Ghostforge is a local AI platform designed for Social Engineering detection and simulation. It acts as both a Red Team tool (generating attack scenarios) and a Blue Team tool (analyzing suspicious documents) using Large Language Models (LLMs) running entirely on your machine.
- Attack Lab: Generates realistic phishing emails, SMS, and pretexting scenarios to test security awareness.
- Defense Center: Analyzes PDF documents to detect urgency, suspicious links, and malicious intent, providing a risk score (0-100).
- 100% Local: Uses Ollama and Docker. No data leaves your computer.
- Docker & Docker Compose installed on your machine.
-
Clone the repository.
-
Setup .env: Setup your .env file using the provided .env.example as an example
mv .env.example .env
-
Run the installation script in scripts/ directory:
./install.sh
This script will build the containers, set up the database, and automatically download the AI model.
-
Access the App: Open your browser and go to: http://localhost:8000
-
Stop the App: To stop all containers, run:
./stop.sh
Ghostforge allows you to switch between different AI models. This is managed via the .env file.
-
Open the
.envfile in the root directory. -
Change the
OLLAMA_MODELvariable:OLLAMA_MODEL=llama3
-
Apply changes by running the install script again:
./install.sh
- Currently, the project uses
pypdffor extracting text from documents sincedoclingrequires heavy machine learning libraries (PyTorch) and significant hardware resources (GPU). On standard CPUs, this causes an immense bottleneck when analyzing documents.
- Future plans include the integration of the social engineering tookit in order to automate attacks.
- Improve the "Target Info" context in the Attack Lab to allow uploading company profiles for highly targeted spear-phishing simulations.