swarmhack-cli

v3.0.1

Published

4 days ago

SwarmHack - Autonomous swarm penetration testing for web, Active Directory, network lateral movement, and Cisco SSE — with FAIR dollar-risk quantification and Cisco SKU upsell reporting

swarmhack-cli

Autonomous swarm-based penetration testing framework — one CLI for web/API, Active Directory, network lateral movement, and Cisco Secure Service Edge (SSE) assessments. Findings are exploit-validated (not just detected), mapped to OCSF 1.1.0, and — for SSE engagements — translated into FAIR dollar-risk and Cisco SKU upsell recommendations.

What's New in v3.0.0

v3.0.0 — SSE Sales-Enabler Platform + Production POV Path + Three-Discipline Validation

The major release that turns SwarmHack's SSE capability from a control-auditor into a Cisco Secure Access sales-enabler, runs it through the real production CLI against a live customer tenant, and proves the full toolchain across SSE + Active Directory + network lateral movement on local labs.

Cisco SSE Sales-Enabler Platform

The combination no BAS or CRQ tool delivers end-to-end: validated exploit-chain + FAIR dollar-risk + Cisco-SKU/tier-gap mapping.

Cross-domain kill-chain chaining (ADR-SSE-030) — correlates independent SSE findings into typed attack narratives (exfil-unlogged, shadow-app-unisolated, origin-to-data, overperm-drift). Turns N isolated control-gaps into board-level "internet → crown-jewel, undetected" stories. New report ## 5a. Attack chains, delta ## 4a. chain CLOSED/STILL-OPEN/NEW tracking, and CHAIN.* platform-bundle rows in the capability map.
FAIR/ALE dollar-risk quantification (ADR-SSE-031) — every finding carries a defensible dollar exposure (low/expected/high), anchored to cited IBM Cost of a Data Breach 2024/2025 and Verizon DBIR per-record costs, with chain amplification (unlogged ×1.24, shadow ×1.16) and clamps to published incident averages. Record-count assumptions are explicitly flagged and operator-configurable.
Cisco SKU tier-gap upsell engine (ADR-SSE-031) — encodes Cisco Secure Access's real commercial model (DNS Defense / SIA / SPA, Essentials vs Advantage, per-seat, all-or-nothing). Computes "this proven Advantage-gated gap forces the whole estate to Advantage at N seats" → per-seat delta + 3-yr TCV + seat-matched add-ons (Duo, RBI, dedicated IP). Distinguishes configuration gaps ($0 upsell) from tier/add-on gaps so the SE stays credible.
Executive board one-pager + MITRE + diagrams (ADR-SSE-031) — new ## 0. Executive briefing (dollar exposure + Cisco upsell + top exposures), ## 5b. MITRE ATT&CK coverage with an uploadable ATT&CK Navigator layer JSON, and ## 5c. Mermaid attack-path diagrams + posture-amplification gauge.
Production --sse-pac engagement-profile path (ADR-SSE-032) — swarmhack spawn --sse-pac profile.yaml --report sse runs the full SSE suite against a real Cisco Secure Access tenant via the production CLI (auto-enables SSE phase routing, bridges per-agent endpoints/policy from one YAML, synthesizes the scorecard at emit time). A GREEN / AMBER / RED routing-honesty classifier banners which findings are direct-proof vs steering-dependent — so nothing over-claims to a Cisco SE.

Network pentesting — full lateral movement, validated

End-to-end chain proven on the local pentest-lab: exploit an external host (CMDI, credential/.env/.git exposure, CVE-2021-44790), harvest credentials, SSH foothold, establish an SSH tunnel through the dual-homed pivot, and reach + scan the internal-only host — recorded as a Lateral Movement via SSH finding with crown-jewel extraction. The credential-masking + reachable-gateway pivot fixes make the tunnel reliable.

Active Directory pentesting — validated against GOAD

Proven against a live GOAD domain controller: SMB default credentials, ADCS ESC1 (vulnerable certificate template), AD ACL abuse via GenericAll, AS-REP roast (55 targets), and anonymous LDAP bind — alongside the full AD/identity agent family (noPac, ZeroLogon, Kerberoast, NTLM relay, DCSync, delegation, LAPS, shadow creds, GPO abuse, Entra ID hybrid). Destructive primitives stay default-deny behind safety gates.

Ubuntu 24.04 all-in-one Docker image

Dockerfile.ubuntu24 builds the binary and ships it on Ubuntu 24.04 with every external tool the agents use — nmap, ncat, curl, dig, ssh/sshpass, ldapsearch, smbclient, openssl, hashcat, john, tsql, the impacket suite, NetExec (nxc + crackmapexec alias), certipy, bloodhound-python, evil-winrm, responder, freerdp, mongosh — verified resolving at build time. Run any of the three disciplines fully self-contained.

⚠️ Building the image needs ≥ 6 GB of Docker memory (the Rust crate's compile is memory-heavy); see the header of Dockerfile.ubuntu24.

