thehardwarestore.ai

Decepticon is an autonomous AI-powered red team agent platform for offensive security engagements. It orchestrates multiple LLM-based agents (recon, exploit, AD, cloud, etc.) via LangGraph to execute complex, realistic attack chains against targets, with strict Rules of Engagement (RoE) enforcement, sandboxed execution, and human-in-the-loop approval. The system provides a web dashboard (Next.js), CLI (Ink), and MCP server for control and monitoring, and includes a plugin system for extensibility. It also features comprehensive benchmark frameworks for evaluating agent performance on security challenges. The architecture is a multi-service Docker Compose deployment with Python backend services, a Go launcher, Neo4j knowledge graph, and high isolation between management and sandbox networks. This is primarily a software application (automated red team orchestrator) with strong data/research elements such as knowledge graph persistence, benchmarking pipelines, and telemetry collection. The codebase demonstrates high craftsmanship with protocol-based plugin contracts, a well-structured middleware stack, and thorough testing, though the polyglot nature and dual client maintenance add complexity.

KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.

CyberStrikeAI is a full-stack, AI-native cybersecurity operations platform designed for autonomous penetration testing and red teaming. It orchestrates multiple AI agents using the CloudWeGo Eino ADK framework to plan and execute complex security assessments. The platform manages its own C2 (Command & Control) infrastructure with encrypted beacons and listeners, integrates with over 100 security tools via the Model Context Protocol (MCP), and maintains a persistent knowledge base and project fact graph. It features a comprehensive governance layer including Role-Based Access Control (RBAC), Human-in-the-Loop (HITL) approval workflows, tool execution guards, and detailed audit logging. The architecture is a monolithic Go-like backend serving a web SPA, with plugins for Burp Suite and Chrome. It supports multi-agent orchestration modes (single, deep, plan-execute, supervisor), a graph-based workflow engine, and integrations with various chat platforms (WeChat, Discord, Telegram). The codebase demonstrates high craftsmanship in its execution governance, process isolation, atomic update mechanism, and database schema reconciliation. A significant technical concern is the use of a non-standard Go dialect (featuring `func`, `type`, and `map` literals) tied to the Eino framework. This creates a hard dependency on a specific toolchain and represents a major drift risk from the standard Go ecosystem, limiting portability and the ability to use standard tooling. Despite this, the project is actively maintained with extensive test coverage and a clear focus on production-grade security automation.

This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.

Nemesis is an offensive security data processing platform by SpecterOps that ingests, enriches, analyzes, and alerts on files collected during red team and DFIR operations. The system is architected as a suite of microservices orchestrated via Dapr (pub/sub, workflows, state management), with services implemented in Python (FastAPI), Go (Titus secret scanner), and C# (ILSpy .NET decompiler). Key data flows: files are ingested via a CLI (supporting Cobalt Strike, Mythic, Outflank connectors) or REST API, then processed through a Dapr workflow that performs basic analysis (magic, hashes), runs pluggable enrichment modules (PE, .NET, Chromium/DPAPI decryption, YARA, SQLite, containers), invokes the Titus secret scanner, and finally publishes findings and alerts. A React frontend with Hasura GraphQL provides a dashboard for file browsing, enrichment status, YARA management, LLM-based triage agents, and reporting. The platform is deployment-agnostic with Docker Compose and Helm charts for k8s. Notable technical depth includes a standalone DPAPI decryption library (nemesis_dpapi) with multiple storage backends and write-once semantics, a rule-based file linking engine, and an AI agent framework using pydantic-ai and LiteLLM.

LSA Whisperer BOF is a Cobalt Strike Beacon Object File (BOF) port of Evan McBroom's LSA Whisperer tool, enabling red team operators to interact with Windows authentication packages (MSV1_0, Kerberos, CloudAP) through legitimate LSA client APIs (LsaCallAuthenticationPackage). It recovers DPAPI credential keys (including under Credential Guard), dumps Kerberos tickets as base64 .kirbi blobs, performs selective ticket purging, extracts Entra ID/AD FS SSO cookies, and generates NTLMv1 responses for hash cracking—all without opening handles to LSASS or touching process memory. The architecture comprises three independent BOF modules (msv1_0, kerberos, cloudap) sharing a common LSA communication layer and comprehensive header definitions for undocumented LSA structures. The code is well-structured, handles privilege separation (untrusted vs. trusted LSA connections), and provides detailed error messages. It targets red team operations and requires Cobalt Strike for execution.

