Skip to content

Agents Expansion — Go, Cloud & IoT/Firmware (16 new sub-agents)

Choose a tag to compare

View all tags
@Dark-Moon-X Dark-Moon-X released this 02 Aug 19:12
agents-expansion-2026.08
5641bfd

Darkmoon Agents Expansion — Go, Cloud & IoT/Firmware

This release adds 16 new autonomous pentest sub-agents to the Darkmoon orchestrator, taking it from web-application coverage to cloud, identity, CI/CD, IaC, data, secrets and embedded/IoT firmware — plus a dedicated Go web-application agent. Every new plane is credential- or artifact-gated: it dispatches only on a concrete positive artifact (a leaked key, an exposed API/port, a firmware image), never on inference.

🐹 Go agent

  • golang — Gin / Echo / Fiber / Beego / net-http applications: robust Go fingerprinting, XSS/SSTI/SQLi/command-injection/CSRF with framework-anchored payloads and sinks.

☁️ Cloud & platform agents (12)

  • Cloud: aws, azure, gcp — resource-plane privilege escalation, metadata/IMDS token minting, storage exfiltration (incl. anonymous & versioned objects, SSRF-via-gopher metadata smuggling).
  • Identity: entra-id — Microsoft Entra ID roles, apps, service principals, ROPC, UPN-derivation pivots.
  • IaC: terraform (state secret mining), ansible (inventory/vault).
  • CI/CD & source: github, gitlab, jenkins — supply-chain, secrets, self-hosted runners, OIDC-to-cloud.
  • Containers, data & secrets: docker, container-registry, sql-databases (PostgreSQL/MySQL/MSSQL/Oracle), messaging-cache (Redis/RabbitMQ/Kafka/MQTT/…), hashicorp-vault.

🔌 IoT / Firmware agent

  • firmware — embedded/IoT firmware and devices. Two modes: IMAGE (a firmware .img/squashfs — binwalk/sasquatch extraction, hardcoded-credential & backdoor recovery, embedded-web command-injection, outdated-component CVEs) and DEVICE (a live appliance — nmap, backdoor daemons, default/Mirai credentials, LuCI/CGI RCE).

✅ Validated end-to-end against real labs

Each family was proven autonomously (not just unit-tested):

  • Cloud: Pwned Labs — S3 exfiltration, Azure Key Vault → Storage Table PII, Azure BloodHound recon, GCS hidden-file crack, SSRF-with-Gopher → GCP initial access; plus a GitHub secret-in-history recovery cascading to AWS.
  • IoT: OWASP IoTGoat — IMAGE (20 findings: shadow cracked, shellback backdoor on 5515, LuCI command-injection, DNSpooq/BusyBox/Dropbear CVEs) and DEVICE (live root via the backdoor, Mirai-default SSH login, command-injection RCE).

🛡️ Safety & reliability

  • Orchestrator dispatch wiring (roster + credential-gated signal matrix) with anti-false-positive discipline (INC-010).
  • Hardened toolbox execution: no blocking /dev/tcp sockets, non-interactive archive extraction, git --no-pager, and GPU-gated password cracking (no multi-hour CPU brute stalls).
  • Server-side report generation with per-finding evidence.

Sub-agents are byte-identical across the Community / Pro / Front-API editions (except the environment-specific ad, kubernetes, pentest files).

Assets 2
Loading