Project Settings Reference
Every project in RedAmon has 190+ configurable parameters that control the behavior of each reconnaissance module, the AI agent, and CypherFix automated remediation. These settings are managed through the project form UI (15 tabs across four groups: Scope, Recon Pipeline, AI Agent, Remediation), stored in PostgreSQL, and fetched by the recon container and agent at runtime.
Defaults: Sensible defaults are loaded automatically from the server when creating a new project. You only need to fill in the required fields (project name and target domain — or target IPs in IP mode) and adjust what you want.
- Target Configuration
- Scan Module Toggles
- Port Scanner (Naabu)
- HTTP Prober (httpx)
- Technology Detection (Wappalyzer)
- Banner Grabbing
- Web Crawler (Katana)
- Passive URL Discovery (GAU)
- API Discovery (Kiterunner)
- Web Crawler (Hakrawler)
- JavaScript Analysis (jsluice)
- Vulnerability Scanner (Nuclei)
- CVE Enrichment
- MITRE Mapping
- Security Checks
- GVM Vulnerability Scan
- Subdomain Discovery
- URLScan.io Enrichment
- Shodan OSINT Enrichment
- GitHub Secret Hunting
- Agent Behavior
- Hydra Brute Force
- Phishing / Social Engineering
- CypherFix Configuration
- Tool Phase Restrictions
| Parameter | Default | Description |
|---|---|---|
| Start from IP (IP Mode) | false | Toggle between domain mode and IP/CIDR targeting mode. Locked after project creation. When enabled, hides domain fields and shows IP/CIDR input |
| Target Domain | — | The root domain to assess (required in domain mode, hidden in IP mode) |
| Target IPs / CIDRs | [] | IP addresses and CIDR ranges to scan (IP mode only). Accepts IPv4, IPv6, and CIDR notation up to /24 (256 hosts) |
| Subdomain List | [] | Specific subdomain prefixes to scan (empty = discover all). Domain mode only |
| Verify Domain Ownership | false | Require DNS TXT record proof before scanning. Domain mode only |
| Ownership Token | (auto) | Unique token for TXT record verification |
| Ownership TXT Prefix | _redamon |
DNS record name prefix |
| Stealth Mode | false | Forces passive-only techniques — disables active scanning, brute force, and GVM |
| Use Tor | false | Route all recon traffic through the Tor network |
| Use Bruteforce | true | Enable Knockpy active subdomain bruteforcing. Domain mode only |
Modules can be individually enabled/disabled with automatic dependency resolution — disabling a parent module automatically disables all children:
domain_discovery (root)
└── port_scan
└── http_probe
├── resource_enum
└── vuln_scan
| Parameter | Default | Description |
|---|---|---|
| Scan Modules | all enabled | Array of phases to execute |
| Update Graph DB | true | Auto-import results into Neo4j |
| WHOIS Max Retries | 3 | Retry attempts for WHOIS lookups |
| DNS Max Retries | 3 | Retry attempts for DNS resolution |
Controls how ports are discovered on target hosts.
| Parameter | Default | Description |
|---|---|---|
| Top Ports | 1000 | Port selection: 100, 1000, or custom |
| Custom Ports | — | Manual port range (e.g., 80,443,8080-8090) |
| Scan Type | SYN | SYN (fast, requires root) or CONNECT (slower, no root needed) |
| Rate Limit | 1000 | Packets per second |
| Threads | 25 | Parallel scanning threads |
| Timeout | 10000 | Per-port timeout in milliseconds |
| Retries | 3 | Retry attempts for unresponsive ports |
| Exclude CDN | true | Skip CDN-hosted IPs (Cloudflare, Akamai, etc.) |
| Display CDN | true | Show CDN info but don't scan deeper |
| Skip Host Discovery | false | Skip ping-based host check |
| Verify Ports | false | Double-check ports with TCP handshake |
| Passive Mode | false | Use Shodan InternetDB instead of active scanning (zero packets) |
Controls what metadata is extracted from live HTTP services.