What's New in v2.6.0

v2.6.0 -- Cisco SSE Upsell Engine + Hardening + AD Identity Expansion

Cisco Secure Access SSE upsell reports -- --report sse produces an 8-section customer-facing Markdown report that maps every successful exploit to a specific Cisco SSE SKU (ADR-SSE-025/027/028/029). Each finding routes to a priority (P0/P1/P2), a capability_kind (deployed-misconfigured / licensed-not-enabled / not-licensed), and an SE-actionable remediation. Per-capability set-union rollup of affected apps/users/endpoints.
16 SSE agents -- new family of swarm agents that probe SSE controls directly: ZTNA, Identity/MFA, Device Posture, Traffic Steering, DNS Security, SWG, CASB, DLP, FWaaS, RBI, GenAI, Policy Assurance, Observability, Shadow Asset, C2 simulation, Scorecard synthesizer.
Cisco SSE capability map -- 33-entry YAML (config/cisco_sse_capability_map.yaml) mapping every emit category to a specific Cisco SKU + remediation. Plus 14 legacy CWE → Cisco SKU mappings so a confirmed SQLi/CMDI/XSS automatically surfaces the right SKU (WAF, FWaaS L7, DLP, RBI, ZTNA, etc.).
Before/after delta comparator -- swarmhack scorecard --before X --after Y --report sse-delta produces a closed-vs-open-vs-regressed table for renewal-cadence engagements (ADR-SSE-029).
11 new AD/identity agents -- noPac (CVE-2021-42278/42287), ZerOlogon (CVE-2020-1472), NTLM Relay, NTLM Downgrade, Kerbrute (native AS-REQ enum), SCCM NAA / PXE / Relay, Ticket Forging (Golden/Silver/Diamond/Sapphire), Flag Collector, Entra ID hybrid (PRT replay, Seamless SSO, PHS compromise).
Per-agent runtime authz scope check (X8) -- 61 networking agents now refuse to contact hosts outside the --authz-doc targets[] list at every network call. Strict label-boundary wildcard matching (no *.acme.com matching dev.acme.com.evil.com). Documented is_swg_test_url corpus exemption so the SWG agent can still probe EICAR / category-test URLs.
Three destructive-attack safety gates -- --allow-zerologon, --allow-ntlm-relay, --blast-radius {recon,exploit,destructive}. Default-deny on all three. SQLi DROP TABLE-class payloads are filtered at the gate when blast radius is below destructive.
OCSF 1.1.0 strict -- class_uid=2001 (Vulnerability Finding, not 6001 Application Activity), category_uid=2, validator hard-errors on mismatch. Per-finding category.name carries the SSE token directly (e.g. SSE.sse_dns_001).
GOAP planner properly fixed -- HashSet<WorldState> closed-set (was O(N) Vec::contains linear scan) + parent-pointer path reconstruction + goal-scoped action pruning (build_actions_for_goal). A failing 3-goal kill-chain test went from a 14-hour hang to a 0.19-second pass — a 17,100× speedup.
Agent-pool deadlock fix -- semaphore raised 25 → 64 + bounded acquire_slot with 30s timeout. Full-discovery run (28-agent fanout) completes in 121 s; the prior silent multi-hour hang now surfaces as a loud error.
GlobalRateLimiter wired -- 36 RateLimitedClient::new sites now consume the orchestrator's global limiter via AgentContext::global_rate_limiter(). WAF-evasion friction under parallel execution restored.
Authorization-document footer threading -- §8 of the upsell report now cites the exact --authz-doc path and the tester from the JSON (not "see authz-doc" placeholders). End-to-end audit trail for legal countersignature.
TLS verification on by default everywhere -- both the pre-flight reachability probe (SWARMHACK_INSECURE_PREFLIGHT_TLS=1 opt-in) and the recon banner-fetch client (SWARMHACK_INSECURE_BANNER_TLS=1 opt-in) refuse self-signed certs by default. Sprint-1 regression closed.
`75 agents total (23 web + 34 AD/identity/network + 18 SSE family).

What's New in v2.5.0

v2.5.0 -- Multi-Target Campaign + Network Intelligence + Host Recon

Multi-target campaigns -- --target-list accepts comma-separated IPs, URLs, hostnames, and CIDR ranges. Scan entire networks in one command.
CIDR expansion -- --target-list 10.0.0.0/24 expands to 254 hosts automatically.
Campaign intelligence graph -- Credentials found on Host A are automatically seeded to Host B (petgraph + DashMap property graph).
Unified OCSF report -- Single mission-*.json with all targets' findings combined. Per-target reports moved to reports/per-target/.
Network attack path visualization -- D3.js HTML showing all hosts as topology with device types, findings grouped per host, detail panel on click, intel flow bottom panel.
Host recon -- Reverse DNS + HTTP banner + MAC vendor lookup. Device type classification: Router, Printer, NAS, IP Camera, Web Server.
Graceful unreachable skip -- Offline hosts skipped with one-line message instead of verbose error. Prior scan data included in campaign report.
Default credential fallback -- SMB/WinRM agents try vagrant:vagrant and other defaults when campaign creds fail on non-domain hosts.
Network agent findings fix -- AD agent findings now included in OCSF report and CLI display (was silently dropped).
Quiet campaign mode -- Per-target "MISSION COMPLETE" banners suppressed; single campaign summary shown.
49 regression tests (was 37) across 15 categories.
GOAD assessment -- Comprehensive mapping of 38 GOAD attack paths vs SwarmHack capabilities.
46 agents total (23 web + 23 AD/network).

