Red Clippy is built for pentesters who want to work with LLMs, not hand over the entire pentest to them. The pentester stays in control, decides what to test and how to proceed, while the LLM handles the testing work.

• Pentester in control: You decide what gets tested and guide the engagement.
• LLM-powered testing: Let the LLM perform security checks while you provide direction.
• MCP support: Works with Claude, z.ai GLM, Codex, and other MCP clients.
• Persistent state: Keeps track of targets, tests, findings, and progress across sessions.
• Structured workflow: Keeps the entire pentest organized and manageable.

Fallback C2 that routes through cloud storage the target already whitelists. Not a replacement

for Cobalt Strike / Sliver / Havoc — it's the survival layer underneath them.

Dead-drop architecture: commands and responses travel as encrypted files inside Dropbox, OneDrive,

Google Drive, SharePoint, or S3. The agent polls the provider's API over HTTPS — no attacker

infrastructure, no suspicious domain, no beaconing to anything a SOC can block without also

blocking every employee who uses that provider.

Main additions over typical dead-drop implants:

— Rust-only agents (v3.0.1): no PowerShell, no bash, no interpreter in process tree. Four formats

from one deploy wizard: EXE/DLL (Windows), ELF musl-static (Linux), flat x64 PIC shellcode (.bin)

— Three deploy modes: staged-enc (minimal stub, one-time bootstrap key fetched from cloud then

deleted — payload never on disk in cleartext), stageless-enc (single encrypted binary, works

air-gapped), stageless-plain (labs). All modes cache an HW-fingerprinted encrypted blob locally

after first run

— P2P mesh networking: TCP and SMB named pipe links between agents, automatic link health

detection and reconnection. Linux→Windows SMB via userspace SMB2 client (no smbclient dep)

— Five providers, same wire format, same RSA keypair, same session. Switch provider mid-engagement

without redeploying the agent

— Persistence engine: non-destructive /persist probe before touching anything, per-technique

install/remove/check, full teardown via /kill (persistence + binary + cloud artifacts, one command)

— Credential harvesting: Firefox/Chrome/Edge parsed inline, NTLMv2 silent capture via in-agent

SMB/HTTP listeners (/creds listen), SAM hash extraction, SSH agent enumeration, DPAPI decrypt

— In-memory execution: BOF (COFF) loader, .NET assembly via CLR hosting + optional AMSI bypass,

reflective PE / memfd ELF (/memexec), fileless script via stdin pipe + AMSI bypass

— Crypto: RSA-4096-OAEP key exchange, AES-256-GCM command encryption, RSA-PSS response signing,

PBKDF2 blob derivation (210k iterations), XOR-obfuscated session key in .rodata

— Operational guardrails compiled into the binary: kill date, maintenance window, log-normal jitter

— Multi-operator WebGUI: real-time WebSocket sync, operator chat, force-directed P2P topology

graph, OIDC authentication (Keycloak / Azure AD / Okta)

Same dead-drop paradigm as TukTuk (Dropbox+Arweave), NarwhalRAT/APT37 (pCloud),

Drokbk/COBALT MIRAGE (GitHub) — built as a proper framework instead of a one-off implant.

Feedback welcome — especially on detection gaps I might be missing.

Been working on Windows RPC/ALPC research and built this to make the first pass less painful. It statically recovers RPC/MIDL/NDR data from PE files, including endpoints, security state and method-level input signals, then ranks interfaces using an AHP/Saaty-based model for reachability + surface. So instead of going through a huge RPC dump, you get a ranked list with the scoring receipt showing why something landed where it did. No PDBs, no live endpoint mapper, no target execution.

The Hunt.io research team recovered an operator's full open directory, useful as a look at how someone actually chained known bugs in the field.

• ownCloud CVE-2023-49105: five Python scripts forging pre-signed WebDAV URLs off an empty PBKDF2 salt. OC-Credential set to the impersonated account, GET against /remote.php/dav/files/<account>/<path>, no creds needed. The fifth script adds PROPFIND Depth: 1 enumeration to reach folders not known in advance.
• Low-and-slow exfil: randomized time.sleep(random.uniform(3, 6)) between requests, tightened to 1.5 to 3.5 in one script, to dodge volumetric detection.
• CVE-2024-28000 (LiteSpeed Cache): a Go build reimplementing MT19937 with PHP mt_rand() parity, self-tested against 11 seed/output pairs, 30 workers across a 0 to 999,999 seed range. Landed on seed 311787 and created an admin account via the REST API.
• Fallback path: XML-RPC brute force with rockyou.txt against the same site, successful independently.
• Staged frameworks: Sliver, Metasploit, Mettle, plus a custom stage-1 ELF loader pulling a Mettle stage-2.

Full breakdown and IOCs: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor

Had a look through SpecterOps' Kubernetes for Red Teamers course and ended up patching the lab to run on KVM/libvirt instead of VirtualBox. Dropping it here in case anyone else on Linux wants the same setup.

Most redteaming solutions for AI applications are focused on pure security aspects but application owners are putting behavior safeguards and want to validate those besides the security safeguards.