Connection Settings:
| Parameter | Default | Description |
|---|---|---|
| Threads | 50 | Concurrent HTTP probes |
| Timeout | 15 | Request timeout (seconds) |
| Retries | 0 | Retry attempts for failed requests |
| Rate Limit | 150 | Requests per second |
| Follow Redirects | true | Follow HTTP redirects |
| Max Redirects | 10 | Maximum redirect chain depth |
Probe Toggles (each individually enabled/disabled):
| Probe | Default | Description |
|---|---|---|
| Status Code | true | HTTP response status code |
| Content Length | true | Response body size |
| Content Type | true | MIME type of response |
| Title | true | HTML page title |
| Server | true | Server header value |
| Response Time | true | Time to first byte |
| Word Count | true | Number of words in response |
| Line Count | true | Number of lines in response |
| Tech Detect | true | Built-in technology fingerprinting |
| IP | true | Resolved IP address |
| CNAME | true | CNAME DNS records |
| TLS Info | true | TLS certificate details |
| TLS Grab | true | Full TLS handshake data |
| Favicon | false | Favicon hash (for fingerprinting) |
| JARM | false | JARM TLS fingerprint |
| ASN | true | Autonomous System Number |
| CDN | true | CDN provider detection |
| Response Hash | — | Hash algorithm for response body |
| Include Response | false | Include full response body |
| Include Response Headers | false | Include all response headers |
Filtering:
| Parameter | Default | Description |
|---|---|---|
| Paths | [] | Additional paths to probe on each host |
| Custom Headers | [] | Extra headers to send with requests |
| Match Codes | [] | Only keep responses with these status codes |
| Filter Codes | [] | Exclude responses with these status codes |
Second-pass technology fingerprinting engine with 6,000+ fingerprints.
| Parameter | Default | Description |
|---|---|---|
| Enabled | true | Master toggle for Wappalyzer |
| Min Confidence | 50 | Minimum detection confidence (0-100%) |
| Require HTML | false | Only fingerprint responses with HTML content |
| Auto Update | true | Update fingerprint database from npm |
| NPM Version | 6.10.56 | Wappalyzer npm package version |
| Cache TTL (hours) | 24 | How long to cache fingerprint data |
Raw socket banner extraction for non-HTTP services.
| Parameter | Default | Description |
|---|---|---|
| Enabled | true | Master toggle for banner grabbing |
| Timeout | 5 | Connection timeout (seconds) |
| Threads | 10 | Concurrent banner grab connections |
| Max Length | 1024 | Maximum banner size (bytes) |
Active web crawling for endpoint and parameter discovery.
| Parameter | Default | Description |
|---|---|---|
| Enable Katana | true | Master toggle for active web crawling |
| Crawl Depth | 2 | How many links deep to follow (1-10). Each level adds ~50% time |
| Max URLs | 300 | Maximum URLs to collect per domain. 300: ~1-2 min/domain, 1000+: scales linearly |
| Rate Limit | 50 | Requests per second |
| Timeout | 3600 | Overall crawl timeout in seconds (default: 60 minutes) |
| JavaScript Crawling | false | Parse JS files with headless browser (+50-100% time) |
| Parameters Only | false | Only keep URLs with query parameters for DAST fuzzing |
| Exclude Patterns | [100+ patterns] | URL patterns to skip — static assets, images, CDN URLs |
| Custom Headers | [] | Browser-like headers to avoid detection |
Passive URL discovery from web archives and threat intelligence sources.