v2.4.0 -- AD Data Quality + Mandatory Auth + External Tool Documentation

Mandatory Prancer Portal authentication (offline mode removed)
AD finding categorization (CWE-307/521/522 → "authentication")
Dynamic resource type from URL scheme
Compliance mappings for AD CWEs
LDIF base64 parsing, password policy guard, trust direction decoding
Crown jewel dedup across merged findings
External tool documentation (38 binaries)

v2.1.0 -- Quality, OCSF Compliance & Service-Driven Discovery Foundation

Agent Plugin Registry (ADR-011) -- Scalable plugin system: adding a new agent is one file + one registry line. 26 plugins registered (23 legacy web agents + nmap scanner + FTP probe + SSH probe). Foundation for 100+ agents.
Nmap-First Port Discovery -- Every mission starts with nmap port/service discovery (canonical entry point). Discovered services route to the correct agents automatically via ServiceRouter. Falls back to URL-based inference when nmap is unavailable.
FTP & SSH Probe Agents -- New non-HTTP agents: FTP anonymous login + default credential testing, SSH banner analysis + weak version CVE detection. First protocol-aware agents beyond HTTP.
OCSF 1.1.0 Full Compliance -- type_uid corrected to 600105, severity_id added at finding level, crown jewel deduplication by (category, value), findings sorted by generation ascending + risk_score descending.
Crown Jewel Sanitization -- 5-rule system: short values always full, api_key never truncated, credential summaries up to 200 chars, session tokens format-preserving (PHPSESSID=abcd...wxyz), fallback 500-char cap.
False Positive Elimination -- LFI agent filters PHP payloads on ASP.NET/IIS targets, IDOR agent no longer fabricates synthetic parameters, Default Credentials uses discovered form field names, CVE-2021-31166 version rule narrowed.
Risk Score Calibration -- Info=1.0, Low=3.0, Medium=5.0, High=7.5, Critical=10.0 base scores. robots.txt now scores ~0.2 (was 0.9), SQLi auth bypass scores ~9.0 (was 5.63).
Security Fixes -- Shell injection in askpass helper patched, TLS verification restored in file_upload/xxe agents, PII redaction in OCSF reports.
CI Pipeline -- cargo test + cargo clippy now run on every push/PR (was build-only).
Version Banner -- Uses CARGO_PKG_VERSION (no more hardcoded v1.0.0).
83 new regression tests -- 46 for v2.1.0 quality fixes + 37 for ADR-011 Phase 1.

Installation

npm install -g swarmhack-cli

Or use npx:

npx swarmhack-cli --help

Configuration

SwarmHack includes a default configuration file (config/swarmhack.yaml) that is automatically used when running commands. You can override it by:

Using your own config file:

swarmhack spawn --config /path/to/your/config.yaml --target "http://example.com"

Creating a local config in your project: Place config/swarmhack.yaml in your project root - it will be automatically detected.
Customizing the bundled config: Copy the bundled config to your project and modify it:
```
cp $(npm root -g)/swarmhack-cli/config/swarmhack.yaml ./config/
```

CLI Usage

Single Target

# Full kill chain scan
swarmhack spawn \
  --target "http://example.com" \
  --customer "your-customer" \
  --token "your-token"

# Specific agents only
swarmhack spawn --agents sqli,xss,csrf \
  --target "http://example.com" \
  --customer "your-customer" \
  --token "your-token"

# AD domain controller scan
swarmhack spawn \
  --target 192.168.56.10 \
  --customer "your-customer" \
  --token "your-token"

Multi-Target Campaign (NEW in v2.5.0)

# Scan multiple targets — credentials from Host A are shared with Host B
swarmhack spawn \
  --target-list "192.168.56.10,192.168.56.11,10.0.0.1" \
  --customer "your-customer" \
  --token "your-token"

# Scan entire subnet (CIDR)
swarmhack spawn \
  --target-list "10.0.0.0/24" \
  --customer "your-customer" \
  --token "your-token"

# Mixed targets: IPs + URLs + hostnames + CIDR
swarmhack spawn \
  --target-list "192.168.56.10,https://app.corp.local,10.0.0.0/24" \
  --customer "your-customer" \
  --token "your-token"

Campaign output:

Unified mission-*.json with all findings across all targets
mission-*-attack-path.html showing network topology with all hosts
Per-target reports in reports/per-target/
Unreachable hosts gracefully skipped

SSE Assessment — Cisco Secure Access (NEW in v3.0.0)

# Run the full SSE suite against a Cisco Secure Access tenant and emit the
# Exploit-Validated Upsell Opportunity Report (dollar-risk + Cisco SKU tier-gap).
swarmhack spawn \
  --target https://customer-sse-frontend \
  --sse-pac config/sse-engagement.yaml \
  --report sse \
  --customer "your-customer" --token "your-token" \
  --authz-doc config/authz.json

The --sse-pac <profile.yaml> engagement profile carries each SSE agent's endpoints and policy (ZTNA origins, DNS resolver, DLP upload paths, SWG proxy, identity matrix, egress pool, SIEM URL, …) and auto-enables SSE phase routing. Outputs:

reports/<mission>.sse.md — board one-pager (§0): total $ exposure, Cisco Essentials→Advantage upsell at N seats + 3-yr TCV, top exposures, attack chains (§5a), MITRE ATT&CK coverage + Navigator layer (§5b), attack-path diagrams (§5c), license/SKU map.
Each finding is bannered GREEN (direct proof) / AMBER (needs the host enrolled through Secure Access) / RED (does not reflect real Cisco enforcement) — honest by design.

