swarmhack-cli
Advanced tools
SwarmHack - Autonomous swarm penetration testing for web, Active Directory, network lateral movement, and Cisco SSE — with FAIR dollar-risk quantification and Cisco SKU upsell reporting
Autonomous swarm-based penetration testing framework — one CLI for web/API, Active Directory, network lateral movement, and Cisco Secure Service Edge (SSE) assessments. Findings are exploit-validated (not just detected), mapped to OCSF 1.1.0, and — for SSE engagements — translated into FAIR dollar-risk and Cisco SKU upsell recommendations.
v3.2.0 — WAN External-Surface Testing
External-surface engagements (operator machine → client's internet-facing asset) now deliver full parity with lab performance. Two production bugs found via a live cloud-DVWA rehearsal (3/11 over WAN vs 11/11 on-host) are fixed and verified on both ends:
SWARMHACK_RESPECT_ROBOTS=1.clamp(measured_rtt/5ms, 1, 10)
(SWARMHACK_LATENCY_SCALE overrides). Local targets measure ~9ms →
mild scaling, identical results; real internet links measure ~190ms →
full headroom.Verified: Mac → Azure-hosted DVWA over the real internet, full
authorization chain (portal token + authz doc + --allow-public):
11/11 exploit-class items with evidence (was 3/11), and a fresh
dress rehearsal on never-tuned real-world apps (WordPress, phpMyAdmin)
confirmed evidence standards and report hygiene hold on unknown targets.
v3.1.0 — Security & Trust Hardening + Exploitation-Quality Release
A real exploitation tool must be safe to distribute and impossible to run unauthorized. This release closes every bypass found in a full security review of the package and the authorization chain — and pays for nothing in capability (validation run: 11/11 exploit-class items on the DVWA vuln-by-design lab, through the full portal-auth + authz-doc flow).
Unauthorized portal URL). Test overrides
require an explicit dev environment opt-in.spawn.findings array now carries only real rows (exploited /
crown-jewel / validated). Skip notices, recon fingerprints, and
service-banner inventory are partitioned into intelligence_context
— an operator notice such as "NTLM relay skipped" is never again
reported as a High-severity vulnerability.Exploited
only with class-standard proof (marker round-trips for XSS, extracted
rows for SQLi, accepted logins for default credentials, …), shared by
the Rust gate and the Python verifier.v3.0.0 — SSE Sales-Enabler Platform + Production POV Path + Three-Discipline Validation
The major release that turns SwarmHack's SSE capability from a control-auditor into a Cisco Secure Access sales-enabler, runs it through the real production CLI against a live customer tenant, and proves the full toolchain across SSE + Active Directory + network lateral movement on local labs.
The combination no BAS or CRQ tool delivers end-to-end: validated exploit-chain + FAIR dollar-risk + Cisco-SKU/tier-gap mapping.
exfil-unlogged, shadow-app-unisolated,
origin-to-data, overperm-drift). Turns N isolated control-gaps into board-level
"internet → crown-jewel, undetected" stories. New report ## 5a. Attack chains,
delta ## 4a. chain CLOSED/STILL-OPEN/NEW tracking, and CHAIN.* platform-bundle
rows in the capability map.## 0. Executive briefing (dollar exposure + Cisco upsell + top exposures), ## 5b. MITRE ATT&CK coverage with an uploadable ATT&CK Navigator layer JSON, and ## 5c. Mermaid
attack-path diagrams + posture-amplification gauge.--sse-pac engagement-profile path (ADR-SSE-032) — swarmhack spawn --sse-pac profile.yaml --report sse runs the full SSE suite against a real Cisco
Secure Access tenant via the production CLI (auto-enables SSE phase routing, bridges
per-agent endpoints/policy from one YAML, synthesizes the scorecard at emit time). A
GREEN / AMBER / RED routing-honesty classifier banners which findings are
direct-proof vs steering-dependent — so nothing over-claims to a Cisco SE.End-to-end chain proven on the local pentest-lab: exploit an external host (CMDI,
credential/.env/.git exposure, CVE-2021-44790), harvest credentials, SSH
foothold, establish an SSH tunnel through the dual-homed pivot, and reach +
scan the internal-only host — recorded as a Lateral Movement via SSH finding with
crown-jewel extraction. The credential-masking + reachable-gateway pivot fixes make the
tunnel reliable.
