Legal and Safe Use

Legal & Safe Use

Ghostline is an offensive security tool. The techniques it automates, port scanning, SMB/LDAP/RPC enumeration, Kerberos roasting, credential dumping, are intrusive and, against systems you do not own or have permission to test, illegal in most jurisdictions.

---

Authorization

Only use Ghostline against:

• systems you own, or
• systems for which you hold explicit written authorization to test (a signed scope / rules-of-engagement document), or
• deliberately vulnerable lab and CTF environments.

Unauthorized scanning or enumeration can violate computer-misuse laws (e.g. the CFAA in the US, the Computer Misuse Act in the UK, and equivalent statutes elsewhere). The project is released under the MIT License; responsibility for lawful use is entirely yours.

---

Operational safety

These actions are noisy and intrusive. Active enumeration, secretsdump and the vulnerability scan generate clear, loggable signals on the target. Run them only within an authorized window.

Credentials in the process list. CrackMapExec, secretsdump and adidnsdump receive the password as a command-line argument. While the tool runs, that password is visible to other local users via ps / /proc. Therefore:

• run Ghostline only on hosts you control and trust;
• avoid shared/multi-user attack boxes when handling real credentials.

Credentials are session-only. Ghostline holds the username/password in memory and never writes them to a config file. They are lost when you exit, which is intentional, re-enter them next session.

---

Handling collected data

Output directories contain sensitive material, password hashes (secrets.txt, asreproast.txt), a full map of the environment (BloodHound JSON), and internal hostnames/IPs (dns.csv). Treat the entire ad_enum_*/ directory as confidential:

• store it on an encrypted volume during the engagement;
• never commit it, the repository .gitignore already excludes ad_enum_*/, output/, results/, and key/secret files;
• securely delete it once the report is delivered and retention rules allow.

---

Reporting issues responsibly

• Functional bugs and tool requests: use the issue templates.
• Security vulnerabilities in Ghostline itself: report privately per docs/SECURITY.md, do not open a public issue.

---

In short: authorized targets only, protect what you collect, clean up when you are done.