| Parameter | Default | Description |
|---|---|---|
| Enable GAU | false | Master toggle for passive URL discovery |
| Providers | wayback, commoncrawl, otx, urlscan | Data sources for archived URLs |
| Max URLs | 1000 | Maximum URLs per domain (0 = unlimited) |
| Timeout | 60 | Request timeout per provider (seconds) |
| Threads | 5 | Parallel fetch threads (1-20) |
| Year Range | [] | Filter Wayback by year (e.g., "2020, 2024"). Empty = all |
| Verbose Output | false | Detailed logging |
| Blacklist Extensions | [png, jpg, css, pdf, zip, ...] | File extensions to exclude |
URL Verification (when enabled, GAU confirms URLs are still live):
| Parameter | Default | Description |
|---|---|---|
| Verify URLs | false | HTTP check on archived URLs |
| Verify Timeout | 5 | Seconds per URL check |
| Verify Rate Limit | 100 | Verification requests per second |
| Verify Threads | 50 | Concurrent verification threads (1-100) |
| Accept Status Codes | [200, 201, 301, ...] | Status codes indicating a live URL |
| Filter Dead Endpoints | true | Exclude 404/500/timeout URLs |
HTTP Method Detection (when verification is enabled):
| Parameter | Default | Description |
|---|---|---|
| Detect Methods | false | Send OPTIONS to discover allowed methods |
| Method Detect Timeout | 5 | Seconds per OPTIONS request |
| Method Detect Rate Limit | 50 | Requests per second |
| Method Detect Threads | 25 | Concurrent threads |
API endpoint brute-forcing using real-world Swagger/OpenAPI wordlists.
| Parameter | Default | Description |
|---|---|---|
| Enable Kiterunner | true | Master toggle for API brute-forcing |
| Wordlist | routes-large |
routes-large (~100k, 10-30 min) or routes-small (~20k, 5-10 min) |
| Rate Limit | 100 | Requests per second |
| Connections | 100 | Concurrent connections per target |
| Timeout | 10 | Per-request timeout (seconds) |
| Scan Timeout | 1000 | Overall scan timeout (seconds) |
| Threads | 50 | Parallel scanning threads |
| Min Content Length | 0 | Ignore responses smaller than this (bytes) |
Status Code Filters:
| Parameter | Default | Description |
|---|---|---|
| Ignore Status Codes | [] | Blacklist: filter out noise (e.g., 404, 500) |
| Match Status Codes | [200, 201, ...] | Whitelist: only keep these codes. Includes 401/403 |
| Custom Headers | [] | For authenticated API scanning |
Method Detection:
| Parameter | Default | Description |
|---|---|---|
| Detect Methods | true | Find POST/PUT/DELETE methods beyond GET |
| Detection Mode | bruteforce |
bruteforce (slower, more accurate) or options (faster) |
| Bruteforce Methods | POST, PUT, DELETE, PATCH | Methods to try in bruteforce mode |
| Method Detect Timeout | 5 | Seconds per request |
| Method Detect Rate Limit | 50 | Requests per second |
| Method Detect Threads | 25 | Concurrent threads |
Hakrawler is a DOM-aware web crawler that runs as a Docker container alongside Katana. It provides an additional crawling perspective with scope-aware link following.
| Parameter | Default | Description |
|---|---|---|
| Enable Hakrawler | true | Master toggle for Hakrawler crawling |
| Docker Image | jauderho/hakrawler:latest | Docker image to use |
| Crawl Depth | 2 | How many links deep to follow (1-10) |
| Threads | 5 | Concurrent crawling threads |
| Per-URL Timeout | 30 | Timeout per URL in seconds |
| Max URLs | 500 | Maximum URLs to discover |
| Include Subdomains | true | Allow crawler to follow links to subdomains. Results are still scope-filtered |
| Skip TLS Verify | true | Skip TLS certificate verification |
| Custom Headers | [] | Custom HTTP headers for requests |
Stealth mode: Hakrawler is automatically disabled in stealth mode to reduce the active crawling footprint.
jsluice is a passive JavaScript analysis tool compiled into the recon container. It analyzes JS files discovered by Katana/Hakrawler to extract hidden URLs, API endpoints, and embedded secrets.
| Parameter | Default | Description |
|---|---|---|
| Enable jsluice | true | Master toggle for JavaScript analysis |
| Max Files | 50 | Maximum number of JS files to analyze |
| Timeout | 120 | Overall analysis timeout in seconds |
| Concurrency | 5 | Files to process concurrently |
| Extract URLs | true | Extract URLs and API endpoints from JS |
| Extract Secrets | true | Detect API keys, tokens, and credentials |
Note: jsluice is passive — it downloads JS files already discovered by crawlers and analyzes them locally. No additional crawling or scanning traffic is generated.
