RedAmon Wiki
Legal Disclaimer: This tool is intended for authorized security testing, educational purposes, and research only. Never use this system to scan, probe, or attack any system you do not own or have explicit written permission to test. Read the full disclaimer.
Welcome to the RedAmon user guide — a comprehensive, step-by-step reference for getting started with and mastering every feature of the RedAmon AI-powered red team framework.
New here? Start with Getting Started to install and launch RedAmon, then follow the guide sequentially.
Want the deep technical view? This wiki is the operator-facing user guide. For the architectural deep dive — the Scatter-Gather ReAct (SG-ReAct) pattern, every node of the agent state machine, the four-layer guardrail stack, the EvoGraph schema, the fireteam fan-out internals, and an impartial code-verified benchmark against other ai pentesting repos — read the RedAmon Agentic System — Technical Whitepaper in the project repository.
🏆 Flagship result: RedAmon solves 101 / 104 (97.1%) of the XBOW web-security benchmark fully black-box. It also backs every single solve with a complete, unedited raw agent session and a reproducible, step-by-step walkthrough: open any row and read exactly how the flag was recovered, tool call by tool call. A benchmark number with no runnable evidence is a claim; RedAmon's is auditable line by line. See the XBOW Validation Benchmark scorecard.
📊 Where RedAmon stands against the full bug-bounty taxonomy: the Bug Bounty Coverage — The Full Taxonomy Audit (PDF, 124 pages) audits all 397 classes of web bug-bounty finding, one line at a time, against what the codebase actually does — naming the exact module, skill or scanner behind every verdict, and measuring the recon pipeline and the agentic system separately. It is deliberately a self-critical document: it records what is missing as plainly as what is covered, and it scores each half against its own remit (the classes that half should own: 162 for recon, 264 for the agent) rather than against the whole taxonomy, because a class one half was never meant to cover is not a gap in it. Four parts: the measured position, the taxonomy in full, the class-by-class gap with its owning component, and one explicit build decision for every class — 134 already complete, 210 forming the backlog, 44 deliberately not built.
Quick Navigation
Getting Started
| Page | What You'll Learn |
|---|---|
| Getting Started | Prerequisites, installation, environment setup, first launch |
| Deploying to a Server | Put a full instance on a public Linux server (EC2, DigitalOcean, Hetzner) over HTTPS with one command |
| User Management | Creating users, switching between users, deleting users |
| Creating a Project | Setting up a target (single domain, IP/CIDR, or a Domain batch of many domains), configuring scan modules, the 16-tab project form |
| Recon Presets | 21 built-in presets, user-saved presets, AI-generated presets -- configure 328+ parameters in one click |
| Global Settings | LLM providers, the model each AI feature runs on (Models by feature), tool API keys (Tavily, Shodan, SerpAPI), agent skill management |
Core Workflow
| Page | What You'll Learn |
|---|---|
| Red Zone | Main interface tour -- toolbar, 2D/3D graph, data table, node details, bottom bar |
| Recon Pipeline Workflow | Interactive visual pipeline diagram -- data flow, chain breaking, tool dependencies, produces/consumes reference |
| Running Reconnaissance | Starting scans, real-time logs, the parallelized fan-out/fan-in pipeline, downloading results |
| Scan Timeline | Versioned recon graphs -- keep each scan as a snapshot, view/activate any version, compare two scans (Recon Delta), Version Manager, and the Scans tab (schedules, the live scan queue and run history) |
| AI Agent Guide | Chat interface, agent phases, Wave Runner (parallel tools), approval workflows, guidance, reports, starting a session from a graph node |
| Anatomy of a Think Step | The exact prompt the agent receives and the exact decision JSON it returns — every system-prompt section (purpose, logic, as-received text), the human message, and every field of the LLMDecision schema, with one full worked step |