# Renewal-cadence before/after delta (which gaps closed since last engagement)
swarmhack scorecard --before prior.json --after current.json --report sse-delta

Docker Mode

# Run in Docker mode (isolated execution)
swarmhack spawn --agents sqli \
  --target "http://example.com" \
  --runtime docker \
  --docker-image "swarmhack/pentest:latest"

# Run multiple agents
swarmhack spawn --agents sqli,xss,csrf \
  --target "http://example.com" \
  --customer "your-customer" \
  --token "your-token"

# Run in Docker with custom image and volumes
swarmhack spawn --agents sqli \
  --target "http://example.com" \
  --runtime docker \
  --docker-image "myregistry/swarmhack:v1.0" \
  --docker-volume "/host/reports:/app/reports"

# List available agents
swarmhack agents list

# Check system health
swarmhack doctor

Runtime Modes

SwarmHack supports two runtime modes:

| Mode | Description | Use Case | |------|-------------|----------| | local | Run directly on host system | Development, CI/CD with pre-installed tools | | docker | Run inside Docker containers | Production, isolated execution, portable |

CLI Runtime Options

| Option | Description | |--------|-------------| | --runtime | Runtime mode: local (default) or docker | | --docker-image | Docker image to use (overrides config) | | --docker-container | Custom container name | | --docker-volume | Additional volumes (can be repeated) | | --docker-env | Environment variables (format: KEY=VALUE) |

Config File Runtime Options

# In config/swarmhack.yaml
runtime:
  mode: docker  # or "local"
  docker_image: swarmhack/pentest:latest
  docker_auto_remove: true
  docker_volumes:
    - /host/reports:/app/reports
  docker_env:
    CUSTOM_VAR: value
  docker_network: bridge
  docker_resources:
    memory: 1g
    cpus: "1"

Node.js API

const swarmhack = require('swarmhack-cli');

// Run a scan
const results = await swarmhack.scan({
  target: 'http://example.com',
  agents: ['sqli', 'xss'],
  customer: 'your-customer',
  token: 'your-token',
});

console.log(results);

// Check version
const version = await swarmhack.version();
console.log(version);

// Run any command
const result = await swarmhack.run(['spawn', '--help']);
console.log(result.stdout);

Supported Platforms

| Platform | Architecture | |----------|--------------| | Linux | x64, arm64 | | macOS | x64, arm64 | | Windows | x64 |

Docker Alternative

If npm installation fails, use Docker:

docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd)/reports:/app/reports \
  prancer/swarmhack:3.0.0 \
  spawn --agents sqli --target "http://example.com" \
  --customer "your-customer" --token "your-token"

Ubuntu 24.04 all-in-one image (build from source)

Dockerfile.ubuntu24 ships the binary plus every external tool (web + AD + network + SSE) so any discipline runs self-contained (needs ≥ 6 GB Docker memory to build):

docker build -f Dockerfile.ubuntu24 -t swarmhack:ubuntu24 .

# SSE engagement against a Cisco Secure Access tenant
docker run --rm -v "$PWD/reports:/app/reports" -v "$PWD/config:/app/config:ro" \
  swarmhack:ubuntu24 spawn \
    --target https://customer-sse-frontend \
    --sse-pac config/sse-engagement.yaml --report sse \
    --token "$PRANCER_TOKEN" --customer "$PRANCER_CUSTOMER" \
    --authz-doc config/authz.json

Authenticated Scanning

SwarmHack supports authenticated scanning using custom HTTP headers. This enables testing of post-authentication attack surfaces that are invisible to unauthenticated scans.

Using Session Cookies

swarmhack spawn \
  --target "https://your-app.com" \
  --header "Cookie: session=abc123def456" \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

Using Bearer Tokens

swarmhack spawn \
  --target "https://api.your-app.com" \
  --header "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

Using Multiple Headers

swarmhack spawn \
  --target "https://your-app.com" \
  --header "Cookie: session=abc123" \
  --header "X-API-Key: your-api-key-here" \
  --header "X-Tenant-ID: customer-123" \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

Using Basic Auth

swarmhack spawn \
  --target "https://your-app.com" \
  --header "Authorization: Basic YWRtaW46cGFzc3dvcmQ=" \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

Tips for Authenticated Scanning

Get a fresh session token before scanning -- expired sessions produce false negatives
Use a test account with appropriate permissions -- avoid scanning with admin credentials unless testing privilege escalation
Set appropriate timeout -- authenticated scans discover more endpoints, so allow more time: --timeout 1200
Monitor session validity -- some apps invalidate sessions after unusual activity patterns
The --header flag is repeatable -- add as many custom headers as needed
All agents (SQLi, XSS, CSRF, etc.) automatically include your custom headers in every request

Available Agents (75)

Web/API exploit family (23):