Template-based vulnerability scanning with 9,000+ community templates.
Performance Settings:
| Parameter | Default | Description |
|---|---|---|
| Severity Levels | critical, high, medium, low, info | Severity filter. Excluding "info" is ~70% faster |
| Rate Limit | 100 | Requests per second |
| Bulk Size | 25 | Hosts processed in parallel |
| Concurrency | 25 | Templates executed in parallel |
| Timeout | 10 | Request timeout per check (seconds) |
| Retries | 1 | Retry attempts for failed requests (0-10) |
| Max Redirects | 10 | Maximum redirect chain (0-50) |
Template Configuration:
| Parameter | Default | Description |
|---|---|---|
| Template Folders | [] | Directories to include (cves, vulnerabilities, misconfiguration, exposures, etc.). Empty = all |
| Exclude Template Paths | [] | Exclude specific directories or files |
| Custom Template Paths | [] | Your own templates in addition to the official repo |
| Include Tags | [] | Filter by tags: cve, xss, sqli, rce, lfi, ssrf, xxe, ssti. Empty = all |
| Exclude Tags | [] | Exclude tags — recommended: dos, fuzz for production |
Template Options:
| Parameter | Default | Description |
|---|---|---|
| Auto Update Templates | true | Download latest before scan (+10-30 seconds) |
| New Templates Only | false | Only run templates added since last update |
| DAST Mode | true | Active fuzzing for XSS, SQLi, RCE (+50-100% time) |
Advanced Options:
| Parameter | Default | Description |
|---|---|---|
| Headless Mode | false | Use headless browser for JS pages (+100-200% time) |
| System DNS Resolvers | false | Use OS DNS instead of Nuclei defaults |
| Interactsh | true | Blind vulnerability detection via out-of-band callbacks |
| Follow Redirects | true | Follow HTTP redirects during scanning |
| Scan All IPs | false | Scan all resolved IPs, not just hostnames |
Enrich findings with CVSS scores, descriptions, and references.
| Parameter | Default | Description |
|---|---|---|
| Enable CVE Lookup | true | Master toggle |
| CVE Source | nvd | Data source: nvd or vulners
|
| Max CVEs per Finding | 20 | Maximum entries per technology (1-100) |
| Min CVSS Score | 0 | Only include CVEs at or above this score (0-10) |
| NVD API Key | — | Free key from nist.gov — ~80x faster with key |
| Vulners API Key | — | Key for Vulners data source |
CWE/CAPEC enrichment of CVE findings.
| Parameter | Default | Description |
|---|---|---|
| Auto Update DB | true | Auto-update CWE/CAPEC database |
| Include CWE | true | Map CVEs to CWE weaknesses |
| Include CAPEC | true | Map CWEs to CAPEC attack patterns |
| Enrich Recon CVEs | true | Enrich CVEs from reconnaissance |
| Enrich GVM CVEs | true | Enrich CVEs from GVM scans |
| Cache TTL (hours) | 24 | Database cache duration |
25+ individual toggle-controlled checks grouped into six categories. Each check creates a Vulnerability node in the graph if the condition is detected.
