Autonomous Hacking Agent for Red Team
Decepticon is an autonomous red-team agent that coordinates AI agents, security tools, sandboxes, and supporting services for authorized cybersecurity assessments. Security researchers and red teams can run it through its Docker stack, cloud service, command-line interface, or Python SDK, with the catalogue entries representing its available skills.
Skill Claude Code
CORS misconfiguration exploitation — reflected origin, null origin, trusted-subdomain abuse, regex-validation bypass, and credentialed cross-origin data theft.
Skill Claude Code
Cross-Site Request Forgery — missing/invalid tokens, method override, JSON CSRF, SameSite gaps, double-submit flaws, login/logout CSRF, and CSRF-via-XSS chains to account takeover.
Skill Claude Code needs its repo
Known CVE exploitation — fingerprint CMS/framework/plugin version, look up CVE candidates via cvelookup, retrieve PoCs via cvepoclookup, adapt the public exploit to the target, and confirm RCE. Use whenever the challenge tag is cve, recon fingerprinted a versioned service, or the challenge name hints at known…
Skill Claude Code
DNS rebinding attack to bypass browser same-origin policy and reach IMDS/localhost/internal services: TTL=0 rebind mechanics, rbndr.us/singularity tooling, browser DNS cache pinning, chaining into AWS/GCP/Azure IMDS credential pivot. Use when SSRF is blocked but a victim browser can be induced to make requests, or…
Skill Claude CodeCodex
DOM clobbering — abuse named HTML elements to overwrite JavaScript global variables, bypass CSP, hijack object property lookups.
Skill Claude Code
Arbitrary file upload exploitation — webshell upload, extension bypass, content-type manipulation, and upload-to-RCE techniques.
Skill Claude Code
GraphQL exploitation — introspection, injection, authorization bypass, and data exfiltration through GraphQL APIs.
Skill Claude Code
HTTP header injection — CRLF/response splitting, Host-header cache poisoning, X-Forwarded- abuse, Content-Disposition/Set-Cookie injection, and password-reset link poisoning via unvalidated header values.
Skill Claude Code
HTTP Parameter Pollution — parser discrepancies between proxy/server/app, WAF bypass, auth/ACL bypass, injection delivery.
Skill Claude CodeCodex needs its repo
JSON Web Token attacks — algorithm confusion (alg=none, HS256↔RS256), kid header injection, JWKS spoofing, weak HMAC secret cracking, signature stripping.
Skill Claude CodeCodex
LDAP injection — auth bypass via filter manipulation, blind data extraction, search filter abuse, DN injection.
Skill Claude Code needs its repo
Path traversal and Local File Inclusion (LFI) — arbitrary file reading via directory traversal, PHP filter/input/data wrappers for RCE, log poisoning, static resource disclosure, and information leakage. Use for any challenge involving file path manipulation, ../ traversal, local file read, PHP wrappers, or sensitive…
Skill Claude CodeCodex
Mass assignment + ORM leak — inject extra fields into create/update requests, escalate to admin, leak protected fields via response.
Skill Claude Code
2FA / OTP logic flaws — response & status tampering, brute force, OTP reuse, backup-code abuse, race conditions, missing-2FA on flows, remember-me bypass, password-reset skips 2FA.
Skill Claude CodeCodex
NoSQL injection — MongoDB operator injection ($ne, $gt, $where, $regex), CouchDB / Firebase / Redis attack patterns, auth bypass, blind extraction.
Skill Claude CodeCodex
OAuth 2.0 / OIDC attacks — redirecturi bypass, state CSRF, code leak via Referer, responsetype confusion, PKCE downgrade, scope creep, ATO chains.
Skill Claude CodeCodex
Open redirect + tabnabbing — URL filter bypass, OAuth chain extension, phishing infrastructure-free, SSRF chain.
Skill Claude Code
PHP type juggling and magic hash attacks — exploit loose comparison (==) with 0e-prefixed hash collisions and NULL returns to bypass authentication.
Skill Claude CodeCodex
Reverse proxy misconfigurations — nginx alias traversal, Apache modrewrite SSRF, Spring Boot Actuator exposure, Tomcat manager, IIS short-name disclosure.
Skill Claude CodeCodex
Race condition / TOCTOU exploitation — concurrent and parallel-request attacks against web applications that check then act, write session state before validating it, or perform slow operations that widen the race window. Covers single-endpoint races (double-spend, coupon abuse, balance overflow) and multi-endpoint…
Skill Claude CodeCodex
SAML 2.0 attacks — XSW (XML Signature Wrapping) variants 1-8, comment injection, signature stripping, assertion forgery, IdP metadata abuse.
Skill Claude CodeCodex
HTTP Request Smuggling (HRS) — front-end / back-end parser disagreement attacks that desync the proxy stack. Covers CL.TE, TE.CL, TE.TE, CL.0, HTTP/2 downgrade (h2.cl, h2.te), pipelining, and connection-state pinning. Includes a confirm-desync gate, header obfuscation catalog, and minimal raw-socket Python harnesses…
Skill Claude CodeCodex
SQL Injection — automated and manual exploitation of unsanitized SQL queries. Covers Union-based, Error-based, Blind (Boolean/Time-based), and Stacked queries. Includes sqlmap automation with WAF bypass tamper scripts.
Skill Claude Code
HTTP verb/method tampering — auth bypass via HEAD/OPTIONS/arbitrary methods, X-HTTP-Method-Override, TRACE/PUT/DELETE exposure, framework routing flaws.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: