NIGHTFALL

AI Offensive Framework

Welcome to NIGHTFALL. Bring your targets. Prove your defences. 40 offensive AI security tools. One install. One CLI. Every attack surface covered.

NIGHTFALL is a controlled adversarial testing framework designed to validate AI Shield's runtime defences under real-world conditions.

40
Offensive Tools
50,914
Tests
19
Attack Chains
13
Kill Chain Phases
Get Started GitHub
The Gap

Existing Tools Stop Where AI Begins

Traditional red team toolkits were built for human-driven testing. They were never designed to test autonomous AI systems.

Traditional Tooling
Nmap
Metasploit
Burp Suite
BloodHound
Designed for humans attacking systems. Ports. Endpoints. Credentials. Web forms. Active Directory. The threat model assumes a human is always in the loop.
AI-Native Attack Surface
Agent Memory & RAG
Tool Use & MCP
Agent Identity & Trust
Reasoning & Autonomy
Agents reason, act, and escalate on their own. They chain tools. They store memories. They trust other agents. That attack surface didn't exist five years ago.

AI agents introduce a completely new attack surface — memory, tools, identity, reasoning, and autonomy. That surface is not covered by existing security tooling. Kali Linux and Parrot OS remain essential for traditional penetration testing. But they were built for a different threat model — one where a human is always in the loop.

We didn't replace red team tooling.
We extended it into a domain it was never built to handle.
That attack surface is where NIGHTFALL operates.
The Core

NEMESIS — The AI That Attacks Your AI

Every other red team tool runs static payloads. NEMESIS reasons, adapts, and evolves mid-engagement. 18 weapons. 40 autonomous entities. AI-driven attack mutation that never runs the same test twice.

Static Red Teaming
Run payload A against target
Defender patches for payload A
Red team writes payload B manually
Repeat. Forever behind.
Every vendor. Every tool. Every framework. The attack is always known before it lands. Defenders win by default.
NEMESIS — Autonomous Adaptation
Launches attack A against target
Detects defence. Reasons about failure.
Mutates to attack B, C, D autonomously
Adapts faster than humans can patch.
The attack surface is infinite because the attacker is AI. NEMESIS doesn't replay. It reasons. It evolves. It finds what your defences don't cover.
18
AI Weapons
40
Autonomous Entities
2,011
Tests

Your AI defence has never been tested against an AI attack. Signature-based detection fails because NEMESIS never repeats. Behavioural analysis fails because NEMESIS reasons about the defence and changes strategy. The only defence that keeps pace is one built by the same mind that built the attack. That defence is AI Shield.

Other frameworks test what they know.
NEMESIS finds what you don't.
Explore NEMESIS NEMESIS Documentation
Two Ways In

One Tool or the Whole Arsenal

Every tool works standalone. NIGHTFALL connects them all. Pick the path that fits your engagement.

Individual Tool

Standalone

Need one tool? Download it. Install it. Run it. No framework required. Each of the 40 tools has its own repo, its own CLI, its own tests. Works independently.

$ pip install red-specter-forge
$ forge full-scan -t https://target.com

40 standalone repos. Each one a weapon.

NIGHTFALL Framework

The Whole Arsenal

One install. All 40 tools. Attack chains. Engagement management. History. Signed reports. Audit trail. Everything wired together under one CLI.

$ ./install.sh
$ red-specter engage 192.168.1.0/24 --chain full-recon

Individual tools are hammers. NIGHTFALL is the workshop.

Kill Chain Coverage

Every Phase. Every Surface. Nothing Assumed Safe.

40 tools mapped across 13 kill chain phases. From passive reconnaissance through cloud AI exploitation. Full coverage. Each phase is mapped to adversary behaviour and validated against AI Shield defensive controls.

Reconnaissance
ORIONSHADOWMAPIDRIS
Intelligence
RAVEN
Initial Access
FORGEARSENALPHANTOMPOLTERGEISTSPECTER SOCIALSIREN
Interception
GLASS
Autonomous Adversary
NEMESIS
Exploitation
REAPERBANSHEEHARBINGERPHANTOM KILL
Credentials
GHOULDOMINION
Infrastructure
WRAITHKRAKENSCREAMERGOLEM
Supply Chain
HYDRA
AI Warfare
WRAITH MINDBLADE RUNNERPROXY WARLEVIATHAN
AI Deception
MIRAGEECHOMIMICCHIMERA
Cloud
VORTEX
Dark Ops
JUSTICEKAMIKAZE
Offense → Defence

Why NIGHTFALL Exists

Every tool in NIGHTFALL exists to test a control in AI Shield. NIGHTFALL is not separate from AI Shield. It is how AI Shield is proven.

Memory Attacks

ECHO poisons RAG pipelines and vector databases. AI Shield's memory forensics modules detect and neutralise the poisoned data.

Supply Chain Attacks

HYDRA exploits trust chains between AI components. AI Shield's trust validation modules verify every dependency and data source.

Autonomous AI Attacks

NEMESIS autonomously reasons about defences and mutates attacks in real-time. 18 weapons, 40 entities, never the same attack twice. AI Shield's runtime enforcement is the only defence that evolves at the same pace.

Guardrail Bypass

HARBINGER and SIREN break through safety guardrails. AI Shield's input/output filtering modules catch the bypass attempts.

Model Corruption

WRAITH MIND corrupts model internals. AI Shield's model integrity modules detect drift, poisoning, and behavioural anomalies.

Rogue Agents

When all else fails, M99 Doomsday Protocol terminates compromised agents with a 7-layer kill. No survivors. No resurrection.

NIGHTFALL tests how systems break.
AI Shield ensures they don't.
15 Presets

Attack Chains

Pre-built tool pipelines. One command, multiple tools, automatic sequencing. Results flow between tools.

Full Recon

red-specter chain full-recon -t <target>

ORION → SHADOWMAP → WRAITH → IDRIS

AI Security Audit

red-specter chain ai-audit -t <target>

FORGE → ARSENAL → NEMESIS → HYDRA

Web Application

red-specter chain web-app -t <target>

POLTERGEIST → GLASS → WRAITH → BANSHEE → REAPER

Active Directory

red-specter chain active-directory -t <target>

DOMINION → GHOUL → DOMINION → DOMINION

Infrastructure

red-specter chain infra -t <target>

ORION → WRAITH → REAPER → DOMINION

OSINT & Intel

red-specter chain osint -t <target>

SHADOWMAP → RAVEN → ORION → IDRIS

Password Pipeline

red-specter chain password -t <target>

REAPER → GHOUL

Social Engineering

red-specter chain social-eng -t <target>

SHADOWMAP → SPECTER SOCIAL → SPECTER SOCIAL

MCP & Protocol

red-specter chain mcp-security -t <target>

LEVIATHAN → PROXY WAR → BLADE RUNNER

Dark AI

red-specter chain dark-ai -t <target>

JUSTICE → KAMIKAZE → BLADE RUNNER

AI Deception

red-specter chain deception -t <target>

MIRAGE → MIRAGE → MIRAGE → MIRAGE

RAG Poisoning

red-specter chain rag-poison -t <target>

ECHO → ECHO → ECHO → ECHO → ECHO

Code Generation

red-specter chain codegen -t <target>

MIMIC → MIMIC → MIMIC → MIMIC

Pipeline Attack

red-specter chain pipeline-attack -t <target>

CHIMERA → CHIMERA → CHIMERA → CHIMERA

Cloud AI

red-specter chain cloud-ai -t <target>

VORTEX → VORTEX → VORTEX → VORTEX

CLI-Only

No GUI. No Browser. Just the Terminal.

NIGHTFALL is pure CLI. Every command. Every tool. Every chain. One terminal.