| Agent | CWE | Description | |-------|-----|-------------| | crawler | — | Web crawling, form discovery, WAF detection | | sqli | CWE-89 | SQL injection (UNION, boolean, error, time-based) | | xss | CWE-79 | Cross-site scripting (reflected, stored, DOM, blind) | | cmdi | CWE-78 | Command injection with marker-based detection | | csrf | CWE-352 | Cross-site request forgery | | idor | CWE-639 | Insecure direct object reference | | auth_bypass | CWE-287 | Authentication bypass | | ssrf | CWE-918 | Server-side request forgery (IMDS probes) | | lfi | CWE-22 | Local file inclusion / path traversal | | ssti | CWE-1336 | Server-side template injection | | open_redirect | CWE-601 | Open redirect | | cors | CWE-942 | CORS misconfiguration | | jwt | CWE-345 | JWT vulnerabilities (alg:none, confusion) | | xxe | CWE-611 | XML external entity injection | | file_upload | CWE-434 | File upload vulnerabilities | | deserialization | CWE-502 | Insecure deserialization | | http_smuggling | CWE-444 | HTTP request smuggling (CL.TE/TE.CL) | | session_fixation | CWE-384 | Session fixation and invalidation testing | | dangerous_methods | CWE-16 | Dangerous HTTP methods (TRACE/XST, PUT upload) | | default_credentials | CWE-798 | Default credential scanning (20 pairs) | | privilege_escalation | CWE-862 | Function-level access control testing | | mass_assignment | CWE-915 | Mass assignment / parameter injection | | vulnerable_components | CWE-1035 | Version fingerprinting + CVE lookup (30 CVEs) | | pivot | — | SSH lateral movement, tunnel scanning, credential reuse | | idor (enhanced) | CWE-639 | Object reference enumeration with credential correlation | | nmap_scanner | — | Port discovery, service detection, NSE vulnerability scanning | | ftp_probe | CWE-287 | FTP anonymous login, default credentials, banner analysis | | ssh_probe | CWE-327 | SSH banner analysis, weak version CVE detection | | ldap_enum | CWE-284 | AD enumeration (10 categories: users, SPNs, delegation, trusts, policy) | | ldap_spray | CWE-307 | LDAP password spray with lockout-safe threshold detection | | kerberos_attack | CWE-522 | AS-REP roasting + Kerberoasting (TGS hash extraction) | | smb_enum | CWE-200 | SMB null session, signing check, GPP password scraping | | mssql_probe | CWE-798 | MSSQL default credentials, linked servers, xp_cmdshell | | dcsync | CWE-522 | DCSync credential extraction via secretsdump | | winrm_probe | CWE-287 | WinRM lateral movement via evil-winrm/crackmapexec | | ntlm_capture | CWE-522 | NTLM hash capture via Responder (opt-in) | | acl_abuse | CWE-284 | BloodHound-style ACL path discovery and exploitation | | hash_crack | CWE-521 | Offline hash cracking with feedback loop | | pth_agent | CWE-522 | Pass-the-Hash lateral movement via impacket | | cred_dump | CWE-522 | SAM/LSA credential dumping | | adcs_exploit | CWE-295 | ADCS ESC1-ESC15 certificate abuse via certipy | | delegation_exploit | CWE-284 | Constrained/RBCD/unconstrained Kerberos delegation | | laps_reader | CWE-522 | LAPS local admin password extraction | | shadow_creds | CWE-284 | Shadow credentials via pywhisker/certipy | | gpo_abuse | CWE-284 | GPO modification for scheduled task deployment | | trust_exploit | CWE-200 | Cross-forest SID History exploitation | | gmsa_reader | CWE-522 | gMSA service account password reading | | auth_coercion | CWE-287 | PrinterBug/PetitPotam authentication coercion |

New AD / identity agents (v2.6.0 — 11 added):

| Agent | CWE | Description | |-------|-----|-------------| | nopac | CWE-287 | noPac / sAMAccountName spoofing (CVE-2021-42278/42287) — native Kerberos + LDAP | | zerologon | CWE-1390 | ZerOlogon (CVE-2020-1472) — gated behind --allow-zerologon (default-deny) | | ntlm_relay | CWE-345 | NTLM relay to LDAPS / SMB / HTTP — gated behind --allow-ntlm-relay | | ntlm_downgrade | CWE-757 | NTLM downgrade detection (LDAP signing / channel binding) | | kerbrute | CWE-200 | Native AS-REQ user enumeration with lockout-safe throttling | | sccm_naa | CWE-522 | SCCM Network Access Account secret retrieval | | sccm_pxe | CWE-256 | SCCM PXE boot media credential extraction | | sccm_relay | CWE-345 | SCCM NTLM relay to AdminService | | ticket_forge | CWE-345 | Kerberos ticket forgery (Golden / Silver / Diamond / Sapphire) — offline crypto, no network | | flag_collector | CWE-200 | SMB + WSMan / SSH file retrieval (GOAD-style flag capture) | | entra_attacks | CWE-287 | Microsoft Entra ID hybrid: PRT replay, Seamless SSO abuse, PHS compromise |

Cisco Secure Access SSE family (v2.6.0 — 16 new agents):

These agents probe SSE controls (not just CVEs) and emit findings keyed to specific Cisco Secure Access SKUs via the capability map. Used with --report sse to produce the Cisco Secure Access — Exploit-Validated Upsell Opportunity Report.

| Agent | Cisco SKU it informs | Description | |-------|----------------------|-------------| | sse_ztna | Cisco Secure Access — Private App Access | ZTNA bypass: unauthenticated reach, origin hardening, identity-aware policy enforcement | | sse_identity | Cisco Duo + Secure Access — Identity-Aware Policy | MFA/step-up enforcement and session revocation latency | | sse_device_posture | Cisco Secure Client + Posture Profiles | Posture-asserting header / cert / managed-device gates | | sse_traffic_steering | Cisco Secure Access — App Connector + DNS Sinkhole | Egress bypass detection (no_proxy, alt resolvers, direct egress) | | sse_dns | Cisco Umbrella DNS Security — Blocklist + Tunneling Detection | DNS blocklist enforcement + tunneling/C2 beacon detection | | sse_swg | Cisco Secure Access SWG — URL Categories + File Inspection | Category bypass (gambling/adult/phishing reach), EICAR / AMP file inspection | | sse_casb | Cisco Secure Access CASB — SaaS Inventory + Tenant Restrictions | Sanctioned/unsanctioned SaaS reach, corp-vs-personal tenant gating | | sse_dlp | Cisco Secure Access — Inline DLP | PII / PCI / PHI / secrets exfil channel testing (multipart, form, JSON, raw) | | sse_fwaas | Cisco Secure Access FWaaS | L4 + L7 outbound policy + app control bypass | | sse_rbi | Cisco Secure Access RBI (Remote Browser Isolation) | Native-render-vs-isolated determination on high-risk URL classes | | sse_genai | Cisco Secure Access — GenAI Policy + Inline DLP for GenAI | LLM prompt-as-exfil channel testing across vendors | | sse_policy_assurance | Cisco Secure Access — Unified Policy Engine | Cross-capability policy conflict + stale-exception detection | | sse_observability | Cisco Secure Access — Activity Search + SIEM Forwarding | Log-correlation latency budget enforcement; IR chain assembly | | sse_shadow_asset | Cisco SSE expansion-candidate asset onboarding | Shadow-asset OSINT (CT logs, passive DNS, RDAP) with protected_apps cross-check | | sse_c2 | Cisco Secure Access — Multi-Control C2 Correlation | Simulated DNS+HTTPS+TCP C2 beacons against operator-owned callback FQDN | | sse_scorecard | (Scorecard self-summary) | Synthesizer: per-domain scoring + Cisco capability mapping + executive narrative |