Proven against a live GOAD domain controller: SMB default credentials, ADCS ESC1 (vulnerable certificate template), AD ACL abuse via GenericAll, AS-REP roast (55 targets), and anonymous LDAP bind — alongside the full AD/identity agent family (noPac, ZeroLogon, Kerberoast, NTLM relay, DCSync, delegation, LAPS, shadow creds, GPO abuse, Entra ID hybrid). Destructive primitives stay default-deny behind safety gates.
Dockerfile.ubuntu24 builds the binary and ships it on Ubuntu 24.04 with every
external tool the agents use — nmap, ncat, curl, dig, ssh/sshpass, ldapsearch,
smbclient, openssl, hashcat, john, tsql, the impacket suite, NetExec (nxc +
crackmapexec alias), certipy, bloodhound-python, evil-winrm, responder, freerdp,
mongosh — verified resolving at build time. Run any of the three disciplines fully
self-contained.
⚠️ Building the image needs ≥ 6 GB of Docker memory (the Rust crate's compile is memory-heavy); see the header of
Dockerfile.ubuntu24.
v2.6.0 -- Cisco SSE Upsell Engine + Hardening + AD Identity Expansion
--report sse produces an 8-section customer-facing Markdown report that maps every successful exploit to a specific Cisco SSE SKU (ADR-SSE-025/027/028/029). Each finding routes to a priority (P0/P1/P2), a capability_kind (deployed-misconfigured / licensed-not-enabled / not-licensed), and an SE-actionable remediation. Per-capability set-union rollup of affected apps/users/endpoints.config/cisco_sse_capability_map.yaml) mapping every emit category to a specific Cisco SKU + remediation. Plus 14 legacy CWE → Cisco SKU mappings so a confirmed SQLi/CMDI/XSS automatically surfaces the right SKU (WAF, FWaaS L7, DLP, RBI, ZTNA, etc.).swarmhack scorecard --before X --after Y --report sse-delta produces a closed-vs-open-vs-regressed table for renewal-cadence engagements (ADR-SSE-029).--authz-doc targets[] list at every network call. Strict label-boundary wildcard matching (no *.acme.com matching dev.acme.com.evil.com). Documented is_swg_test_url corpus exemption so the SWG agent can still probe EICAR / category-test URLs.--allow-zerologon, --allow-ntlm-relay, --blast-radius {recon,exploit,destructive}. Default-deny on all three. SQLi DROP TABLE-class payloads are filtered at the gate when blast radius is below destructive.class_uid=2001 (Vulnerability Finding, not 6001 Application Activity), category_uid=2, validator hard-errors on mismatch. Per-finding category.name carries the SSE token directly (e.g. SSE.sse_dns_001).HashSet<WorldState> closed-set (was O(N) Vec::contains linear scan) + parent-pointer path reconstruction + goal-scoped action pruning (build_actions_for_goal). A failing 3-goal kill-chain test went from a 14-hour hang to a 0.19-second pass — a 17,100× speedup.acquire_slot with 30s timeout. Full-discovery run (28-agent fanout) completes in 121 s; the prior silent multi-hour hang now surfaces as a loud error.RateLimitedClient::new sites now consume the orchestrator's global limiter via AgentContext::global_rate_limiter(). WAF-evasion friction under parallel execution restored.--authz-doc path and the tester from the JSON (not "see authz-doc" placeholders). End-to-end audit trail for legal countersignature.SWARMHACK_INSECURE_PREFLIGHT_TLS=1 opt-in) and the recon banner-fetch client (SWARMHACK_INSECURE_BANNER_TLS=1 opt-in) refuse self-signed certs by default. Sprint-1 regression closed.v2.5.0 -- Multi-Target Campaign + Network Intelligence + Host Recon
--target-list accepts comma-separated IPs, URLs, hostnames, and CIDR ranges. Scan entire networks in one command.--target-list 10.0.0.0/24 expands to 254 hosts automatically.mission-*.json with all targets' findings combined. Per-target reports moved to reports/per-target/.v2.4.0 -- AD Data Quality + Mandatory Auth + External Tool Documentation
v2.1.0 -- Quality, OCSF Compliance & Service-Driven Discovery Foundation
type_uid corrected to 600105, severity_id added at finding level, crown jewel deduplication by (category, value), findings sorted by generation ascending + risk_score descending.PHPSESSID=abcd...wxyz), fallback 500-char cap.cargo test + cargo clippy now run on every push/PR (was build-only).CARGO_PKG_VERSION (no more hardcoded v1.0.0).npm install -g swarmhack-cli
Or use npx:
npx swarmhack-cli --help
SwarmHack includes a default configuration file (config/swarmhack.yaml) that is automatically used when running commands. You can override it by:
Using your own config file:
swarmhack spawn --config /path/to/your/config.yaml --target "http://example.com"
Creating a local config in your project:
Place config/swarmhack.yaml in your project root - it will be automatically detected.