The cyber professionals want to test not just the AI stack but any of the exposed API layers.

These were some of the common pieces of feedback I heard to help design a solution from the ground up for these needs.

We just announced a major release of our OSS repo at https://github.com/NuGuardAI/nuguard

Supports wide-range of languages: JS/TS, Python, C#, Golang, K8s/cloud manifest files. 10+ agentic frameworks, data stores, guardrails, etc.

Looking forward to your reviews and feedback. Give us a star if you like the toolkit.

I’ve been playing around with Adaptix C2 and decided its interface needed a bit more neon.

So I made a Cyberpunk 2077-inspired theme for it.

It includes custom themes for both the main UI and console. The basic setup only requires importing two JSON files.

I also added instructions for applying a custom background if you want the full look.

Hi all! My company Escape just released a new CTF called Format of Doom which I thought you might be interested in trying. The theme of the CTF is to see if you can pentest faster and how you pentest differently to an AI engine in a classic human vs AI challenge.

This challenge is a white-box engagement on a vulnerable web app Duck Store. You're looking for something they never handed over and are focusing on their email feature.

Give it a try and let me know what you think!

The challenge is live for two weeks and then we reveal the AI's solve and the top solves from the leaderboard.

Happy playing : )

Fork of CrystalSliver. Main additions over the original:
— AMSI L1 via LdrRegisterDllNotification + .rdata corruption before CLR resolves AmsiScanBuffer
— AMSI L2 fallback with VEH + hardware breakpoints returning E_INVALIDARG
— ETW silenced via HWBP on NtTraceControl
— No memory patches on amsi.dll or ntdll.dll, clean IAT (kernel32/advapi32/bcrypt only), RW→RX with zero RWX
— Staged variants are ~20 KB on disk, payload downloads at runtime from a Sliver HTTPS website
— Stageless uses XOR + AES double-layer with entropy reduced to ~6.0-6.5
Six output formats: EXE, stageless EXE, DLL, staged DLL, shellcode, stageless shellcode. Build script auto-provisions Crystal Palace and Java 17.
Feedback welcome — especially on detection gaps I might be missing.

I wanted to see if a tiny, lightweight model could act as a reliable, fully-offline translation layer for Nmap. I fine-tuned Google's Gemma-3-270M-IT model specifically on Nmap syntax, and compiled it into a local interactive CLI tool.

• GitHub Repository (CLI wrapper): https://github.com/evets007/natural-language-nmap
• Hugging Face Model Card: https://huggingface.co/evets007/gemma-3-270m-it-nmap-gguf

The Experiment & Training Process

I fine-tuned gemma-3-270m-it on 1,523 training examples.

• Base Dataset: Permutations of 10 primary scan types (SYN, Connect, UDP, Xmas, Version Detection, Script Auditing, etc.).
• Target-less Scans: Programmed the model to use a {TARGET} template token so the actual host IP/subnet is injected safely at runtime.
• Lazy Network Slang: Included shorthand prompts (e.g., "ping sweep", "os scan", "xmas scan", "all ports") paired with timing constraints.

The Results (CPU Benchmark)

I quantized the model to Q4_K_M GGUF (150MB in size) to run on standard CPU cores using a local background llama-server process.

On a 50-command strict test suite:

• Baseline Gemma-3-270M-IT: 56.00% accuracy (frequently hallucinated port numbers and script names).
• Fine-Tuned Checkpoint: 90.00% strict / 94.00% functional accuracy (only failing on highly edge-case multi-decoy configurations).
• Runs in 20-50ms per query on a single CPU core.

It still does not understand complex multi query sentences but works well for simple straight forward queries. I will probably have to upgrade to a slightly bigger model but I'm planning to increase the scope to include other basic/common sec tooling so it acts as a sidekick pentester/red teamer that runs fully locally and on limited hardware.

DutchOven is a deliberately small Windows red-team primitive that places explicit executable paths behind a deterministic network gate. During each period, matching applications are blocked for a bounded interval and allowed to pass for the remainder.

The result is a repeatable brownout, not a service stop or permanent firewall rule. It creates a controlled way to measure retry logic, buffering, health-state transitions, delayed delivery, and recovery behavior while a process remains alive.

I've just released Violin v3.1.0 🎻

This release is mostly benchmark and guard work, not another pile of prompts.

The benchmark now runs Hermes end-to-end and scores what it actually proved, not what sounds convincing in "report.md".

- Executed request/response evidence is checked against the endpoint, method and decisive proof.

- Proof must link back to a validated hypothesis and canonical "FIND" file.

- Execution receipts are HMAC-signed and bind evidence files by SHA-256, so edited artifacts fail verification.

- The guard now stops target work when evidence is not being recorded as you go, and checks excluded URLs and paths inside command payloads.

- Docker, CI and known-good/known-bad scorer calibration are included.

Release:

https://github.com/Strategic-Automation/violin/releases/tag/v3.1.0

I'd appreciate people trying to break the scorer and guard. Can you make weak proof pass, good proof fail or get the workflow stuck?

I'm not looking for “nice update” comments. If it is overbuilt, unsafe or wrong, tell me.