Global Settings:
| Parameter | Default | Description |
|---|---|---|
| Enable Security Checks | true | Master toggle for all checks |
| Timeout | 10 | Per-check timeout (seconds) |
| Max Workers | 10 | Concurrent check threads |
Network Exposure:
| Check | Default | Description |
|---|---|---|
| Direct IP HTTP | true | HTTP accessible via IP address |
| Direct IP HTTPS | true | HTTPS accessible via IP address |
| IP API Exposed | true | API endpoints accessible via IP |
| WAF Bypass | true | WAF can be bypassed via direct IP |
TLS/Certificate:
| Check | Default | Description |
|---|---|---|
| TLS Expiring Soon | true | Certificate expires within configurable days |
| TLS Expiry Days | 30 | Days before expiry to trigger warning |
Security Headers:
| Check | Default | Description |
|---|---|---|
| Missing Referrer-Policy | true | No Referrer-Policy header |
| Missing Permissions-Policy | true | No Permissions-Policy header |
| Missing COOP | true | No Cross-Origin-Opener-Policy |
| Missing CORP | true | No Cross-Origin-Resource-Policy |
| Missing COEP | true | No Cross-Origin-Embedder-Policy |
| Cache-Control Missing | true | No Cache-Control header |
| CSP Unsafe Inline | true | Content-Security-Policy allows unsafe-inline |
Authentication:
| Check | Default | Description |
|---|---|---|
| Login No HTTPS | true | Login form served over HTTP |
| Session No Secure | true | Session cookie missing Secure flag |
| Session No HttpOnly | true | Session cookie missing HttpOnly flag |
| Basic Auth No TLS | true | Basic Authentication without TLS |
DNS Security:
| Check | Default | Description |
|---|---|---|
| SPF Missing | true | No SPF record for the domain |
| DMARC Missing | true | No DMARC record |
| DNSSEC Missing | true | DNSSEC not configured |
| Zone Transfer | true | DNS zone transfer allowed |
Exposed Services:
| Check | Default | Description |
|---|---|---|
| Admin Port Exposed | true | Administrative ports publicly accessible |
| Database Exposed | true | Database ports publicly accessible |
| Redis No Auth | true | Redis accessible without authentication |
| Kubernetes API Exposed | true | Kubernetes API publicly accessible |
| SMTP Open Relay | true | SMTP server allows open relay |
Application:
| Check | Default | Description |
|---|---|---|
| Insecure Form Action | true | Form submits over HTTP |
| No Rate Limiting | true | No rate limiting detected on endpoints |
Configure GVM/OpenVAS network-level scanning.
Scan Configuration:
| Parameter | Default | Description |
|---|---|---|
| Scan Profile | Full and fast | GVM scan preset — see GVM Vulnerability Scanning for all 7 profiles |
| Scan Targets Strategy | both |
both (IPs + hostnames), ips_only, or hostnames_only
|
Timeouts & Polling:
| Parameter | Default | Description |
|---|---|---|
| Task Timeout | 14400 | Maximum seconds per scan task (4 hours). 0 = unlimited |
| Poll Interval | 5 | Seconds between status checks (5-300) |
Post-Scan:
| Parameter | Default | Description |
|---|---|---|
| Cleanup After Scan | true | Remove targets/tasks from GVM after results are extracted |
Configure passive and active subdomain enumeration. Located in the Discovery & OSINT tab.
Each passive source has an enabled toggle and a max results cap. All sources run in parallel and results are merged and deduplicated. After merging, Puredns validates the combined list against public DNS resolvers to remove wildcard and DNS-poisoned entries before DNS resolution proceeds.