Customizing the bundled config: Copy the bundled config to your project and modify it:
cp $(npm root -g)/swarmhack-cli/config/swarmhack.yaml ./config/
# Full kill chain scan
swarmhack spawn \
--target "http://example.com" \
--customer "your-customer" \
--token "your-token"
# Specific agents only
swarmhack spawn --agents sqli,xss,csrf \
--target "http://example.com" \
--customer "your-customer" \
--token "your-token"
# AD domain controller scan
swarmhack spawn \
--target 192.168.56.10 \
--customer "your-customer" \
--token "your-token"
# Scan multiple targets — credentials from Host A are shared with Host B
swarmhack spawn \
--target-list "192.168.56.10,192.168.56.11,10.0.0.1" \
--customer "your-customer" \
--token "your-token"
# Scan entire subnet (CIDR)
swarmhack spawn \
--target-list "10.0.0.0/24" \
--customer "your-customer" \
--token "your-token"
# Mixed targets: IPs + URLs + hostnames + CIDR
swarmhack spawn \
--target-list "192.168.56.10,https://app.corp.local,10.0.0.0/24" \
--customer "your-customer" \
--token "your-token"
Campaign output:
mission-*.json with all findings across all targetsmission-*-attack-path.html showing network topology with all hostsreports/per-target/# Run the full SSE suite against a Cisco Secure Access tenant and emit the
# Exploit-Validated Upsell Opportunity Report (dollar-risk + Cisco SKU tier-gap).
swarmhack spawn \
--target https://customer-sse-frontend \
--sse-pac config/sse-engagement.yaml \
--report sse \
--customer "your-customer" --token "your-token" \
--authz-doc config/authz.json
The --sse-pac <profile.yaml> engagement profile carries each SSE agent's endpoints
and policy (ZTNA origins, DNS resolver, DLP upload paths, SWG proxy, identity matrix,
egress pool, SIEM URL, …) and auto-enables SSE phase routing. Outputs:
reports/<mission>.sse.md — board one-pager (§0): total $ exposure, Cisco
Essentials→Advantage upsell at N seats + 3-yr TCV, top exposures, attack chains
(§5a), MITRE ATT&CK coverage + Navigator layer (§5b), attack-path diagrams
(§5c), license/SKU map.# Renewal-cadence before/after delta (which gaps closed since last engagement)
swarmhack scorecard --before prior.json --after current.json --report sse-delta
# Run in Docker mode (isolated execution)
swarmhack spawn --agents sqli \
--target "http://example.com" \
--runtime docker \
--docker-image "swarmhack/pentest:latest"
# Run multiple agents
swarmhack spawn --agents sqli,xss,csrf \
--target "http://example.com" \
--customer "your-customer" \
--token "your-token"
# Run in Docker with custom image and volumes
swarmhack spawn --agents sqli \
--target "http://example.com" \
--runtime docker \
--docker-image "myregistry/swarmhack:v1.0" \
--docker-volume "/host/reports:/app/reports"
# List available agents
swarmhack agents list
# Check system health
swarmhack doctor
SwarmHack supports two runtime modes:
| Mode | Description | Use Case |
|---|---|---|
local | Run directly on host system | Development, CI/CD with pre-installed tools |
docker | Run inside Docker containers | Production, isolated execution, portable |
| Option | Description |
|---|---|
--runtime | Runtime mode: local (default) or docker |
--docker-image | Docker image to use (overrides config) |
--docker-container | Custom container name |
--docker-volume | Additional volumes (can be repeated) |
--docker-env | Environment variables (format: KEY=VALUE) |
# In config/swarmhack.yaml
runtime:
mode: docker # or "local"
docker_image: swarmhack/pentest:latest
docker_auto_remove: true
docker_volumes:
- /host/reports:/app/reports
