caldera - Automated Adversary Emulation Platform

项目说明

![Release]()
![Testing Status]()
![Security Status]()
![codecov]()
![Documentation Status]()

Caldera™

Caldera™ is a cyber security platform designed to easily automate ad emulation, assist manual red-teams, and automate incident response.

It is built on the MITRE ATT&CK™ framework and is an acti project at MITRE.

The framework consists of two components:

1) The core system. This is the framework code, consisting of what is a in this repository. Included is
an asynchronous command-and-control (C2) server with a REST API and a web interface.
2) Plugins. These repositories expand the core framework capabilities and pro additional functionality. Examples include agents, reporting, collections of TTPs and more.

Resources & Socials

* 📜 Documentation, training, and use-cases
* 🎬 Tutorial
* ✍️ Caldera's blog
* 🌐 Homepage

Plugins

:star: Create your own plugin! Plugin generator: Skeleton :star:

Default

These plugins are supported and maintained by the Caldera team.

Access (red team initial access tools and techniques)

Atomic (Atomic Red Team project TTPs)

Builder (dynamically compile payloads)

Caldera for OT (ICS/OT capabilities for Caldera)

Compass (ATT&CK )

Debrief (operations insights)

Emu (CTID emulation plans)

Fieldmanual (documentation)

GameBoard ( joint red and blue operations)

Human (create simulated noise on an endpoint)

Magma (VueJS UI for Caldera v5)

Manx (shell functionality and reverse shell payloads)

Response (incident response)

Sandcat (default agent)

SSL (enable https for caldera)

Stockpile (technique and profile storehouse)

Training (certification and training course)

More

These plugins are ready to use but are not included by default and are not maintained by the Caldera team.

Arsenal (MITRE ATLAS techniques and profiles)

BountyHunter (The Bounty Hunter)

CalTack (embedded ATT&CK website)

SAML (SAML authentication)

Requirements

These requirements are for the computer running the core framework:

* Any Linux or MacOS
* Python 3.10+ (with Pip3)
* Recommended hardware to run on is 8GB+ RAM and 2+ CPUs
* Recommended: GoLang 1.24+ to dynamically compile GoLang-based agents.
* NodeJS (v16+ recommended for v5 VueJS UI)

Installation

Note: we HIGHLY recommend installing Caldera in a Python en to avoid issues with pip packages. You can use an existing en if you wish or create a new one from scratch:

Concise installation steps:

Full steps:
Start by cloning this repository recursively, passing the desired /release in x.x.x format. This will pull in all a plugins.

Next, install the PIP requirements:

Finally, start the server.

The --build flag automatically installs any VueJS UI dependencies, bundles the UI into a dist directory and is served by the Caldera server. You will only have to use the --build flag again if you add any plugins or make any changes to the UI. Once started, log into using the default credentials red/admin. Then go into Plugins -> Training and complete the capture-the-flag style training course to learn how to use Caldera.

If you prefer to not use the new VueJS UI, revert to Caldera v4.2.0. Correspondingly, do not use the --build flag for earlier as not required.

Additionally, please note security recommendations for deploying Caldera.

Docker Installation

Local build:

Adjust the port forwarding (-p) and build args (--build-arg) as desired to make ports accessible or change the Caldera . The ports that you expose depend on which contacts you plan on using (see Dockerfile and docker-compose.yml for reference).

Pre-Built Image (from GitHub Container Registry):

This container may be slightly outdated, we recommend building the container yourself.

To gracefully terminate your docker container, do the following:

There are two a, *full* and *slim*. The *slim* doesn't include files necessary for the emu and atomic plugins, which will be downloaded on-demand if the plugins are e. The *full* is suitable for operation in en without an internet connection. Slim images on GHCR are prefixed with "slim".

Docker Container Notes

The Caldera container will automatically generate keys/usernames/password on first start.

If you wish to o the default configuration or avoid automatically generated keys/passwords, consider bind-mounting your own configuration file with the -v <your_path>/conf.yml:/usr/src/app/conf/local.yml flag.

Data stored by Caldera is ephemeral by default. If you wish to make it persistent, use docker and/or bind mounts (-v <path_to_your_data_or_>:/usr/src/app/data/). Ensure that the directory structure is the same as in the data/ directory on GitHub, as Caldera will refuse to create these sub-directories if they are missing. Lastly, make sure that the configuration file is also made persistent to prevent issues with encryption keys.

The builder plugin will not work within Docker.

If you wish to modify data used by the atomic plugin, clone the Atomic Red Team repository outside the container, apply your modifications and bind-mount it (-v) to /usr/src/app/plugins/atomic/data/atomic-red-team within the container.

If you wish to modify data used by emu, clone the ady repository locally and bind-mount it (-v) to /usr/src/app/plugins/emu/data/ad.

Additionally, please note security recommendations for deploying Caldera.

User Interface De

If you'll be de the UI, there are a few more additional installation steps.

Requirements
* NodeJS (v16+ recommended)

Setup

1. Add the Magma submodule if you haven't already: git submodule add
1. Install NodeJS dependencies: cd plugins/magma && npm install && cd ..
1. Start the Caldera server with an additional flag: python3 server.py --uide

Your Caldera server is a at as usual, but there will now be a hot-reloading de server for the VueJS front-end a at Both logs from the server and the front-end will display in the terminal you launched the server from.

Security

The Caldera team highly reccommends standing up the Caldera server on a secure en/network, and not exposing it to the internet. The Caldera server does not have a hardened and thoroughly pentested web application interface, but only basic authentication and security features. Both MITRE and MITRE's US Go sponsors nearly exclusively only use Caldera on secure en and do not rely on Caldera's own security protocols for proper cyber security.

Disclosures

Refer to our Disclosure Documentation for submitting bugs.

#### Recent Disclosures

🚨Security Notice🚨: (17 Feb 2025 10:00 EST) Please pull v5.1.0+ for a recent security patch for C. Please update your Caldera instance, especially if you host Caldera on a publicly accessible network. walkthrough.

Contributing

Refer to our contributor documentation.

Caldera Benefactor Program

If you are interested in partnering to support, sustain, and evol Caldera™'s open source capabilities, please contact us at .

项目信息

开发语言：Python

Star 数：7307

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automated Adversary Emulation Platform展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。