samugit83/redamon

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merged patch, with human oversight at every critical step. LEGAL DISCLAIMER : This tool is intended for authorized security testing , educational purposes , and research only . Never use this system to scan, probe, or attack any system you do not own or have explicit written permission to test. Unauthorized access is illegal and punishable by law. By using this tool, you accept full responsibility for your actions. Read Full Disclaimer 🏆 Flagship result: RedAmon solves 101 / 104 (97.1%) of the XBOW web-security benchmark fully black-box . Every solve ships a complete, unedited raw agent session and a reproducible, step-by-step walkthrough: open any row and read exactly how the flag fell, tool call by tool call. Auditable, line by line. See the XBOW Validation Benchmark scorecard . 📊 Coverage, measured and self-scored: the Bug Bounty Coverage — The Full Taxonomy Audit (PDF, 124 pages) audits RedAmon against all 397 classes of web bug-bounty finding, one line at a time, naming the exact module, skill or scanner behind every verdict, and scoring the recon pipeline and the agentic system separately against their own remit. It is deliberately self-critical, it records what is missing as plainly as what is covered: 134 classes complete, 210 in the build backlog, 44 deliberately excluded, with one explicit decision for every class. Dynamic Multi-Tool Parallel Recon Pipeline RedAmon launches multiple reconnaissance tools in parallel, each feeding results into a shared knowledge graph in real time. Tools spin up, adapt their scope based on live discoveries, and coordinate without manual intervention. The entire attack surface -- subdomains, ports, endpoints, parameters -- materializes in minutes, not hours. Recon as a Living Knowledge Graph Industry-standard scanners chained so each tool's output feeds the next, then merged into a single Neo4j knowledge graph. Findings are deduplicated, relationships are explicit, and the agent inherits a structured, fully connected attack surface ready to query in natural language. Offense meets defense . One pipeline, full visibility. Reconnaissance ➜ Exploitation ➜ Post-Exploitation ➜ AI Triage ➜ CodeFix Agent ➜ GitHub PR RedAmon doesn't stop at finding vulnerabilities, it fixes them. The pipeline starts with a 6-phase reconnaissance engine that maps your target's entire attack surface, then hands control to an autonomous AI agent that validates CVE exploitability, tests credential policies, and maps lateral movement paths. Every finding is recorded in a Neo4j knowledge graph. When the offensive phase completes, CypherFix takes over: an AI triage agent correlates hundreds of findings, deduplicates them, and ranks them by exploitability. Then a CodeFix agent clones your repository, navigates the codebase with 11 code-aware tools, implements targeted fixes, and opens a GitHub pull request, ready for review and merge. Roadmap & Community Contributions We maintain a public Project Board with upcoming features open for community contributions. Pick a task and submit a PR! Want to contribute? See CONTRIBUTING.md for how to get started. Maintainers Samuele Giampieri : Creator, Maintainer & AI Platform Architect AI Platform Architect & Full-Stack Lead with 15+ years of freelancing experience and more than 30 projects shipped to production, including enterprise-scale AI agentic systems. AWS-certified (DevOps Engineer, ML Specialty) and IBM-certified AI Engineer. Designs end-to-end ML solutions spanning deep learning, NLP, Computer Vision, and AI Agent systems with LangChain/LangGraph. LinkedIn · GitHub · Devergo Labs From the same creator: Pathbreak - Agentic Cloud Security See the attack path. Then break it. Pathbreak is an agentic cloud security platform that discovers and validates the real attack paths a threat actor would exploit across your cloud. It catches the control-plane chains most tools miss. Pathbreak - agentic cloud security pathbreak.io Ritesh Gohil : Maintainer & Lead Security Researcher Cyber Security Engineer at Workday with over 7 years of experience in Web, API, Mobile, Network, and Cloud penetration testing. Published 11 CVEs in MITRE, with security acknowledgements from Google (4×) and Apple (6×). Secured 200+ web and mobile applications and contributed to Exploit Database, Google Hacking Database, and the AWS Community. Holds AWS Security Specialty, eWPTXv2, eCPPTv2, CRTP, and CEH certifications with expertise in red teaming, cloud security, CVE research, and security architecture review. LinkedIn · GitHub Anthropic Cyber Verification Program: the team behind RedAmon is approved under Anthropic's Cyber Verification Program . Quick Start Prerequisites Docker & Docker Compose v2+ macOS: Docker Desktop, with Memory raised to at least 4 GB (8 GB with --gvm ) in Settings → Resources. Clone under ~/ so the path is inside the default File Sharing list. Windows: Docker Desktop with the WSL2 backend, run from inside the WSL2 filesystem ( ~/ ), not /mnt/c/ . That's it. No Node.js, Python, or security tools needed on your host. Minimum System Requirements Resource Without OpenVAS With OpenVAS (full stack) CPU 2 cores 4 cores RAM 4 GB 8 GB (16 GB recommended) Disk 80 GB free 110 GB free Without OpenVAS runs 7 containers: webapp, postgres, neo4j, agent, kali-sandbox, recon-orchestrator, and docker-broker (a filtering Docker-socket proxy that the recon orchestrator's spawned scan containers go through, so they can only launch the known tool images). With OpenVAS adds 4 more runtime containers (gvmd, ospd-openvas, gvm-postgres, gvm-redis) plus ~8 one-shot data-init containers for vulnerability feeds (~170K+ NVTs). First launch takes ~30 minutes for GVM feed synchronization. Dynamic recon and scan containers are spawned on-demand during operations and require additional resources. Disk sizing for a real deployment. The figures above are bare minimums to build and run the stack (fixed platform footprint: ~70 GB without OpenVAS, ~95 GB with - measured by true on-disk image size after deduplicating the shared Kali base layers). For an always-on server running real engagements , add ~100 GB of free space for operational data - the Neo4j attack graph, scan artifacts/outputs, Postgres, and container logs all grow with use. That means 200 GB without OpenVAS, 250 GB with OpenVAS , each leaving well over 100 GB free for operations. See the deployment guide for the full breakdown. 1. Clone & Install git clone https://github.com/samugit83/redamon.git cd redamon # Without GVM (lighter, faster startup): ./redamon.sh install # With GVM / OpenVAS (full stack, ~30 min first run): ./redamon.sh install --gvm The script builds all images and starts the services. 2. Create Admin Account At the end of the install (and on every ./redamon.sh up or ./redamon.sh update if no admin exists), you will be prompted in the terminal: [WARN] No admin user found. Let's create one. Admin name: Your Name Admin email: admin@example.com Admin password: ******** Confirm password: ******** Admin name -- display name shown in the UI (e.g. Admin , your name, anything you want). Admin email -- used to log in at http://localhost:3000/login . Admin password -- minimum 12 characters. After creation, open http://localhost:3000 and sign in with the email and password you just set. No prompt appeared? On a heavy first boot (especially --gvm , or a small VM) the webapp can take a while to come up, so the automatic prompt may be skipped. Create the admin at any time with: ./redamon.sh create-admin It waits for the webapp, then prompts for the same details. It is safe to re-run: reusing an existing admin's email resets that password, a new email adds another admin.