docker_env:
CUSTOM_VAR: value
docker_network: bridge
docker_resources:
memory: 1g
cpus: "1"
const swarmhack = require('swarmhack-cli');
// Run a scan
const results = await swarmhack.scan({
target: 'http://example.com',
agents: ['sqli', 'xss'],
customer: 'your-customer',
token: 'your-token',
});
console.log(results);
// Check version
const version = await swarmhack.version();
console.log(version);
// Run any command
const result = await swarmhack.run(['spawn', '--help']);
console.log(result.stdout);
| Platform | Architecture |
|---|---|
| Linux | x64, arm64 |
| macOS | x64, arm64 |
| Windows | x64 |
If npm installation fails, use Docker:
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $(pwd)/reports:/app/reports \
prancer/swarmhack:3.0.0 \
spawn --agents sqli --target "http://example.com" \
--customer "your-customer" --token "your-token"
Dockerfile.ubuntu24 ships the binary plus every external tool (web + AD + network +
SSE) so any discipline runs self-contained (needs ≥ 6 GB Docker memory to build):
docker build -f Dockerfile.ubuntu24 -t swarmhack:ubuntu24 .
# SSE engagement against a Cisco Secure Access tenant
docker run --rm -v "$PWD/reports:/app/reports" -v "$PWD/config:/app/config:ro" \
swarmhack:ubuntu24 spawn \
--target https://customer-sse-frontend \
--sse-pac config/sse-engagement.yaml --report sse \
--token "$PRANCER_TOKEN" --customer "$PRANCER_CUSTOMER" \
--authz-doc config/authz.json
SwarmHack supports authenticated scanning using custom HTTP headers. This enables testing of post-authentication attack surfaces that are invisible to unauthenticated scans.
swarmhack spawn \
--target "https://your-app.com" \
--header "Cookie: session=abc123def456" \
--token "$PRANCER_TOKEN" \
--customer "$PRANCER_CUSTOMER"
swarmhack spawn \
--target "https://api.your-app.com" \
--header "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
--token "$PRANCER_TOKEN" \
--customer "$PRANCER_CUSTOMER"
swarmhack spawn \
--target "https://your-app.com" \
--header "Cookie: session=abc123" \
--header "X-API-Key: your-api-key-here" \
--header "X-Tenant-ID: customer-123" \
--token "$PRANCER_TOKEN" \
--customer "$PRANCER_CUSTOMER"
swarmhack spawn \
--target "https://your-app.com" \
--header "Authorization: Basic YWRtaW46cGFzc3dvcmQ=" \
--token "$PRANCER_TOKEN" \
--customer "$PRANCER_CUSTOMER"
--timeout 1200--header flag is repeatable -- add as many custom headers as neededWeb/API exploit family (23):
| Agent | CWE | Description |
|---|---|---|
crawler | — | Web crawling, form discovery, WAF detection |
sqli | CWE-89 | SQL injection (UNION, boolean, error, time-based) |
xss | CWE-79 | Cross-site scripting (reflected, stored, DOM, blind) |
cmdi | CWE-78 | Command injection with marker-based detection |
csrf | CWE-352 | Cross-site request forgery |
idor | CWE-639 | Insecure direct object reference |
auth_bypass | CWE-287 | Authentication bypass |
ssrf | CWE-918 | Server-side request forgery (IMDS probes) |
lfi | CWE-22 | Local file inclusion / path traversal |
ssti | CWE-1336 | Server-side template injection |
open_redirect | CWE-601 | Open redirect |
cors | CWE-942 | CORS misconfiguration |
jwt | CWE-345 | JWT vulnerabilities (alg:none, confusion) |
xxe | CWE-611 | XML external entity injection |
file_upload | CWE-434 | File upload vulnerabilities |
deserialization | CWE-502 | Insecure deserialization |
http_smuggling | CWE-444 | HTTP request smuggling (CL.TE/TE.CL) |
session_fixation | CWE-384 | Session fixation and invalidation testing |
