blacklanternsecurity

blacklanternsecurity/red-run

Hook Claude Code

Runs when a session starts, executing start.sh via bash. From blacklanternsecurity/red-run.

blacklanternsecurity/red-run

Hook Claude Code

Runs when a subagent finishes for (network-recon, web-(discovery, exploit), ad-(discovery, exploit), password-spray, (linux, windows)-privesc, evasion, credential-cracking, pivoting and research)-agent tool calls, executing save-agent-log.sh. From blacklanternsecurity/red-run.

blacklanternsecurity/red-run

Hook Claude Code

Runs on the TeammateIdle event, executing save-teammate-log.sh. From blacklanternsecurity/red-run.

blacklanternsecurity/red-run

Settings file Claude Code

Agent settings declaring 3 hook events (SessionStart, SubagentStop, TeammateIdle) and 7 allowed tools.

blacklanternsecurity/red-run

MCP server Claude CodeCodexCursor +2

MCP server "skill-router" as configured in blacklanternsecurity/red-run. Runs locally from the tools/skill-router Python package. Needs 1 environment variable to run.

blacklanternsecurity/red-run

MCP server Claude CodeCodexCursor +2

MCP server "nmap-server" as configured in blacklanternsecurity/red-run. Runs locally from the tools/nmap-server Python package.

blacklanternsecurity/red-run

MCP server Claude CodeCodexCursor +2

MCP server "shell-server", hosted remotely at 127.0.0.1, as configured in blacklanternsecurity/red-run.

blacklanternsecurity/red-run

MCP server Claude CodeCodexCursor +2

MCP server "browser-server" as configured in blacklanternsecurity/red-run. Runs locally from the tools/browser-server Python package.

blacklanternsecurity/red-run

MCP server Claude CodeCodexCursor +2

MCP server "rdp-server" as configured in blacklanternsecurity/red-run. Runs locally from the tools/rdp-server Python package.

blacklanternsecurity/red-run

MCP server Claude CodeCodexCursor +2

MCP server "state" as configured in blacklanternsecurity/red-run. Runs locally from the tools/state-server Python package.

blacklanternsecurity/red-run

MCP server Claude CodeCodexCursor +2

MCP server "sliver-server", hosted remotely at 127.0.0.1, as configured in blacklanternsecurity/red-run.

blacklanternsecurity/red-run

Instructions file

Claude Code instructions for blacklanternsecurity/red-run, covering red-run, engagement workflow, token budget, architecture and orchestrator variants.

blacklanternsecurity/red-run

Agent

Active Directory discovery subagent for red-run. Performs AD enumeration, BloodHound collection, LDAP queries, and attack surface mapping as directed by the orchestrator. Use when the orchestrator needs to enumerate a domain and map AD attack paths.

blacklanternsecurity/red-run

Agent

Active Directory exploitation subagent for red-run. Executes one AD technique skill per invocation as directed by the orchestrator. Handles Kerberos attacks, ADCS abuse, ACL exploitation, credential operations, lateral movement, and domain persistence. Use when the orchestrator needs to exploit an AD vulnerability.

blacklanternsecurity/red-run

Agent

Credential cracking subagent for red-run. Performs offline hash cracking and encrypted file cracking using hashcat and john as directed by the orchestrator. Handles hash identification, wordlist selection, rule escalation, and file extraction (2john tools). All operations are local — no target interaction. Use when…

blacklanternsecurity/red-run

Agent

AV/EDR evasion subagent for red-run. Builds AV-safe payloads and applies runtime evasion techniques as directed by the orchestrator. Handles custom payload compilation (mingw, Go), AMSI bypass, ETW patching, and alternative execution methods. Use when an exploit or privesc agent reports that a payload was quarantined…

blacklanternsecurity/red-run

Agent

Linux privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Linux host discovery, sudo/SUID/capabilities abuse, cron/service exploitation, file path abuse, kernel exploits, and container escapes. Use when the orchestrator has shell access on a…

blacklanternsecurity/red-run

Agent

Network reconnaissance subagent for red-run. Performs host discovery, port scanning, service enumeration, and quick-win checks as directed by the orchestrator. Has access to nmap via MCP server — no sudo handoff needed. Use when the orchestrator needs to scan a target or subnet.

blacklanternsecurity/red-run

Agent

Password spraying subagent for red-run. Executes credential spraying against any authentication service (AD, web forms, SSH, etc.) as directed by the orchestrator. Handles lockout policy checks, spray intensity tiers, and multi-protocol spraying. Use when the orchestrator needs to spray credentials against discovered…

blacklanternsecurity/red-run

Agent

Pivoting and tunneling subagent for red-run. Sets up network tunnels through compromised hosts to reach internal subnets. Handles SSH tunnels, sshuttle, ligolo-ng, chisel, and socat as directed by the orchestrator. Use when the orchestrator has shell access on a dual-homed host and needs to reach an internal network.

blacklanternsecurity/red-run

Agent

Deep analysis subagent for red-run. Analyzes custom applications, binaries, and scripts that standard technique skills could not crack. Performs source code review, binary analysis, CVE research, and PoC adaptation. Use when any technique agent returns saying standard patterns do not match.

blacklanternsecurity/red-run

Agent

Web application discovery subagent for red-run. Performs web application enumeration, technology fingerprinting, and vulnerability identification as directed by the orchestrator. Handles content discovery, input mapping, and attack surface analysis. Use when the orchestrator needs to discover vulnerabilities in a web…

blacklanternsecurity/red-run

Agent

Web application exploitation subagent for red-run. Executes one web technique skill per invocation as directed by the orchestrator. Handles injection testing, authentication bypass, file upload, deserialization, and all other web exploitation techniques. Use when the orchestrator needs to exploit a web vulnerability.

blacklanternsecurity/red-run

Agent

Windows privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Windows host discovery, token impersonation, service/DLL abuse, UAC bypass, credential harvesting, and kernel exploits. Use when the orchestrator has shell access on a Windows host and…