swarmhack-cli 2.1.0 → 2.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +193 -25
  2. package/native/linux-x64/swarmhack +0 -0
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -2,22 +2,47 @@
2
2
 
3
3
  Neural swarm-based penetration testing framework.
4
4
 
5
- ## What's New in v2.0.0
6
-
7
- **v2.0.0 -- Major Release**
8
-
9
- - **Confidence Calibration System** -- Evidence-based confidence scoring (0.60-1.0) replacing fixed 1.0. Each finding's confidence reflects actual proof quality: heuristic detection (0.60), response pattern match (0.90), marker-based confirmation (0.99), synthesized from confirmed data (1.0).
10
- - **Full Kill Chain Automation** -- Single command executes: external web scan -> credential extraction -> SSH lateral movement -> privilege escalation -> SSH tunnel -> internal target scanning. Zero human intervention.
11
- - **Credential Correlation** -- 12 regex patterns extract credentials from HTML response bodies (SSH creds in admin pages, connection strings, API keys, Bearer tokens). Extracted creds automatically propagated via Intelligence Bus to SSH/auth agents.
12
- - **Privilege Escalation Chain Synthesis (ADR-009)** -- Post-processing creates standalone "www-data -> root" findings from CMDI post-exploitation data (sudo NOPASSWD, SUID binaries, Docker socket).
13
- - **.env File Deep Extraction** -- CMDI agent reads .env files via command injection, parses SSH/DB/API credentials with category classification (ssh_credential, database_credential, api_key, network_topology).
14
- - **Internal Tunnel Scanning (ADR-010)** -- After SSH pivot discovers dual-homed hosts, automatically opens SSH tunnel via portable-pty and spawns new kill chain against internal targets.
15
- - **SSRF CVE Correlation** -- 10-CVE payload map (CVE-2021-44224, ProxyLogon, Log4Shell, etc.). SSRF agent reads vulnerable_components findings and generates CVE-specific exploitation payloads.
16
- - **SQLi Time-Based Confirmation** -- 3-step verification: retry payload, send SLEEP(0) control, confirm only if retry delayed AND control fast. Eliminates jitter false positives.
17
- - **XXE Confidence Grading** -- Tiered confidence: heuristic-only (0.60), marker match (0.90), with deep exploitation output (1.0). OOB callback infrastructure ready (callback_url config).
18
- - **SONA Self-Learning (Phase 1)** -- Optional `--features self-learning` wires ruvector-sona for payload trajectory recording and adaptive recommendations.
19
- - **32 Exploit Agents** -- Added session_fixation, dangerous_methods, pivot, plus enhanced all ADR-003 agents with memory deduplication and Intelligence Bus integration.
20
- - **Smart Pivot Optimization** -- Port-scanned reachable hosts tried first, failed hosts skipped after timeout, SSH ConnectTimeout reduced to 3s for fast iteration.
5
+ ## What's New in v2.5.0
6
+
7
+ **v2.5.0 -- Multi-Target Campaign + Network Intelligence + Host Recon**
8
+
9
+ - **Multi-target campaigns** -- `--target-list` accepts comma-separated IPs, URLs, hostnames, and CIDR ranges. Scan entire networks in one command.
10
+ - **CIDR expansion** -- `--target-list 10.0.0.0/24` expands to 254 hosts automatically.
11
+ - **Campaign intelligence graph** -- Credentials found on Host A are automatically seeded to Host B (petgraph + DashMap property graph).
12
+ - **Unified OCSF report** -- Single `mission-*.json` with all targets' findings combined. Per-target reports moved to `reports/per-target/`.
13
+ - **Network attack path visualization** -- D3.js HTML showing all hosts as topology with device types, findings grouped per host, detail panel on click, intel flow bottom panel.