dangerous_methods | CWE-16 | Dangerous HTTP methods (TRACE/XST, PUT upload) |
default_credentials | CWE-798 | Default credential scanning (20 pairs) |
privilege_escalation | CWE-862 | Function-level access control testing |
mass_assignment | CWE-915 | Mass assignment / parameter injection |
vulnerable_components | CWE-1035 | Version fingerprinting + CVE lookup (30 CVEs) |
pivot | — | SSH lateral movement, tunnel scanning, credential reuse |
idor (enhanced) | CWE-639 | Object reference enumeration with credential correlation |
nmap_scanner | — | Port discovery, service detection, NSE vulnerability scanning |
ftp_probe | CWE-287 | FTP anonymous login, default credentials, banner analysis |
ssh_probe | CWE-327 | SSH banner analysis, weak version CVE detection |
ldap_enum | CWE-284 | AD enumeration (10 categories: users, SPNs, delegation, trusts, policy) |
ldap_spray | CWE-307 | LDAP password spray with lockout-safe threshold detection |
kerberos_attack | CWE-522 | AS-REP roasting + Kerberoasting (TGS hash extraction) |
smb_enum | CWE-200 | SMB null session, signing check, GPP password scraping |
mssql_probe | CWE-798 | MSSQL default credentials, linked servers, xp_cmdshell |
dcsync | CWE-522 | DCSync credential extraction via secretsdump |
winrm_probe | CWE-287 | WinRM lateral movement via evil-winrm/crackmapexec |
ntlm_capture | CWE-522 | NTLM hash capture via Responder (opt-in) |
acl_abuse | CWE-284 | BloodHound-style ACL path discovery and exploitation |
hash_crack | CWE-521 | Offline hash cracking with feedback loop |
pth_agent | CWE-522 | Pass-the-Hash lateral movement via impacket |
cred_dump | CWE-522 | SAM/LSA credential dumping |
adcs_exploit | CWE-295 | ADCS ESC1-ESC15 certificate abuse via certipy |
delegation_exploit | CWE-284 | Constrained/RBCD/unconstrained Kerberos delegation |
laps_reader | CWE-522 | LAPS local admin password extraction |
shadow_creds | CWE-284 | Shadow credentials via pywhisker/certipy |
gpo_abuse | CWE-284 | GPO modification for scheduled task deployment |
trust_exploit | CWE-200 | Cross-forest SID History exploitation |
gmsa_reader | CWE-522 | gMSA service account password reading |
auth_coercion | CWE-287 | PrinterBug/PetitPotam authentication coercion |
New AD / identity agents (v2.6.0 — 11 added):
| Agent | CWE | Description |
|---|---|---|
nopac | CWE-287 | noPac / sAMAccountName spoofing (CVE-2021-42278/42287) — native Kerberos + LDAP |
zerologon | CWE-1390 | ZerOlogon (CVE-2020-1472) — gated behind --allow-zerologon (default-deny) |
ntlm_relay | CWE-345 | NTLM relay to LDAPS / SMB / HTTP — gated behind --allow-ntlm-relay |
ntlm_downgrade | CWE-757 | NTLM downgrade detection (LDAP signing / channel binding) |
kerbrute | CWE-200 | Native AS-REQ user enumeration with lockout-safe throttling |
sccm_naa | CWE-522 | SCCM Network Access Account secret retrieval |
sccm_pxe | CWE-256 | SCCM PXE boot media credential extraction |
sccm_relay | CWE-345 | SCCM NTLM relay to AdminService |
ticket_forge | CWE-345 | Kerberos ticket forgery (Golden / Silver / Diamond / Sapphire) — offline crypto, no network |
flag_collector | CWE-200 | SMB + WSMan / SSH file retrieval (GOAD-style flag capture) |
entra_attacks | CWE-287 | Microsoft Entra ID hybrid: PRT replay, Seamless SSO abuse, PHS compromise |
Cisco Secure Access SSE family (v2.6.0 — 16 new agents):
These agents probe SSE controls (not just CVEs) and emit findings keyed to specific Cisco Secure Access SKUs via the capability map. Used with --report sse to produce the Cisco Secure Access — Exploit-Validated Upsell Opportunity Report.