| Fireteam — Parallel Specialists | Fan-out the agent into N specialist sub-agents on independent angles; per-member panels, per-member tool approvals, every project parameter explained |
| Exploit-Path Search (LATS) | Optional value-guided tree search over exploit probes during exploitation; fans out attack paths, scores each probe, prunes WAF/403 dead ends, live tree card + expandable modal, every parameter explained |
| Agent Workspace | Per-project filesystem the agent + the kali-sandbox + you all share — drag-and-drop drawer, 24 fs_* tools, 5 job_* background-job tools, auto-offload of huge tool outputs |
| Reverse Shells | Live session interaction, Command Whisperer, meterpreter/shell management, session upgrade |
| RedAmon Terminal | Direct interactive Kali sandbox shell via xterm.js — fullscreen, auto-reconnect, all pentesting tools |
Scanning & OSINT
| Page | What You'll Learn |
|---|---|
| AI in the Recon Pipeline | How RedAmon threads AI through the recon pipeline in small, auditable doses instead of one autonomous black box — where each LLM hook sits and what it decides |
| TypeSafe Jev | A typed decision model as a second engine for four recon AI hooks (FFuf extensions, Nuclei tags, WAF classification, takeover disambiguation), and five Jev-only hooks (page-type labels, FFuf base-path ranking, Hakrawler seed order, tool health, serialized-object ranking) -- what Jev is asked, the floors and closed answer sets that contain its answers, setup, fallbacks, cost and MCP |
| Jev Meets the Recon Pipeline | The animated 19-slide walkthrough of the same idea on redamon.org -- how Jev plugs into the pipeline, what each hook decides and gains, and how to switch it on |
| Adversarial AI Recon | AI-surface signal extraction inside the standard recon pipeline -- DNS provider hints, AI port catalog, runtime-version regex, HTTP header/title/favicon signatures, endpoint AI classifier (ai_interface_type, is_ai_rag_ingest, prompt-injectable params), and JS Recon AI SDK detection (vendor SDK imports, hard-coded provider keys, dangerouslyAllowBrowser opt-in, AI-frontend product markers in JS bundles) across LLM runtimes, vector DBs, frontends, proxies, and SDK clients |
| AI Gauntlet | Offensive AI testing -- runs the discovered LLM endpoints through garak, PyRIT, Giskard, and promptfoo; every probe family explained, every UI parameter, graph in / findings out, the Red Zone AI Gauntlet Vulnerabilities table, and the report section; deterministic and zero-egress (local Ollama judge) |
| JS Reconnaissance | Deep JavaScript analysis -- secrets, endpoints, dependency confusion, source maps, DOM sinks, framework detection, AI SDK detection (Phase 6 of the Adversarial AI rollout) |
| GraphQL Security Testing | Dedicated GraphQL scanner -- endpoint discovery, introspection leaks, schema extraction, sensitive-field detection, 12 graphql-cop misconfig checks |
| Subdomain Takeover Detection | Layered takeover scanner -- Subjack + Nuclei takeover templates + BadDNS (AGPL-3.0 isolated sidecar), dedup across tools, confidence scoring, verdicts |
| VHost & SNI Enumeration | Hidden virtual host discovery via L7 (HTTP Host header) + L4 (TLS SNI) probes per candidate hostname; reveals reverse-proxy / k8s ingress / Cloudflare routing |
| TLS Certificate Grab | Grabs the certificate off every open non-HTTP TLS port (SMTPS, IMAPS, LDAPS, FTPS, odd ports) with a single tlsx handshake; hostnames found inside a cert become probe targets in the same scan |
| Web Cache Poisoning | Active web cache poisoning + deception scanner -- WCVS breadth sweep then a RedAmon-native 5-phase confirmation (cache oracle, isolated cache-buster, framework hypotheses, baseline→poison→clean persistence, confidence scoring); reflected + non-reflective detection, benign canaries, every UI parameter explained |
