Agent
Active Directory discovery subagent for red-run. Performs AD enumeration, BloodHound collection, LDAP queries, and attack surface mapping as directed by the orchestrator. Use when the orchestrator needs to enumerate a domain and map AD attack paths.
Agent
Active Directory exploitation subagent for red-run. Executes one AD technique skill per invocation as directed by the orchestrator. Handles Kerberos attacks, ADCS abuse, ACL exploitation, credential operations, lateral movement, and domain persistence. Use when the orchestrator needs to exploit an AD vulnerability.
Agent
Credential cracking subagent for red-run. Performs offline hash cracking and encrypted file cracking using hashcat and john as directed by the orchestrator. Handles hash identification, wordlist selection, rule escalation, and file extraction (2john tools). All operations are local — no target interaction. Use when…
Agent
AV/EDR evasion subagent for red-run. Builds AV-safe payloads and applies runtime evasion techniques as directed by the orchestrator. Handles custom payload compilation (mingw, Go), AMSI bypass, ETW patching, and alternative execution methods. Use when an exploit or privesc agent reports that a payload was quarantined…
Agent
Linux privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Linux host discovery, sudo/SUID/capabilities abuse, cron/service exploitation, file path abuse, kernel exploits, and container escapes. Use when the orchestrator has shell access on a…
Agent
Network reconnaissance subagent for red-run. Performs host discovery, port scanning, service enumeration, and quick-win checks as directed by the orchestrator. Has access to nmap via MCP server — no sudo handoff needed. Use when the orchestrator needs to scan a target or subnet.
Agent
Password spraying subagent for red-run. Executes credential spraying against any authentication service (AD, web forms, SSH, etc.) as directed by the orchestrator. Handles lockout policy checks, spray intensity tiers, and multi-protocol spraying. Use when the orchestrator needs to spray credentials against discovered…
Agent
Pivoting and tunneling subagent for red-run. Sets up network tunnels through compromised hosts to reach internal subnets. Handles SSH tunnels, sshuttle, ligolo-ng, chisel, and socat as directed by the orchestrator. Use when the orchestrator has shell access on a dual-homed host and needs to reach an internal network.
Agent
Deep analysis subagent for red-run. Analyzes custom applications, binaries, and scripts that standard technique skills could not crack. Performs source code review, binary analysis, CVE research, and PoC adaptation. Use when any technique agent returns saying standard patterns do not match.
Agent
Web application discovery subagent for red-run. Performs web application enumeration, technology fingerprinting, and vulnerability identification as directed by the orchestrator. Handles content discovery, input mapping, and attack surface analysis. Use when the orchestrator needs to discover vulnerabilities in a web…
Agent
Web application exploitation subagent for red-run. Executes one web technique skill per invocation as directed by the orchestrator. Handles injection testing, authentication bypass, file upload, deserialization, and all other web exploitation techniques. Use when the orchestrator needs to exploit a web vulnerability.
Agent
Windows privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Windows host discovery, token impersonation, service/DLL abuse, UAC bypass, credential harvesting, and kernel exploits. Use when the orchestrator has shell access on a Windows host and…