| Agent | Cisco SKU it informs | Description |
|---|---|---|
sse_ztna | Cisco Secure Access — Private App Access | ZTNA bypass: unauthenticated reach, origin hardening, identity-aware policy enforcement |
sse_identity | Cisco Duo + Secure Access — Identity-Aware Policy | MFA/step-up enforcement and session revocation latency |
sse_device_posture | Cisco Secure Client + Posture Profiles | Posture-asserting header / cert / managed-device gates |
sse_traffic_steering | Cisco Secure Access — App Connector + DNS Sinkhole | Egress bypass detection (no_proxy, alt resolvers, direct egress) |
sse_dns | Cisco Umbrella DNS Security — Blocklist + Tunneling Detection | DNS blocklist enforcement + tunneling/C2 beacon detection |
sse_swg | Cisco Secure Access SWG — URL Categories + File Inspection | Category bypass (gambling/adult/phishing reach), EICAR / AMP file inspection |
sse_casb | Cisco Secure Access CASB — SaaS Inventory + Tenant Restrictions | Sanctioned/unsanctioned SaaS reach, corp-vs-personal tenant gating |
sse_dlp | Cisco Secure Access — Inline DLP | PII / PCI / PHI / secrets exfil channel testing (multipart, form, JSON, raw) |
sse_fwaas | Cisco Secure Access FWaaS | L4 + L7 outbound policy + app control bypass |
sse_rbi | Cisco Secure Access RBI (Remote Browser Isolation) | Native-render-vs-isolated determination on high-risk URL classes |
sse_genai | Cisco Secure Access — GenAI Policy + Inline DLP for GenAI | LLM prompt-as-exfil channel testing across vendors |
sse_policy_assurance | Cisco Secure Access — Unified Policy Engine | Cross-capability policy conflict + stale-exception detection |
sse_observability | Cisco Secure Access — Activity Search + SIEM Forwarding | Log-correlation latency budget enforcement; IR chain assembly |
sse_shadow_asset | Cisco SSE expansion-candidate asset onboarding | Shadow-asset OSINT (CT logs, passive DNS, RDAP) with protected_apps cross-check |
sse_c2 | Cisco Secure Access — Multi-Control C2 Correlation | Simulated DNS+HTTPS+TCP C2 beacons against operator-owned callback FQDN |
sse_scorecard | (Scorecard self-summary) | Synthesizer: per-domain scoring + Cisco capability mapping + executive narrative |
Key functions added in v2.6.0:
render_upsell_report() (src/reporting/sse_markdown_report.rs) — produces the 8-section customer-facing upsell Markdown.compute_delta() + render_delta_report() (src/reporting/sse_delta_renderer.rs) — before/after comparator for renewal-cadence engagements.build_actions_for_goal() (src/agents/goap_planner.rs) — goal-scoped action pruning for the GOAP A* planner.AgentContext::is_host_in_scope() (src/memory/mod.rs) — strict label-boundary scope check, called by 61 networking agents at every cross-origin probe.AgentContext::global_rate_limiter() — orchestrator-stamped Arc<GlobalRateLimiter> consumed by 36 RateLimitedClient::new call sites.VulnerabilityCategory::Sse(String) — typed enum variant that carries the SSE category token through OCSF emission and dedup paths.build_actions_for_goal() + GOAPPlanner::new_with_goal_pruning() — goal-scoped action pruning that collapses the 68-action library to ~6 for a 3-goal SQLi kill chain.is_swg_test_url() (src/agents/sse_swg/agent.rs) — documented allowlist that lets the SWG agent probe well-known external test corpora (EICAR, category samples) without violating the per-engagement authz scope.--allow-zerologon, --allow-ntlm-relay, --blast-radius, --pci-compliance, --use-goap-planning CLI flags — all default-deny / default-off opt-ins for risky operations.SwarmHack generates reports in OCSF 1.1.0 format, the industry standard for security findings.
