ASCIT31/Dark-Moon

DarkMoon – Autonomous AI‑powered Penetration Testing

What it is – DarkMoon is an open‑source platform that lets you run a full penetration test against a target you own or have permission to assess. It drives a large language model (LLM) to plan, coordinate and execute real offensive tools, then records the exact commands and raw output as proof of each vulnerability.

How it works

1. Target input – You start a run from the CLI with a single line such as ./darkmoon.sh "TARGET: example.com".
2. Discovery & modelling – The system enumerates ports, services and technology stacks, building a concise “attack‑surface model”.
3. Agent dispatch – Based on what it finds, a specialised sub‑agent (e.g., a WordPress scanner, an AD agent, a Kubernetes agent, an LLM‑endpoint tester, etc.) is launched. DarkMoon ships with about 50 such agents.
4. Execution via MCP – All commands are sent through a controlled MCP (Managed Command Proxy) layer that logs the timestamp, the exact command and the raw response. No command is run directly by the LLM.
5. Proof‑of‑exploitation – When a vulnerability is discovered, the agent runs an exploit or proof‑of‑concept payload and stores the output as evidence.
6. Report generation – Findings are emitted as JSON/Markdown with severity, CVSS, MITRE ATT&CK tags and the command evidence. The open‑source edition stops here; the paid DarkMoon Pro adds a web dashboard, automated remediation PRs and scheduled campaigns.

Key features

• Local‑LLM first – Works with Ollama, llama.cpp or any cloud LLM (OpenAI, Anthropic, OpenRouter). A Privacy Gateway tokenises real IPs/credentials so the model only sees placeholders.
• Evidence‑based – Every finding includes the exact command and raw output; the Pro tier can re‑run exploits to confirm fixes.
• Broad coverage – Agents target web apps, APIs, AD, Kubernetes, major cloud providers, databases, IoT firmware, and even AI/LLM inference endpoints.
• CI/CD & IDE integrations – GitHub Actions, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana, Splunk, plus an SDK (@darkmoon_ai/client). Integrations emit safe metadata (severity, MITRE IDs) without leaking secrets.
• Open‑source & self‑hosted – GPL‑3.0, Docker‑Compose stack, no proprietary hardware. All agent logic lives in readable Markdown files.

Getting started

git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon
./install.sh          # configures LLM provider, builds Docker stack
./darkmoon.sh "TARGET: example.com"

Prerequisites are Docker, Docker‑Compose and an LLM API key (or a local model). The repo also provides --log <session> to replay a run.

Benchmark – In a black‑box test against the OWASP Juice Shop, DarkMoon (using Anthropic Claude) discovered 57 vulnerabilities (8 critical, 24 high, 21 medium, 4 low) in 28.5 minutes, each with a reproducible exploit command.

Who it’s for – Security teams, DevSecOps engineers, red‑teamers and ethical hackers who want an automated, evidence‑rich first pass of a pentest while keeping all data on‑premises.

---

All details above are taken directly from the repository’s README; no additional claims are made.