Key functions added in v2.6.0:

render_upsell_report() (src/reporting/sse_markdown_report.rs) — produces the 8-section customer-facing upsell Markdown.
compute_delta() + render_delta_report() (src/reporting/sse_delta_renderer.rs) — before/after comparator for renewal-cadence engagements.
build_actions_for_goal() (src/agents/goap_planner.rs) — goal-scoped action pruning for the GOAP A* planner.
AgentContext::is_host_in_scope() (src/memory/mod.rs) — strict label-boundary scope check, called by 61 networking agents at every cross-origin probe.
AgentContext::global_rate_limiter() — orchestrator-stamped Arc<GlobalRateLimiter> consumed by 36 RateLimitedClient::new call sites.
VulnerabilityCategory::Sse(String) — typed enum variant that carries the SSE category token through OCSF emission and dedup paths.
build_actions_for_goal() + GOAPPlanner::new_with_goal_pruning() — goal-scoped action pruning that collapses the 68-action library to ~6 for a 3-goal SQLi kill chain.
is_swg_test_url() (src/agents/sse_swg/agent.rs) — documented allowlist that lets the SWG agent probe well-known external test corpora (EICAR, category samples) without violating the per-engagement authz scope.
--allow-zerologon, --allow-ntlm-relay, --blast-radius, --pci-compliance, --use-goap-planning CLI flags — all default-deny / default-off opt-ins for risky operations.

OCSF Reports

SwarmHack generates reports in OCSF 1.1.0 format, the industry standard for security findings.

Single target:

{
  "scan_info": {
    "scanner": { "name": "SwarmHack", "vendor": "Prancer" },
    "customer": "your-customer",
    "target": "http://example.com",
    "summary": { "findings_count": 9, "crown_jewels_count": 23 }
  },
  "compliance_summary": { "frameworks_covered": ["PCI-DSS 4.0", "OWASP Top 10", "NIST CSF 2.0", ...] },
  "findings": [...]
}

Multi-target campaign:

{
  "scan_info": {
    "mission_type": "multi-target",
    "targets_scanned": 4,
    "targets_total": 5,
    "summary": { "findings_count": 20, "crown_jewels_count": 28 },
    "per_target": [
      { "target": "http://192.168.56.10/", "findings_count": 6, "crown_jewels_count": 4 },
      { "target": "https://demo.testfire.net/", "findings_count": 7, "crown_jewels_count": 22 }
    ]
  },
  "findings": [/* all findings from all targets combined */]
}

Each finding includes:

Severity + risk score + confidence
CWE classification + MITRE ATT&CK mapping
Compliance mappings (PCI-DSS, OWASP, NIST, SOC2, HIPAA, ISO 27001, DORA, NIS2)
Crown jewels (extracted credentials, hashes, sensitive data)
Device type identification (Router, Printer, NAS, etc.)

Authentication

SwarmHack requires Prancer Portal authentication:

swarmhack spawn \
  --target "http://example.com" \
  --agents sqli,xss \
  --customer "your-customer" \
  --token "your-32-char-token"

Get your token from Prancer Portal → Settings → Access Tokens.

Requirements

Node.js 16+
Prancer Portal account (for --token and --customer)

Changelog

v3.0.0

SSE cross-domain kill-chain chaining (ADR-SSE-030) — SseAttackChain synthesizer correlates SSE findings into typed attack narratives; report ## 5a., delta ## 4a. chain tracking, CHAIN.* capability-map bundle rows.
FAIR/ALE dollar-risk engine (ADR-SSE-031) — per-finding $ exposure (low/expected/high) with cited IBM/Verizon costs, chain amplification, incident-average clamps; assumptions flagged + configurable (src/reporting/sse_risk_quant.rs).
Cisco SKU tier-gap upsell engine (ADR-SSE-031) — Essentials→Advantage whole-estate rule, per-seat delta + 3-yr TCV + seat-matched add-ons; config-gap vs upsell distinction (src/reporting/sse_tier_gap.rs).
Executive board one-pager + MITRE Navigator + Mermaid diagrams (ADR-SSE-031) — report ## 0. briefing, ## 5b. ATT&CK coverage + uploadable Navigator layer JSON, ## 5c. attack-path diagrams (mitre::to_navigator_layer).
Production --sse-pac path (ADR-SSE-032) — engagement-profile loader + per-agent metadata bridge + auto-enable SSE routing + emit-time scorecard synthesis; runs the SSE suite against a real Cisco tenant via swarmhack spawn (src/core/sse_pac_profile.rs). GREEN/AMBER/RED routing-honesty classifier.
Network lateral movement validated — exploit → credential harvest → SSH foothold → tunnel through dual-homed pivot → internal-host scan, with credential-masking + reachable-gateway fixes; Lateral Movement via SSH finding emitted.
AD validated against GOAD — SMB default cred, ADCS ESC1, AD ACL GenericAll abuse, AS-REP roast (55 targets), anonymous LDAP bind.
Ubuntu 24.04 all-in-one Docker image (Dockerfile.ubuntu24) — builds the binary + ships the full external toolset (impacket, NetExec/crackmapexec alias, certipy, bloodhound, evil-winrm, responder, freerdp, mongosh, nmap/ncat/hashcat/john/tsql/…), verified at build time.
All additive: existing OCSF, scorecard, upsell-report, and delta contracts preserved (golden tests intact). Major version bump for the new SSE platform surface + production CLI path.