14
+ - **Host recon** -- Reverse DNS + HTTP banner + MAC vendor lookup. Device type classification: Router, Printer, NAS, IP Camera, Web Server.
15
+ - **Graceful unreachable skip** -- Offline hosts skipped with one-line message instead of verbose error. Prior scan data included in campaign report.
16
+ - **Default credential fallback** -- SMB/WinRM agents try vagrant:vagrant and other defaults when campaign creds fail on non-domain hosts.
17
+ - **Network agent findings fix** -- AD agent findings now included in OCSF report and CLI display (was silently dropped).
18
+ - **Quiet campaign mode** -- Per-target "MISSION COMPLETE" banners suppressed; single campaign summary shown.
19
+ - **49 regression tests** (was 37) across 15 categories.
20
+ - **GOAD assessment** -- Comprehensive mapping of 38 GOAD attack paths vs SwarmHack capabilities.
21
+ - **46 agents total** (23 web + 23 AD/network).
22
+
23
+ **v2.4.0 -- AD Data Quality + Mandatory Auth + External Tool Documentation**
24
+
25
+ - Mandatory Prancer Portal authentication (offline mode removed)
26
+ - AD finding categorization (CWE-307/521/522 → "authentication")
27
+ - Dynamic resource type from URL scheme
28
+ - Compliance mappings for AD CWEs
29
+ - LDIF base64 parsing, password policy guard, trust direction decoding
30
+ - Crown jewel dedup across merged findings
31
+ - External tool documentation (38 binaries)
32
+
33
+ **v2.1.0 -- Quality, OCSF Compliance & Service-Driven Discovery Foundation**
34
+
35
+ - **Agent Plugin Registry (ADR-011)** -- Scalable plugin system: adding a new agent is one file + one registry line. 26 plugins registered (23 legacy web agents + nmap scanner + FTP probe + SSH probe). Foundation for 100+ agents.
36
+ - **Nmap-First Port Discovery** -- Every mission starts with nmap port/service discovery (canonical entry point). Discovered services route to the correct agents automatically via ServiceRouter. Falls back to URL-based inference when nmap is unavailable.
37
+ - **FTP & SSH Probe Agents** -- New non-HTTP agents: FTP anonymous login + default credential testing, SSH banner analysis + weak version CVE detection. First protocol-aware agents beyond HTTP.
38
+ - **OCSF 1.1.0 Full Compliance** -- `type_uid` corrected to 600105, `severity_id` added at finding level, crown jewel deduplication by (category, value), findings sorted by generation ascending + risk_score descending.
39
+ - **Crown Jewel Sanitization** -- 5-rule system: short values always full, api_key never truncated, credential summaries up to 200 chars, session tokens format-preserving (`PHPSESSID=abcd...wxyz`), fallback 500-char cap.
40
+ - **False Positive Elimination** -- LFI agent filters PHP payloads on ASP.NET/IIS targets, IDOR agent no longer fabricates synthetic parameters, Default Credentials uses discovered form field names, CVE-2021-31166 version rule narrowed.
41
+ - **Risk Score Calibration** -- Info=1.0, Low=3.0, Medium=5.0, High=7.5, Critical=10.0 base scores. robots.txt now scores ~0.2 (was 0.9), SQLi auth bypass scores ~9.0 (was 5.63).
42
+ - **Security Fixes** -- Shell injection in askpass helper patched, TLS verification restored in file_upload/xxe agents, PII redaction in OCSF reports.
43
+ - **CI Pipeline** -- `cargo test` + `cargo clippy` now run on every push/PR (was build-only).
44
+ - **Version Banner** -- Uses `CARGO_PKG_VERSION` (no more hardcoded v1.0.0).
45
+ - **83 new regression tests** -- 46 for v2.1.0 quality fixes + 37 for ADR-011 Phase 1.
21
46
 