| Parameter | Default | Description |
|---|---|---|
| crt.sh | enabled, max 5000 | Certificate Transparency log queries for subdomain discovery |
| HackerTarget | enabled, max 5000 | Passive DNS lookup database |
| Subfinder | enabled, max 5000 | Passive enumeration using 50+ online sources (CT logs, DNS databases, web archives). Runs via Docker (projectdiscovery/subfinder). No API key required |
| Amass | disabled, max 5000 | OWASP Amass subdomain enumeration using 50+ data sources (certificate logs, DNS databases, web archives, WHOIS). Runs via Docker (caffix/amass). No API key required for passive mode |
| Amass Timeout | 10 | Enumeration timeout in minutes (1-120) |
| Amass Active Mode | false | Enable zone transfers and certificate name grabs — sends DNS queries directly to target. Forced off in stealth mode |
| Amass Bruteforce | false | DNS brute forcing after passive enumeration — significantly increases scan time. Forced off in stealth mode |
| Knockpy Recon | enabled, max 5000 | Passive wordlist-based subdomain enumeration |
| Use Bruteforce | true | Enable Knockpy active subdomain brute-forcing. Domain mode only |
| Puredns Wildcard Filtering | enabled | Validates discovered subdomains against public DNS resolvers and removes wildcard entries and DNS-poisoned results. Runs after all discovery tools complete, before DNS resolution. Active tool — sends DNS queries. Runs via Docker (frost19k/puredns). Disabled in stealth mode |
| Puredns Threads | 0 | Parallel resolution threads (0 = auto-detect) |
| Puredns Rate Limit | 0 | DNS queries per second (0 = unlimited). Capped by RoE global rate limit when enabled |
| WHOIS Max Retries | 3 | Retry attempts for WHOIS lookups |
| DNS Max Retries | 3 | Retry attempts for DNS resolution |
Passive OSINT enrichment using URLScan.io historical scan data. Runs in the recon pipeline after domain discovery and before port scanning. Located in the Discovery & OSINT tab.
| Parameter | Default | Description |
|---|---|---|
| URLScan Enabled | false | Master toggle for URLScan.io enrichment |
| Max Results | 500 | Maximum scan results to fetch per domain (1-10000) |
API Key: Optional. Configure in Global Settings → Tool API Keys. Without an API key, only public scan results are available with lower rate limits. With a key, you get access to private scans and higher rate limits.
Graph nodes created/enriched: Domain, Subdomain, IP, Endpoint, Parameter, ExternalDomain. URL paths from historical scans are parsed into Endpoint and Parameter nodes. External domains encountered in scans are tracked as ExternalDomain nodes for situational awareness.
GAU deduplication: When URLScan enrichment runs successfully, the urlscan provider is automatically removed from GAU's data sources to avoid redundant API calls.
Passive internet-wide OSINT enrichment using the Shodan REST API. Runs in the recon pipeline after domain/IP discovery and before port scanning. Located in the Discovery & OSINT tab. Each feature is independently toggled and all require a Shodan API key set in Global Settings.
API Key Required: All toggles are disabled until a Shodan API key is configured in Global Settings. Host Lookup, Reverse DNS, and Passive CVEs automatically fall back to the free InternetDB API when the paid Shodan API returns 403. Domain DNS requires a paid Shodan plan (no free fallback).
| Parameter | Default | Description |
|---|---|---|
| Host Lookup | false | Query each discovered IP for OS, ISP, organization, geolocation, and known vulnerabilities. Uses /shodan/host/{ip} (paid plan: full banners, geo, services) or falls back to InternetDB (free: ports, hostnames, CPEs, CVEs, tags — no geo or banners) |
| Reverse DNS | false | Discover hostnames for known IPs. Uses /dns/reverse (paid) or falls back to InternetDB hostnames (free). Can reveal subdomains missed by standard enumeration |
| Domain DNS | false | Subdomain enumeration and DNS records via /dns/domain/{domain}. Requires paid Shodan plan — no free fallback. Domain mode only (skipped in IP mode) |
| Passive CVEs | false | Extract known CVEs associated with discovered IPs. Reuses Host Lookup data if available; otherwise queries InternetDB directly (free, no key needed) |
Graph nodes created/enriched: IP (os, isp, organization, country, city), Service, Subdomain, DNSRecord, Vulnerability, CVE. All use MERGE-based deduplication — data from Shodan is automatically merged with findings from Naabu, Nuclei, and other tools. Port discovery is handled by Naabu (not duplicated by Shodan enrichment).