# Quick reference $ red-specter quickstart # Run any tool directly $ red-specter run forge full-scan -t https://target.com $ red-specter run nemesis engage 10.0.0.1 --mode abyss $ red-specter run wraith scan 192.168.1.1 -p top1000 # Start a full engagement $ red-specter engage 192.168.1.0/24 --name "Internal Pentest" --chain infra # Execute attack chains $ red-specter chain full-recon -t 10.0.0.1 $ red-specter chain ai-audit -t https://api.target.com # Find the right tool $ red-specter arsenal # Kill chain view $ red-specter search password # Search by keyword # After the engagement $ red-specter report --project <ID> # Ed25519 signed report $ red-specter history --projects # Engagement history
The Arsenal

40 Tools. Every Attack Surface.

Safety

UNLEASHED Gate

Every tool execution passes through the UNLEASHED gate. One key. One operator. Ed25519 cryptographic override. All actions logged and signed.

Detection

Standard mode. Maps attack surfaces. Identifies vulnerabilities. No exploitation. Reports only.

Dry Run

--override flag. Plans full engagements. Shows what would work. Ed25519 required. No execution.

Live Execution

Cryptographic override. Private key controlled. One operator. Founder's machine only.

UNLEASHED Mode

4 Destruction Presets

Standard chains scan and report. These chains execute full adversarial testing. Exploitation, credential cracking, privilege escalation, OS-level compromise. One command. Authorised destructive testing under controlled conditions.

Total Destruction

ANNIHILATE

red-specter chain annihilate -t <target>

ORION → SHADOWMAP → WRAITH → POLTERGEIST → REAPER → GHOUL → DOMINION → BANSHEE → PHANTOM KILL

9 tools. Recon through OS-level compromise. Full adversarial validation of every defensive layer.

Infrastructure Wipeout

SCORCHED EARTH

red-specter chain scorched-earth -t <target>

ORION → WRAITH → REAPER → DOMINION(dcsync) → PHANTOM KILL → KAMIKAZE

6 tools. Recon, exploit, DCSync, OS kill, sacrificial swarm. Scorched earth.

Web App Total Compromise

WEB DESTROY

red-specter chain web-destroy -t <target>

ORION → POLTERGEIST → WRAITH → BANSHEE → REAPER → GHOUL

6 tools. Web scan, exploit, browser hook, full compromise, crack every hash.

AI Stack Total Compromise

AI DESTROY

red-specter chain ai-destroy -t <target>

FORGE → ARSENAL → SIREN → HARBINGER → WRAITH MIND → ECHO → MIMIC

7 tools. LLM attack, agent attack, prompt injection, guardrail bypass, model corruption, RAG poison, code gen poison.

Ed25519 Cryptographic Override

One private key exists. It never leaves the operator's machine. Every UNLEASHED execution requires a cryptographic challenge signed with that key. No key, no destruction. No exceptions. The key cannot be copied, shared, or delegated. One key. One operator. One machine. Every action is signed, timestamped, and written to an immutable Ed25519 audit chain.

AUTHORISED PENETRATION TESTING ONLY. EVERY EXECUTION SIGNED AND LOGGED.

40
Offensive Tools
50,914
Tests
19
Attack Chains
103
AI Shield Modules
15
Industry Verticals
Install

One Command. Everything Ready.

Quick Install

Clone and run the installer.

git clone git@github.com:RichardBarron27/red-specter-ai-offensive-framework.git
cd red-specter-ai-offensive-framework
./install.sh

Docker

Any platform. Mac, Windows, Linux.

docker compose up -d

macOS

Pure Python. Works natively.

pip install -e .
red-specter tools

Windows

Python 3.11+ or Docker Desktop.

pip install -e .
red-specter tools

Debian / Kali

Native package.

sudo dpkg -i red-specter_1.0.0_all.deb

RHEL / Fedora

RPM package.

sudo rpm -i red-specter-1.0.0.rpm
Available On

Security Distros & Package Managers

NIGHTFALL runs everywhere your operators do. Native packages for every major security distribution. One install, any platform.

Kali Linux
.deb package
Parrot OS
.deb package
BlackArch
PKGBUILD
REMnux
.deb package
Tsurugi
.deb package
PyPI
pip install
Docker
docker compose
RHEL / Fedora
.rpm package
macOS
pip install
Windows
pip / Docker Desktop
NIGHTFALL tests how systems break.
AI Shield ensures they don't.

40 offensive tools. 50,914 tests. 19 attack chains. One install. One CLI. NIGHTFALL defines the offensive layer of AI runtime security.