22
47
  ## Installation
23
48
 
@@ -51,13 +76,59 @@ SwarmHack includes a default configuration file (`config/swarmhack.yaml`) that i
51
76
 
52
77
  ## CLI Usage
53
78
 
79
+ ### Single Target
80
+
54
81
  ```bash
55
- # Run SQL injection scan (local mode - default)
56
- swarmhack spawn --agents sqli \
82
+ # Full kill chain scan
83
+ swarmhack spawn \
84
+ --target "http://example.com" \
85
+ --customer "your-customer" \
86
+ --token "your-token"
87
+
88
+ # Specific agents only
89
+ swarmhack spawn --agents sqli,xss,csrf \
57
90
  --target "http://example.com" \
58
91
  --customer "your-customer" \
59
92
  --token "your-token"
60
93
 
94
+ # AD domain controller scan
95
+ swarmhack spawn \
96
+ --target 192.168.56.10 \
97
+ --customer "your-customer" \
98
+ --token "your-token"
99
+ ```
100
+
101
+ ### Multi-Target Campaign (NEW in v2.5.0)
102
+
103
+ ```bash
104
+ # Scan multiple targets — credentials from Host A are shared with Host B
105
+ swarmhack spawn \
106
+ --target-list "192.168.56.10,192.168.56.11,10.0.0.1" \
107
+ --customer "your-customer" \
108
+ --token "your-token"
109
+
110
+ # Scan entire subnet (CIDR)
111
+ swarmhack spawn \
112
+ --target-list "10.0.0.0/24" \
113
+ --customer "your-customer" \
114
+ --token "your-token"
115
+
116
+ # Mixed targets: IPs + URLs + hostnames + CIDR
117
+ swarmhack spawn \
118
+ --target-list "192.168.56.10,https://app.corp.local,10.0.0.0/24" \
119
+ --customer "your-customer" \
120
+ --token "your-token"
121
+ ```
122
+
123
+ Campaign output:
124
+ - Unified `mission-*.json` with all findings across all targets
125
+ - `mission-*-attack-path.html` showing network topology with all hosts
126
+ - Per-target reports in `reports/per-target/`
127
+ - Unreachable hosts gracefully skipped
128
+
129
+ ### Docker Mode
130
+
131
+ ```bash
61
132
  # Run in Docker mode (isolated execution)
62
133
  swarmhack spawn --agents sqli \
63
134
  --target "http://example.com" \
@@ -161,7 +232,7 @@ If npm installation fails, use Docker:
161
232
  docker run --rm \
162
233
  -v /var/run/docker.sock:/var/run/docker.sock \
163
234
  -v $(pwd)/reports:/app/reports \
164
- prancer/swarmhack:2.0.0 \
235
+ prancer/swarmhack:2.5.0 \
165
236
  spawn --agents sqli --target "http://example.com" \
166
237
  --customer "your-customer" --token "your-token"
167
238
  ```
@@ -221,7 +292,7 @@ swarmhack spawn \
221
292
  - The `--header` flag is repeatable -- add as many custom headers as needed
222
293
  - All agents (SQLi, XSS, CSRF, etc.) automatically include your custom headers in every request
223
294
 
224
- ## Available Agents (32)
295
+ ## Available Agents (46)
225
296
 
226
297
  | Agent | CWE | Description |
227
298
  |-------|-----|-------------|
@@ -250,26 +321,72 @@ swarmhack spawn \
250
321
  | `vulnerable_components` | CWE-1035 | Version fingerprinting + CVE lookup (30 CVEs) |
251
322
  | `pivot` | — | SSH lateral movement, tunnel scanning, credential reuse |
252
323
  | `idor` (enhanced) | CWE-639 | Object reference enumeration with credential correlation |
324
+ | `nmap_scanner` | — | Port discovery, service detection, NSE vulnerability scanning |
325
+ | `ftp_probe` | CWE-287 | FTP anonymous login, default credentials, banner analysis |
326
+ | `ssh_probe` | CWE-327 | SSH banner analysis, weak version CVE detection |
327
+ | `ldap_enum` | CWE-284 | AD enumeration (10 categories: users, SPNs, delegation, trusts, policy) |
328
+ | `ldap_spray` | CWE-307 | LDAP password spray with lockout-safe threshold detection |
329
+ | `kerberos_attack` | CWE-522 | AS-REP roasting + Kerberoasting (TGS hash extraction) |
330
+ | `smb_enum` | CWE-200 | SMB null session, signing check, GPP password scraping |
331
+ | `mssql_probe` | CWE-798 | MSSQL default credentials, linked servers, xp_cmdshell |
332
+ | `dcsync` | CWE-522 | DCSync credential extraction via secretsdump |
333
+ | `winrm_probe` | CWE-287 | WinRM lateral movement via evil-winrm/crackmapexec |
334
+ | `ntlm_capture` | CWE-522 | NTLM hash capture via Responder (opt-in) |
335
+ | `acl_abuse` | CWE-284 | BloodHound-style ACL path discovery and exploitation |
336
+ | `hash_crack` | CWE-521 | Offline hash cracking with feedback loop |
337
+ | `pth_agent` | CWE-522 | Pass-the-Hash lateral movement via impacket |
338
+ | `cred_dump` | CWE-522 | SAM/LSA credential dumping |
339
+ | `adcs_exploit` | CWE-295 | ADCS ESC1-ESC15 certificate abuse via certipy |
340
+ | `delegation_exploit` | CWE-284 | Constrained/RBCD/unconstrained Kerberos delegation |
341
+ | `laps_reader` | CWE-522 | LAPS local admin password extraction |
342
+ | `shadow_creds` | CWE-284 | Shadow credentials via pywhisker/certipy |
343
+ | `gpo_abuse` | CWE-284 | GPO modification for scheduled task deployment |
344
+ | `trust_exploit` | CWE-200 | Cross-forest SID History exploitation |
345
+ | `gmsa_reader` | CWE-522 | gMSA service account password reading |
346
+ | `auth_coercion` | CWE-287 | PrinterBug/PetitPotam authentication coercion |
253
347
 