Configure GitHub repository scanning for leaked credentials.
| Parameter | Default | Description |
|---|---|---|
| GitHub Access Token | — | Personal Access Token (ghp_...) |
| Target Organization | — | GitHub org or username to scan |
| Target Repositories | (all) | Comma-separated repo names to limit scope |
| Scan Member Repositories | false | Include individual member repos |
| Scan Gists | false | Search gists for secrets |
| Scan Commits | false | Examine git history for removed secrets |
| Max Commits to Scan | 100 | Max commits per repo (1-1000) |
| Output as JSON | false | Save results as downloadable JSON |
See GitHub Secret Hunting for a step-by-step setup guide including how to create a GitHub Personal Access Token.
Configure the AI agent orchestrator for autonomous pentesting.
LLM & Phase Configuration:
| Parameter | Default | Description |
|---|---|---|
| Guardrail Enabled | true | Enable/disable the LLM-based scope guardrail that verifies the target on agent startup. When disabled, the agent skips scope verification. Fail-closed: if the check itself fails, the agent is blocked |
| LLM Model | claude-opus-4-6 | AI model for the agent. 400+ models from 5 providers — see AI Model Providers |
| Deep Think | true | When enabled, the agent performs an explicit deep reasoning step at key decision points (start of session, phase transitions, failure loops) to plan multi-step attack strategies before acting. Adds ~1 extra LLM call at these moments. Recommended for complex targets with multiple services. |
| Post-Exploitation Type | statefull |
statefull (Meterpreter sessions) or stateless (one-shot commands) |
| Activate Post-Exploitation Phase | true | Whether post-exploitation is available |
| Informational Phase System Prompt | — | Custom instructions for the informational phase |
| Exploitation Phase System Prompt | — | Custom instructions for the exploitation phase |
| Post-Exploitation Phase System Prompt | — | Custom instructions for the post-exploitation phase |
Payload Direction:
| Parameter | Default | Description |
|---|---|---|
| Tunnel Provider | None | Dropdown: None (manual LHOST/LPORT), ngrok (single port — free, no VPS), or chisel (multi-port — requires VPS). Only one tunnel can be active at a time. ngrok tunnels port 4444 only, requires the ngrok authtoken configured in Global Settings → Tunneling, auto-detects LHOST/LPORT from the ngrok public URL, stageless payloads only. Requires identity verification on your ngrok account (free). chisel tunnels ports 4444 + 8080, requires Chisel Server URL (and optionally Chisel Auth) configured in Global Settings → Tunneling, enables web delivery and HTA delivery (which need two ports), stageless payloads required (staged payloads fail through the tunnel). Requires a VPS running chisel server -p 9090 --reverse. See AI Agent Guide — Tunnel Providers for setup instructions. |
| LHOST (Attacker IP) | — | Your IP for reverse shell callbacks. Leave empty for bind mode. Hidden when a tunnel provider is enabled. |
| LPORT | — | Listening port for reverse shells. Leave empty for bind mode. Hidden when a tunnel provider is enabled. |
| Bind Port on Target | — | Port the target opens for bind shell payloads |
| Payload Use HTTPS | false | Use reverse_https instead of reverse_tcp
|
Agent Limits:
| Parameter | Default | Description |
|---|---|---|
| Max Iterations | 100 | Maximum LLM reasoning-action loops per objective |
| Trace Memory Steps | 100 | Past steps kept in agent's working context |
| Tool Output Max Chars | 20000 | Truncation limit for tool output (min: 1000) |
Approval Gates:
| Parameter | Default | Description |
|---|---|---|
| Require Approval for Exploitation | true | User confirmation before exploitation phase |
| Require Approval for Post-Exploitation | true | User confirmation before post-exploitation phase |
Kali Shell — Library Installation:
| Parameter | Default | Description |
|---|---|---|
| Allow Library Installation | false | Let the agent install packages (pip/apt) via kali_shell at runtime. Prompt-based control only — no server-side enforcement. Installed packages are ephemeral (lost on container restart). |
| Authorized Packages | — | Comma-separated whitelist. If non-empty, only these packages may be installed. |
| Forbidden Packages | — | Comma-separated blacklist. These packages must never be installed. |
Retries, Logging & Debug:
| Parameter | Default | Description |
|---|---|---|
| Cypher Max Retries | 3 | Neo4j query retry attempts (0-10) |
| Log Max MB | 10 | Maximum log file size before rotation |
| Log Backups | 5 | Number of rotated log backups |
| Create Graph Image on Init | false | Generate a LangGraph visualization on startup |
Configure THC Hydra password cracking (50+ protocols: SSH, FTP, RDP, SMB, HTTP forms, databases, etc.).