| Serialized Object Detection | Insecure-deserialization capability in two halves -- a passive, in-memory recon scan flags serialized-object signatures (native Java, polymorphic JSON/XML/YAML, PHP, Python pickle, .NET BinaryFormatter/ViewState, Ruby Marshal, Hessian) as info candidates (never deserializes, bomb-safe decoder), and the built-in Insecure Deserialization agent skill confirms the one that matters with a non-destructive out-of-band oracle and promotes it |
| Origin Discovery | Unmasks the real origin server behind a CDN/WAF -- gathers candidate IPs from non-CDN subdomains, SPF/MX, crt.sh, favicon hash, Shodan/Censys/FOFA/ZoomEye, OTX/VirusTotal, and SecurityTrails/ViewDNS DNS history, then confirms each with a weighted HTML+cert+header similarity probe (fail-closed SSRF gate, per-scan search budget); writes IP + HAS_ORIGIN + a waf_bypass Vulnerability |
| GVM Vulnerability Scanning | Network-level scanning with OpenVAS, scan profiles, viewing results |
| GitHub Secret Hunting | Creating a GitHub token, configuring and running secret scans |
| Secret Multiscanner | Deep secret scanning across 14 sources with 1060 detectors and live API verification |
| Supply-Chain Scanning | Detect known-malicious (MAL-) and known-vulnerable (CVE / GHSA) packages, fully offline against a local OSV database -- an SBOM/repo audit (Other Scans), a live-target harvest in recon, and two agent tools (OSV-Scanner + GuardDog + retire.js) |
AI & Automation
| Page | What You'll Learn |
|---|---|
| AI Model Providers | Setting up OpenAI, Anthropic, Gemini, DeepSeek, GLM, Kimi, Qwen, xAI, Mistral, OpenRouter, AWS Bedrock, OpenAI-Compatible (Ollama, vLLM, …), plus the TypeSafe Jev token for the recon AI hooks |
| MCP Tool Plugins | Plug any Model-Context-Protocol server into the agent as a tool plugin — 39 prefilled presets (Shodan, GitHub, Hugging Face, Censys, mitmproxy, …), Test/Discover button, phase-aware Tool Matrix integration |
| MCP Server | RedAmon as an MCP server: let YOUR AI agent connect in and drive recon as you (the opposite direction from Tool Plugins). Start and stop scans, query the attack-surface graph in natural language or raw Cypher, tune recon. Read-only by default, scoped to your own projects, editable and revocable at any time |
| MCP API Reference | Every tool the MCP server exposes, generated from the server itself: arguments, types and limits, the permission each one needs, whether it is read-only or destructive, an example call and the JSON Schema |
| Knowledge Base & Web Search | Offline, RAG-enhanced search for the agent — a local FAISS + Neo4j index of curated security data that web_search() queries first, skipping or merging with Tavily by confidence |
| Agent Skills | Built-in skills (CVE, SQLi, XSS, brute force, phishing, DoS), user-defined agent skills, classification badge, skill authoring |
| Chat Skills | On-demand reference injection via /skill command -- tool playbooks, vulnerability guides, framework notes |
| Tradecraft Lookup | A user-curated catalog of trusted offensive-security URLs (HackTricks, PayloadsAllTheThings, PoC repos) the agent pulls the exact page from mid attack chain, in the exploitation and post-exploitation phases |
| CVE Intel | Structured CVE intelligence for the agent — exploitability scoring, KEV status, EPSS, public PoC links, and Nuclei template availability via the vulnx CLI (the structured query axis that semantic search can't answer) |
| Playwright Browser Automation | The agent drives a real headless Chromium (the execute_playwright MCP tool) to test SPAs and JS-heavy pages where curl only returns empty loader HTML |
| CypherFix — Automated Remediation | Vulnerability triage, remediation dashboard, CodeFix agent, diff review, PR creation |
| Priority Board | Deterministic ranking of every finding by exploitability and exposure, and muting so noise is hidden from the graph, reports and the AI agent; Multi mute finds the findings like the one you mute and groups them for you to confirm |
| Rules of Engagement (RoE) | Document upload, LLM parsing, enforcement layers, RoE viewer, settings reference |
Plugins
Optional features an admin installs from the signed RedAmon plugin catalog. Each plugin has its own page.