Single target:
{
"scan_info": {
"scanner": { "name": "SwarmHack", "vendor": "Prancer" },
"customer": "your-customer",
"target": "http://example.com",
"summary": { "findings_count": 9, "crown_jewels_count": 23 }
},
"compliance_summary": { "frameworks_covered": ["PCI-DSS 4.0", "OWASP Top 10", "NIST CSF 2.0", ...] },
"findings": [...]
}
Multi-target campaign:
{
"scan_info": {
"mission_type": "multi-target",
"targets_scanned": 4,
"targets_total": 5,
"summary": { "findings_count": 20, "crown_jewels_count": 28 },
"per_target": [
{ "target": "http://192.168.56.10/", "findings_count": 6, "crown_jewels_count": 4 },
{ "target": "https://demo.testfire.net/", "findings_count": 7, "crown_jewels_count": 22 }
]
},
"findings": [/* all findings from all targets combined */]
}
Each finding includes:
SwarmHack requires Prancer Portal authentication:
swarmhack spawn \
--target "http://example.com" \
--agents sqli,xss \
--customer "your-customer" \
--token "your-32-char-token"
Get your token from Prancer Portal → Settings → Access Tokens.
--token and --customer)SseAttackChain synthesizer correlates SSE findings into typed attack narratives; report ## 5a., delta ## 4a. chain tracking, CHAIN.* capability-map bundle rows.src/reporting/sse_risk_quant.rs).src/reporting/sse_tier_gap.rs).## 0. briefing, ## 5b. ATT&CK coverage + uploadable Navigator layer JSON, ## 5c. attack-path diagrams (mitre::to_navigator_layer).--sse-pac path (ADR-SSE-032) — engagement-profile loader + per-agent metadata bridge + auto-enable SSE routing + emit-time scorecard synthesis; runs the SSE suite against a real Cisco tenant via swarmhack spawn (src/core/sse_pac_profile.rs). GREEN/AMBER/RED routing-honesty classifier.Dockerfile.ubuntu24) — builds the binary + ships the full external toolset (impacket, NetExec/crackmapexec alias, certipy, bloodhound, evil-winrm, responder, freerdp, mongosh, nmap/ncat/hashcat/john/tsql/…), verified at build time.--report sse produces the 8-section Exploit-Validated Upsell Opportunity Report mapping every finding to a specific Cisco SKU.config/cisco_sse_capability_map.yaml.--allow-zerologon, --allow-ntlm-relay, --blast-radius {recon,exploit,destructive}; all default-deny.class_uid=2001, category_uid=2, validator hard-errors on mismatch; SSE category emitted as typed VulnerabilityCategory::Sse(String) variant.HashSet<WorldState> closed-set + parent-pointer path + build_actions_for_goal() goal-scoped pruning. Failing 3-goal kill-chain test: 14-hour hang → 0.19-second pass (17,100× speedup).acquire_slot with 30s timeout. Full-discovery run completes in 121 s.RateLimitedClient::new sites consume AgentContext::global_rate_limiter(); WAF-evasion friction under parallel execution restored.--authz-doc path and tester from the JSON.SWARMHACK_INSECURE_PREFLIGHT_TLS=1 opt-in) and recon banner-fetch (SWARMHACK_INSECURE_BANNER_TLS=1 opt-in).core::authorization::is_target_authorized no longer matches dev.acme.com.evil.com against *.acme.com.Sse(String) category — full X1 closure across the SSE family.--target-list with comma-separated IPs, URLs, hostnames, CIDR ranges10.0.0.0/24 → 254 hosts, up to /16 supported--header flag for session cookies, Bearer tokens, API keysMIT
FAQs
SwarmHack - Autonomous swarm penetration testing for web, Active Directory, network lateral movement, and Cisco SSE — with FAIR dollar-risk quantification and Cisco SKU upsell reporting
The npm package swarmhack-cli receives a total of 61 weekly downloads. As such, swarmhack-cli popularity was classified as not popular.
We found that swarmhack-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Research
/Security News
Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open VSX.
Security News
/Company News
Capital One is partnering with Socket to proactively secure its open source supply chain.
Security News
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.