254
348
  ## OCSF Reports
255
349
 
256
- SwarmHack generates reports in [OCSF 1.1.0](https://schema.ocsf.io/) format, the industry standard for security findings:
350
+ SwarmHack generates reports in [OCSF 1.1.0](https://schema.ocsf.io/) format, the industry standard for security findings.
257
351
 
352
+ **Single target:**
258
353
  ```json
259
354
  {
260
355
  "scan_info": {
261
356
  "scanner": { "name": "SwarmHack", "vendor": "Prancer" },
262
357
  "customer": "your-customer",
263
358
  "target": "http://example.com",
264
- "duration_formatted": "3m 11s",
265
- "summary": { "findings_count": 5, "crown_jewels_count": 12 }
359
+ "summary": { "findings_count": 9, "crown_jewels_count": 23 }
266
360
  },
267
- "class_name": "Vulnerability Finding",
268
- "class_uid": 6001,
361
+ "compliance_summary": { "frameworks_covered": ["PCI-DSS 4.0", "OWASP Top 10", "NIST CSF 2.0", ...] },
269
362
  "findings": [...]
270
363
  }
271
364
  ```
272
365
 
366
+ **Multi-target campaign:**
367
+ ```json
368
+ {
369
+ "scan_info": {
370
+ "mission_type": "multi-target",
371
+ "targets_scanned": 4,
372
+ "targets_total": 5,
373
+ "summary": { "findings_count": 20, "crown_jewels_count": 28 },
374
+ "per_target": [
375
+ { "target": "http://192.168.56.10/", "findings_count": 6, "crown_jewels_count": 4 },
376
+ { "target": "https://demo.testfire.net/", "findings_count": 7, "crown_jewels_count": 22 }
377
+ ]
378
+ },
379
+ "findings": [/* all findings from all targets combined */]
380
+ }
381
+ ```
382
+
383
+ Each finding includes:
384
+ - Severity + risk score + confidence
385
+ - CWE classification + MITRE ATT&CK mapping
386
+ - Compliance mappings (PCI-DSS, OWASP, NIST, SOC2, HIPAA, ISO 27001, DORA, NIS2)
387
+ - Crown jewels (extracted credentials, hashes, sensitive data)
388
+ - Device type identification (Router, Printer, NAS, etc.)
389
+
273
390
  ## Authentication
274
391
 
275
392
  SwarmHack requires Prancer Portal authentication:
@@ -291,6 +408,57 @@ Get your token from [Prancer Portal](https://portal.prancer.io) → Settings →
291
408
 