| Page | What You'll Learn |
|---|---|
| Plugin Platform | Optional features an admin installs from the signed RedAmon plugin catalog (not the same as MCP Tool Plugins): what the server needs (Docker Engine 28.0.0+) and why a start can refuse, installing, updating, disabling and uninstalling |
| Skiller | The first plugin: reads a finished chat session and proposes a better, session-agnostic version of a skill the agent used, a built-in one or, since 1.1.0, one of your own, for you to review and approve. How it works, step by step |
| Building a Plugin | Build your own plugin and propose it without write access: fork, build and test, open a pull request, then an administrator reviews, merges and releases it to every RedAmon |
HackLab
| Page | What You'll Learn |
|---|---|
| RedAmon HackLab | A self-contained vulnerable target environment for evaluating the agent — two scenarios (guided and open-ended), the target service map, and the prerequisites to run each |
Analysis & Reporting
| Page | What You'll Learn |
|---|---|
| Insights Dashboard | Analytics overview — KPI cards, attack chain charts, vulnerability intelligence, graph overview |
| TrafficMind | AI-aware HTTP capture proxy that records every request/response your recon tools and agent send, attributes each to its source, and exposes the captured traffic to the operator and the AI agent |
| proxy_brain | The agent's code-native web-hacking tool over the TrafficMind corpus: it writes Python against the redamon SDK to search, replay, fuzz, decode, forge and race the traffic — and drive a real browser for DOM-based bugs |
| Authenticated Session Recording | Give recon and the agent one logged-in identity per project, recorded by driving your own browser through the capture proxy or entered by hand, so the post-login surface is crawled and tested |
| Pentest Reports | Report generation, templates, export formats |
| Attack Surface Graph | Neo4j graph schema -- 22 node types, 20+ relationships |
| Surface Shaper | Define focused attack surfaces from the full graph using natural language and AI-generated Cypher queries |
| EvoGraph — Attack Chain Evolution | Evolutive attack chain graph — 5 node types, bridge relationships, cross-session learning |
| Data Export & Import | Exporting projects, downloading scan data, Excel export |
Contributing
| Page | What You'll Learn |
|---|---|
| AI-Assisted Development | Ship perfect PRs using AI coding agents — integration prompts, iterative review workflow, Claude Code setup |
Reference & Help
| Page | What You'll Learn |
|---|---|
| Project Settings Reference | Complete reference for all 245+ configurable parameters |
| Memory Management | The memory governor that watches free RAM and keeps parallel scans from exhausting the single host — what you see in the UI, how many scans you can run, and the knobs to tune it |
| XBOW Validation Benchmark | Evaluation of the RedAmon agent on the 104 XBOW web targets — 101/104 (97.1%) solved fully black-box, every solve backed by an unedited session transcript and a reproducible walkthrough |
| Troubleshooting | Common issues, container management, GVM feed sync |
What is RedAmon?
RedAmon is an open-source, self-hosted AI penetration testing framework that maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens pull requests that fix what it finds. It is MCP-native both ways: plug any MCP server in as a tool, or drive RedAmon from Claude Code or your own agent. Everything runs inside Docker containers: no security tools needed on your host machine.