v2.6.0

Cisco Secure Access SSE upsell engine (ADR-SSE-025/026/027/028/029) — --report sse produces the 8-section Exploit-Validated Upsell Opportunity Report mapping every finding to a specific Cisco SKU.
16 SSE agents added (sse_ztna, sse_identity, sse_device_posture, sse_traffic_steering, sse_dns, sse_swg, sse_casb, sse_dlp, sse_fwaas, sse_rbi, sse_genai, sse_policy_assurance, sse_observability, sse_shadow_asset, sse_c2, sse_scorecard).
11 new AD/identity agents (nopac, zerologon, ntlm_relay, ntlm_downgrade, kerbrute, sccm_naa/pxe/relay, ticket_forge, flag_collector, entra_attacks).
47-entry Cisco capability map (33 SSE scenarios + 14 legacy CWE → Cisco SKU mappings) in config/cisco_sse_capability_map.yaml.
Per-agent runtime authz scope check (X8) — 61 networking agents refuse out-of-scope hosts at every network call; strict label-boundary wildcard matching.
Three destructive-attack safety gates — --allow-zerologon, --allow-ntlm-relay, --blast-radius {recon,exploit,destructive}; all default-deny.
OCSF 1.1.0 strict — class_uid=2001, category_uid=2, validator hard-errors on mismatch; SSE category emitted as typed VulnerabilityCategory::Sse(String) variant.
GOAP A planner properly fixed* — HashSet<WorldState> closed-set + parent-pointer path + build_actions_for_goal() goal-scoped pruning. Failing 3-goal kill-chain test: 14-hour hang → 0.19-second pass (17,100× speedup).
Agent-pool deadlock fix — semaphore 25 → 64 + bounded acquire_slot with 30s timeout. Full-discovery run completes in 121 s.
GlobalRateLimiter wired — 36 RateLimitedClient::new sites consume AgentContext::global_rate_limiter(); WAF-evasion friction under parallel execution restored.
Authorization-document footer threading — §8 of the upsell report cites the exact --authz-doc path and tester from the JSON.
TLS verification on by default everywhere — pre-flight reachability probe (SWARMHACK_INSECURE_PREFLIGHT_TLS=1 opt-in) and recon banner-fetch (SWARMHACK_INSECURE_BANNER_TLS=1 opt-in).
Authz wildcard label-boundary fix — core::authorization::is_target_authorized no longer matches dev.acme.com.evil.com against *.acme.com.
15 SSE agents migrated to typed Sse(String) category — full X1 closure across the SSE family.
138 new X8 scope-gate regression tests + 3 deadlock regression tests + 6 GOAP planner tests + comprehensive sse_swg / sse_observability / sse_dns / sse_ztna / sse_dlp tests.
4533 lib tests pass, 0 failed.
75 agents total (23 web + 34 AD/identity/network + 18 SSE family).

v2.5.0

Multi-target campaigns: --target-list with comma-separated IPs, URLs, hostnames, CIDR ranges
CIDR expansion: 10.0.0.0/24 → 254 hosts, up to /16 supported
Campaign intelligence graph: credentials from Host A seed Host B (petgraph + DashMap)
Unified OCSF report: single mission-*.json with all targets combined
Network attack path visualization: D3.js HTML with host topology, device types, detail panel, intel flow
Host recon: reverse DNS + HTTP banner + MAC vendor → device type classification
Graceful unreachable skip: offline hosts skipped cleanly, prior scan data included
Default credential fallback: SMB/WinRM try vagrant:vagrant when null session/campaign creds fail
Network agent findings fix: AD findings now in report + CLI display (was silently dropped)
Quiet campaign mode: per-target banners suppressed, single summary shown
49 regression tests across 15 categories
GOAD lab assessment: 38 attack paths mapped vs SwarmHack capabilities
Validated: 5-target campaign = 20 findings, 28 crown jewels

v2.4.0

BREAKING: Mandatory Prancer Portal authentication — offline mode removed
AD finding category mapping: CWE-307/521/522 → "authentication", CWE-200 → "reconnaissance"
Dynamic affected_resource.type from URL scheme (Directory Service, Kerberos KDC, SMB File Share)
Compliance mappings for AD CWEs (OWASP A07:2021, PCI-DSS 8.3.6, NIST PR.AA-01)
LDIF base64 attribute parsing, empty password policy guard, trust direction decoding
Crown jewel dedup across merged findings, masked value filtering
37 quality regression tests (was 25)
External tool documentation: 38 binaries fully documented with install instructions

v2.3.0

Full AD exploitation pipeline: 23 new network/AD agents (LDAP, Kerberos, SMB, MSSQL, DCSync, WinRM, NTLM, ACL, ADCS, delegation, LAPS, shadow creds, GPO, trust)
6-pass AD kill chain: Discovery → Spray → Kerberoast → Exploit → Lateral → Dominate
Credential chaining via shared memory (spray → Kerberoast → lateral movement)
Blackbox DC discovery: rootDSE + DNS reverse + NetBIOS
OCSF compliance mapping for 8 frameworks (ADR-012)
D3.js attack path visualization (ADR-013)
GOAD lab validated: hodor:hodor credential + tyron.lannister TGS hash extracted
Agent plugin registry with define_plugin! macro (46 plugins total)
Bare IP/hostname target support (auto-prepend http://)
TCP connectivity fallback for non-HTTP targets