292
409
  ## Changelog
293
410
 
411
+ ### v2.5.0
412
+ - **Multi-target campaigns**: `--target-list` with comma-separated IPs, URLs, hostnames, CIDR ranges
413
+ - **CIDR expansion**: `10.0.0.0/24` → 254 hosts, up to /16 supported
414
+ - **Campaign intelligence graph**: credentials from Host A seed Host B (petgraph + DashMap)
415
+ - **Unified OCSF report**: single mission-*.json with all targets combined
416
+ - **Network attack path visualization**: D3.js HTML with host topology, device types, detail panel, intel flow
417
+ - **Host recon**: reverse DNS + HTTP banner + MAC vendor → device type classification
418
+ - **Graceful unreachable skip**: offline hosts skipped cleanly, prior scan data included
419
+ - **Default credential fallback**: SMB/WinRM try vagrant:vagrant when null session/campaign creds fail
420
+ - **Network agent findings fix**: AD findings now in report + CLI display (was silently dropped)
421
+ - **Quiet campaign mode**: per-target banners suppressed, single summary shown
422
+ - 49 regression tests across 15 categories
423
+ - GOAD lab assessment: 38 attack paths mapped vs SwarmHack capabilities
424
+ - Validated: 5-target campaign = 20 findings, 28 crown jewels
425
+
426
+ ### v2.4.0
427
+ - **BREAKING**: Mandatory Prancer Portal authentication — offline mode removed
428
+ - AD finding category mapping: CWE-307/521/522 → "authentication", CWE-200 → "reconnaissance"
429
+ - Dynamic affected_resource.type from URL scheme (Directory Service, Kerberos KDC, SMB File Share)
430
+ - Compliance mappings for AD CWEs (OWASP A07:2021, PCI-DSS 8.3.6, NIST PR.AA-01)
431
+ - LDIF base64 attribute parsing, empty password policy guard, trust direction decoding
432
+ - Crown jewel dedup across merged findings, masked value filtering
433
+ - 37 quality regression tests (was 25)
434
+ - External tool documentation: 38 binaries fully documented with install instructions
435
+
436
+ ### v2.3.0
437
+ - Full AD exploitation pipeline: 23 new network/AD agents (LDAP, Kerberos, SMB, MSSQL, DCSync, WinRM, NTLM, ACL, ADCS, delegation, LAPS, shadow creds, GPO, trust)
438
+ - 6-pass AD kill chain: Discovery → Spray → Kerberoast → Exploit → Lateral → Dominate
439
+ - Credential chaining via shared memory (spray → Kerberoast → lateral movement)
440
+ - Blackbox DC discovery: rootDSE + DNS reverse + NetBIOS
441
+ - OCSF compliance mapping for 8 frameworks (ADR-012)
442
+ - D3.js attack path visualization (ADR-013)
443
+ - GOAD lab validated: hodor:hodor credential + tyron.lannister TGS hash extracted
444
+ - Agent plugin registry with define_plugin! macro (46 plugins total)
445
+ - Bare IP/hostname target support (auto-prepend http://)
446
+ - TCP connectivity fallback for non-HTTP targets
447
+
448
+ ### v2.1.0
449
+ - Agent plugin registry (ADR-011): scalable plugin system for 100+ agents (one file + one registry line per agent)
450
+ - Nmap-first port discovery: canonical entry point, automatic service-to-agent routing
451
+ - FTP probe agent: anonymous login, default credential testing, banner analysis
452
+ - SSH probe agent: banner analysis, weak version CVE detection
453
+ - OCSF 1.1.0 compliance: type_uid=600105, severity_id at finding level, crown jewel dedup, finding sort order
454
+ - Crown jewel sanitization: 5-rule system (api_key never truncated, format-preserving session tokens)
455
+ - False positive elimination: LFI tech-stack filter, IDOR no synthetic params, default creds uses discovered form fields, CVE-2021-31166 narrowed
456
+ - Risk score calibration: Info=1.0, Low=3.0, Medium=5.0, High=7.5, Critical=10.0
457
+ - Security fixes: shell injection in askpass, TLS verification restored, PII redaction in reports
458
+ - CI pipeline: cargo test + cargo clippy (was build-only)
459
+ - 83 new regression tests (46 quality fixes + 37 ADR-011 Phase 1)
460
+ - 35 exploit agents (was 32): added nmap_scanner, ftp_probe, ssh_probe
461
+
294
462
  ### v2.0.0
295
463
  - Confidence calibration system: evidence-based scoring (0.60-1.0) replacing fixed 1.0
296
464
  - Full kill chain automation: web scan -> credential extraction -> SSH pivot -> privilege escalation -> internal scanning
package/native/linux-x64/swarmhack CHANGED
Binary file
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "swarmhack-cli",
3
- "version": "2.1.0",
3
+ "version": "2.3.1",
4
4
  "description": "SwarmHack - Neural swarm-based penetration testing framework",
5
5
  "author": "Prancer <support@prancer.io>",
6
6
  "license": "MIT",