Key capabilities:
- Automated Reconnaissance - parallelized fan-out/fan-in scanning pipeline that maps an entire attack surface from a domain, IP/CIDR targets, or a Domain batch of many domains scanned in turn
- AI-Powered Pentesting — autonomous agent that reasons, selects tools, executes exploits, and runs independent tools in parallel via Wave Runner
- Network Vulnerability Scanning — GVM/OpenVAS integration with 170,000+ NVTs
- GitHub Secret Hunting — discover leaked credentials and API keys
- Secret Multiscanner - 1060 secret detectors across 14 sources, with optional live API verification
- Supply-Chain Scanning -- detects known-malicious (
MAL-) and known-vulnerable (CVE/GHSA) packages fully offline against a local OSV database; three layers (SBOM/lockfile or GitHub-repo audit in Other Scans, a black-box live-target harvest inside recon, and two agent tools) share one engine (OSV-Scanner + GuardDog + retire.js) and one graph model - TypeSafe Jev in the recon pipeline -- a typed decision model you can switch on per hook instead of the LLM for FFuf extensions, Nuclei tags, WAF classification and takeover disambiguation, plus five Jev-only hooks (page-type labels, FFuf base-path ranking, Hakrawler seed order, tool health, serialized-object ranking); its answers are confined to closed sets with code-enforced floors, it never removes a finding, and any failure falls back to the static behaviour
- Adversarial AI Recon -- AI-surface signal extraction inside the standard recon pipeline; finds local model runtimes, vector DBs, AI frontends, AI proxies, and SDK clients via DNS hints, port catalog, Nmap regex, and HTTP header/title/favicon signatures -- all black-box, no API keys
- AI Gauntlet -- offensive AI testing that runs the discovered LLM endpoints through garak, PyRIT, Giskard, and promptfoo; deterministic and zero-egress (local Ollama judge), with findings written back to the graph as OWASP-LLM-mapped vulnerabilities
- JS Reconnaissance -- deep JavaScript analysis with 90+ secret patterns, source map discovery, dependency confusion detection, and endpoint extraction
- GraphQL Security Testing -- dedicated scanner for GraphQL APIs with introspection detection, schema extraction, sensitive-field flagging, and 12 graphql-cop misconfig checks
- Subdomain Takeover Detection -- three-engine layered scanner (Subjack + Nuclei takeover templates + BadDNS AGPL-3.0 sidecar) with cross-tool dedup, 12+ auto-exploitable providers, and confidence-scored verdicts
- VHost & SNI Enumeration -- finds hidden virtual hosts on every target IP by probing each candidate at both the HTTP Host header (L7) and the TLS SNI (L4); reveals admin panels, k8s ingress backends, staging environments, and proxy-routing inconsistencies that DNS doesn't expose
- Web Cache Poisoning -- active two-engine cache poisoning + deception scanner: the WCVS breadth sweep finds suspects across 10+ technique classes, then a RedAmon-native 5-phase confirmation engine re-proves each one with a safe baseline-poison-clean-persistence sequence using benign canaries and isolated cache buckets; reflected and non-reflective (differential) detection, confidence-scored findings written back as
cache_poisoningVulnerability nodes - TrafficMind -- AI-aware HTTP capture proxy that records all traffic from your recon tools and the AI agent, attributes each request to its source, and exposes the corpus to the operator and the agent
- proxy_brain -- the agent's code-native web-hacking tool over the captured corpus: it writes Python against the
redamonSDK (search / replay / fuzz / decode / JWT forge / race), and can drive a real browser to confirm DOM-based XSS and other post-JavaScript bugs - Attack Surface Graph -- Neo4j knowledge graph with 22 node types + EvoGraph evolutionary attack chain tracking
- Scan Timeline -- version history for the recon graph: keep each scan as an immutable snapshot, view or activate any past version, diff two scans field-by-field with Recon Delta (new/removed/changed/relationships/security lenses/graph overlay), and schedule scans to run automatically
- Recon Presets -- 21 built-in reconnaissance configurations plus AI-generated custom presets for instant project setup
- 245+ Project Settings — fine-grained control over every tool and behavior
- 400+ AI Models — support for 12 providers (OpenAI, Anthropic, Gemini, DeepSeek, GLM, Kimi, Qwen, xAI, Mistral, OpenRouter, Bedrock, OpenAI-Compatible) plus local models via Ollama, and a model of your choice for each AI feature (Models by feature)