This repository is a curated list of over 150 red teaming tools and resources, organized by MITRE ATT&CK categories (Reconnaissance, Resource Development, Initial Access, etc.). It contains no original source code; instead, it provides descriptions, installation instructions, usage examples, and links to external tools. The README is the sole deliverable, serving as a comprehensive reference for red team operators. While not a software application itself, it functions as a catalog of applications. The backlog file contains a few additional URLs and notes for future additions. The repository is well-maintained with active issue triage and recent commits, but its value lies in curation rather than code craftsmanship.

RedEdr is a Windows telemetry recorder designed for red teams and malware developers to assess detection surface before hitting a real EDR. It captures events from multiple Windows security layers: ETW (Event Tracing for Windows), ETW-TI (Threat Intelligence), kernel callbacks, and user-mode API hooks via Detours. The system comprises a main orchestrator (RedEdr.exe) that starts all reader subsystems, a kernel driver (RedEdrDriver.sys) for process/thread/image callbacks and KAPC injection, a DLL (RedEdrDll.dll) injected into target processes for ntdll.dll hooking, and a PPL service (RedEdrPplService.exe) that consumes ETW-TI events. An embedded web server (port 8081) serves a REST API and a client-side log viewer for filtering and analyzing captured events. The architecture follows a producer-consumer pattern: events from all sources (ETW, kernel pipe, DLL pipe, PPL pipe) are aggregated into a central EventAggregator, augmented with process and memory context, and then stored for retrieval via the web API. Inter-component communication relies on named pipes with simple ASCII command protocols. The kernel driver also includes an ELAM driver to allow the PPL service to run as a protected process. While the project demonstrates deep Windows internals knowledge and provides a comprehensive telemetry capture system, it has significant maintenance risks: hardcoded paths (C:\RedEdr\), fragile driver build dependencies, minimal unit test coverage, and several commented-out hooks in the injected DLL. The codebase is functional for its intended red-team use case but is not production-grade without substantial hardening.

This repository is a collection of Proof of Concept (PoC) implementations for various Windows process manipulation and evasion techniques, including process hollowing, DLL injection, spoofing, and memory analysis. Each technique is implemented as a standalone console application with a consistent structure separating command-line handling, core logic, and Windows API interop. The code demonstrates a clear understanding of Windows internals but suffers from significant code duplication (e.g., identical CommandLineParser and HexDump utilities across multiple projects) and relies on undocumented APIs that are prone to breaking with Windows updates. Many techniques are noted in the README as ineffective against modern Windows defenses due to security mitigations. The repository appears to be stale, with no recent updates to address evolving defenses, and exhibits high technical drift due to outdated dependencies and techniques.

This repository is a curated cheat sheet for web application security testing, penetration testing, and bug bounty hunting. It aggregates a vast collection of tools, commands, URLs, and references organized by phases: discovering, enumerating, scanning, monitoring, attacking, manual exploitation, and AI-related security. The repo contains no application code; it is a markdown document only. It is a valuable reference for security professionals but lacks any executable software components or data pipelines. The information is comprehensive and well-structured, but the repository itself is not a functional system and does not demonstrate software architecture or engineering craftsmanship beyond content curation.

This repository is a static README-based reference list that curates 20 links to external blog posts about credential dumping techniques for penetration testing. There is no actual source code, scripts, executables, or any functional software. The entire content is a markdown table with topics and links to the Ignitetechnologies blog. It functions as a curated cheat sheet or index, not as a tool, library, or pipeline. No architecture, entry points, dependencies, or data flows exist. The repository has no reusable components and exhibits zero code craftsmanship—it is purely documentation. Despite having many stars and forks, it offers no software value and is effectively a non-functional repository from a software engineering perspective.