| Parameter | Default | Description |
|---|---|---|
| Hydra Enabled | true | Enable/disable Hydra brute force |
| Threads (-t) | 16 | Parallel connections per target. Protocol limits: SSH max 4, RDP max 1, VNC max 4 |
| Wait Between Connections (-W) | 0 | Seconds between each connection. 0 = no delay |
| Connection Timeout (-w) | 32 | Max seconds to wait for a response |
| Stop On First Found (-f) | true | Stop when valid credentials are found |
| Extra Password Checks (-e) | nsr | Additional checks: n=null, s=username-as-password, r=reversed username |
| Verbose Output (-V) | true | Show each login attempt |
| Max Wordlist Attempts | 3 | Wordlist strategies to try before giving up (1-10) |
Configure SMTP settings for the phishing attack skill email delivery capability. The agent reads this configuration when the phishing_social_engineering attack skill is active and the user requests email delivery.
| Parameter | Default | Description |
|---|---|---|
| SMTP Configuration | (empty) | Free-text SMTP settings for email delivery. The agent parses this naturally when sending phishing emails via Python smtplib |
Example configuration:
SMTP_HOST: smtp.gmail.com
SMTP_PORT: 587
SMTP_USER: pentest@gmail.com
SMTP_PASS: abcd efgh ijkl mnop
SMTP_FROM: it-support@company.com
USE_TLS: true
If left empty, the agent asks the user at runtime for SMTP credentials when email delivery is requested. The agent never attempts to send email without proper SMTP configuration.
See Attack Skills > Phishing / Social Engineering for the full phishing workflow documentation.
Configure CypherFix automated vulnerability remediation. These settings control how the CodeFix agent interacts with your GitHub repository.
| Parameter | Default | Description |
|---|---|---|
| GitHub Token (CypherFix) | — | Personal Access Token with repo scope for cloning, pushing, and creating PRs |
| Default Repository | — | Target repository in owner/repo format (e.g., redis/redis) |
| Default Branch | main | Base branch for creating fix branches |
| Branch Prefix | cypherfix/ | Prefix for auto-created fix branches (e.g., cypherfix/fix-sqli-42) |
| Require Approval | true | Pause before each code edit for human review. When disabled, blocks auto-accept after 5 minutes |
| LLM Model Override | (Agent default) | Use a specific model for CodeFix instead of the model configured in Agent Behaviour |
See CypherFix — Automated Remediation for the full usage guide.
A matrix controlling which tools the agent can use in each operational phase. Each tool can be independently enabled/disabled per phase. Tools that require an external API key (web_search, shodan, google_dork) display a warning with a quick-add modal when enabled without a key configured in Global Settings.
| Tool | Informational | Exploitation | Post-Exploitation |
|---|---|---|---|
| query_graph | ✓ | ✓ | ✓ |
| web_search | ✓ | ✓ | ✓ |
| shodan | ✓ | ✓ | — |
| google_dork | ✓ | — | — |
| execute_curl | ✓ | ✓ | ✓ |
| execute_naabu | ✓ | ✓ | — |
| execute_nmap | ✓ | ✓ | ✓ |
| execute_nuclei | ✓ | ✓ | — |
| kali_shell | ✓ | ✓ | ✓ |
| execute_code | — | ✓ | ✓ |
| execute_hydra | — | ✓ | ✓ |
| metasploit_console | — | ✓ | ✓ |
| msf_restart | — | ✓ | ✓ |
This matrix is configurable per project in the dedicated Tool Matrix tab of the project settings form (under the AI Agent tab group).