fuzzing, and chain-thinking examples

Multi- mission seeding — initial message now seeds 6 concurrent hypotheses per target across all attack surface categories

Max turns raised — default 80 → 100 (mission usually ends earlier exhaustion)

v3.0.x

v3 PAOR orchestrator replacing v2 linear loop

Dynamic Tool Forge (LLM generates and executes custom Python scripts)

MissionMemory with SQLite persistence

AttackGraph with Mermaid

ReflectionLayer with stall detection and pi

XML plan block parsing for structured LLM output

246 unit tests

---

Legal

This tool is for authorized penetration testing only. Running it against systems you do not ha permission to test is illegal. The authors are not responsible for misuse.

---

*Built by KMDN — Switzerland*

项目信息

开发语言：Python

Star 数：56

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An autonomous agent that acts as a DEF CON-level Certified Ethical Hacker, using tools such as Nuclei, sqlmap, ffuf, Burp, ZAP, and the Social Engineering Toolkit (SET), (labs, CTFs, HackTheBox, TryHackMe, and bug bounties with a written scope).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	phantom-ethical-redteam - An autonomous agent that acts as a DEF CON-level C
所属分类	CTF思路
发布作者	admin
发布时间	2026-10-06 00:05:26
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	426
讨论数量	0
主题状态	正常讨论中

phantom-ethical-redteam - An autonomous agent that acts as a DEF CON-level C

项目说明