v2.1.0

Agent plugin registry (ADR-011): scalable plugin system for 100+ agents (one file + one registry line per agent)
Nmap-first port discovery: canonical entry point, automatic service-to-agent routing
FTP probe agent: anonymous login, default credential testing, banner analysis
SSH probe agent: banner analysis, weak version CVE detection
OCSF 1.1.0 compliance: type_uid=600105, severity_id at finding level, crown jewel dedup, finding sort order
Crown jewel sanitization: 5-rule system (api_key never truncated, format-preserving session tokens)
False positive elimination: LFI tech-stack filter, IDOR no synthetic params, default creds uses discovered form fields, CVE-2021-31166 narrowed
Risk score calibration: Info=1.0, Low=3.0, Medium=5.0, High=7.5, Critical=10.0
Security fixes: shell injection in askpass, TLS verification restored, PII redaction in reports
CI pipeline: cargo test + cargo clippy (was build-only)
83 new regression tests (46 quality fixes + 37 ADR-011 Phase 1)
35 exploit agents (was 32): added nmap_scanner, ftp_probe, ssh_probe

v2.0.0

Confidence calibration system: evidence-based scoring (0.60-1.0) replacing fixed 1.0
Full kill chain automation: web scan -> credential extraction -> SSH pivot -> privilege escalation -> internal scanning
Credential correlation: 12 regex patterns, auto-propagation via Intelligence Bus
Privilege escalation chain synthesis (ADR-009): standalone www-data -> root findings
.env file deep extraction: SSH/DB/API credential parsing from command injection
Internal tunnel scanning (ADR-010): SSH tunnel via portable-pty for internal targets
SSRF CVE correlation: 10-CVE payload map (ProxyLogon, Log4Shell, etc.)
SQLi time-based confirmation: 3-step verification eliminates jitter false positives
XXE confidence grading: tiered 0.60/0.90/1.0 with OOB callback ready
SONA self-learning (Phase 1): ruvector-sona payload trajectory recording
32 exploit agents (was 23): added pivot, enhanced all ADR-003 agents
Smart pivot optimization: port-scan prioritization, 3s SSH ConnectTimeout
Authenticated scanning: --header flag for session cookies, Bearer tokens, API keys

v1.5.0

ADR-006: OWASP Top 10 full coverage -- 6 new agents (SessionFixation, DangerousMethods, DefaultCredentials, PrivilegeEscalation, MassAssignment, VulnerableComponents)
Intelligence Bus: 7 typed intel categories shared across all 23 agents
Runtime vulnerability chaining: credentials/sessions feed consumer agents live
VulnerableComponents agent (OWASP A06): 30 built-in CVE entries
CVSS score fix (was always 0.0), GOAP precondition key unification
SwarmHackConfig wrapped in Arc (performance), agent pool 20->25
Live validated: 16 findings, 67 crown jewels, 0 false positives across 3 targets

v1.4.0

Hybrid execution mode (Kill Chain + AEL amplification)
SPA false positive elimination
Auth crawling and OCSF auth tracking
Common endpoint discovery (107 paths)
Version bump and CI adjustments

v1.3.0

ADR-005: Self-learning intelligence layer (SONA, WAF evasion learning, adaptive rate limiting)
ADR-005: Semantic deduplication + crown jewel ML matching
ADR-005: Real HNSW vector index (replaced HashMap stub)
ADR-004: Recursive swarm architecture with 6 trigger types
Pre-flight authentication (5 methods via --auth)
Checkpoint-on-detection for all 17 agents
UTF-8 safety fix (28 byte-slicing sites)
147 new tests across intelligence layer

v1.2.0

ADR-004: Recursive swarm + auth config + tech debt remediation
CI hardening (test gates, pipefail)
Version bump and dependency cleanup

v1.1.0

ADR-003: 10 new exploit agents (SSRF, LFI, SSTI, CORS, JWT, XXE, FileUpload, Deserialization, HTTPSmuggling, OpenRedirect)
ADR-001: Parallel agent execution (4x speedup)
ADR-002: curl/nc deep exploitation

v0.2.0

Runtime mode selection (local/docker)
OCSF 1.1.0 report generation
Prancer Portal authentication

v0.1.0

Initial release

License

MIT

Published

Vulnerabilities

Links

Maintainers

Keywords

Readme

swarmhack-cli

What's New in v3.0.0

Cisco SSE Sales-Enabler Platform

Network pentesting — full lateral movement, validated

Active Directory pentesting — validated against GOAD

Ubuntu 24.04 all-in-one Docker image

What's New in v2.6.0

What's New in v2.5.0

Installation

Configuration

CLI Usage

Single Target

Multi-Target Campaign (NEW in v2.5.0)

SSE Assessment — Cisco Secure Access (NEW in v3.0.0)

Docker Mode

Runtime Modes

CLI Runtime Options

Config File Runtime Options

Node.js API

Supported Platforms

Docker Alternative

Ubuntu 24.04 all-in-one image (build from source)

Authenticated Scanning

Using Session Cookies

Using Bearer Tokens

Using Multiple Headers

Using Basic Auth

Tips for Authenticated Scanning

Available Agents (75)

OCSF Reports

Authentication

Requirements

Changelog

v3.0.0

v2.6.0

v2.5.0

v2.4.0

v2.3.0

v2.1.0

v2.0.0

v1.5.0

v1.4.0

v1.3.0

v1.2.0

v1.1.0

v0.2.0

v0.1.0

License