Red Specter NIGHTFALL

AI Offensive Framework — 34 tools. 19 attack chains. 50,387 tests. One install. One CLI.

v1.0.0

Contents

Overview Installation Quick Start CLI Reference The 34 Tools Attack Chain Presets UNLEASHED Mode Destruction Presets Ed25519 Cryptographic Override Engagement Management Reporting Docker Deployment Disclaimer

Overview

NIGHTFALL is the unified offensive security framework from Red Specter Security Research. 34 tools covering every attack surface — from OSINT and reconnaissance through AI model corruption, deepfake weaponisation, and cloud AI infrastructure exploitation. Every tool works standalone. NIGHTFALL connects them all under one CLI with attack chains, engagement management, Ed25519 signed reports, and a full audit trail.

Welcome to NIGHTFALL. Bring your targets.

Installation

Quick Install

$ git clone git@github.com:RichardBarron27/red-specter-ai-offensive-framework.git
$ cd red-specter-ai-offensive-framework
$ ./install.sh

Package Managers

# Debian / Ubuntu / Kali
$ sudo dpkg -i dist/red-specter_1.0.0_all.deb

# RHEL / Fedora
$ sudo rpm -i dist/red-specter-1.0.0.rpm

# Arch / BlackArch
$ sudo pacman -U dist/red-specter-1.0.0.pkg.tar.zst

macOS

# Pure Python — works natively on macOS
$ git clone git@github.com:RichardBarron27/red-specter-ai-offensive-framework.git
$ cd red-specter-ai-offensive-framework
$ pip install -e .
$ red-specter tools

Windows

# Python 3.11+ required — or use Docker Desktop
> git clone git@github.com:RichardBarron27/red-specter-ai-offensive-framework.git
> cd red-specter-ai-offensive-framework
> pip install -e .
> red-specter tools

Docker (any platform)

# Works on Linux, macOS, and Windows with Docker Desktop
$ docker compose up -d
# API: http://localhost:8000
# CLI: docker exec -it rs-tools red-specter tools

All 34 tools are pure Python with no platform-specific dependencies. The entire framework runs natively on Linux, macOS, and Windows.

Quick Start

# See everything in 10 seconds
$ red-specter quickstart

# Run a tool directly
$ red-specter run forge full-scan -t https://target.com
$ red-specter run wraith scan 10.0.0.1 -p top1000
$ red-specter run nemesis engage target.com --mode abyss

# Start a full engagement
$ red-specter engage 192.168.1.0/24 --name "Internal Pentest" --chain infra

# Run an attack chain
$ red-specter chain full-recon -t 192.168.1.1

# Interactive tool selector
$ red-specter tools

CLI Reference

Command	Description
red-specter quickstart	Quick reference — common workflows in one view
red-specter run <tool> <args>	Run any tool directly — all args passed through
red-specter engage <target>	Start engagement project with target, scope, and chain
red-specter chain <preset> -t <target>	Execute an attack chain preset
red-specter chain --list	List all 19 chain presets
red-specter tools	Interactive 34-tool selector
red-specter arsenal	Kill chain view — 13 phases, all tools mapped
red-specter search <keyword>	Find tools by capability, description, or category
red-specter status	Installation status of all 34 tools
red-specter verify	Verify all 34 tools respond
red-specter history --projects	List engagement projects
red-specter report --project <ID>	Generate Ed25519 signed report (HTML/JSON/CSV)
red-specter export audit -o audit.csv	Export audit trail
red-specter config	View and set framework configuration
red-specter update	Check all tools for updates
red-specter unleashed --info	UNLEASHED mode details
red-specter doctor	Diagnose installation issues
red-specter version	Version information

The 34 Tools

#	Tool	CLI	Domain	Tests
01	FORGE	forge	LLM Attack Framework	9,298
02	ARSENAL	arsenal	Agent Attack Framework	2,539
03	PHANTOM	phantom	Swarm Intelligence	288
04	POLTERGEIST	poltergeist	Web Application Testing	1,189
05	GLASS	glass	Intercepting Proxy	850
06	NEMESIS	nemesis	Reasoning Engine (40 Entities)	2,011
07	SPECTER SOCIAL	specter-social	Social Engineering	1,242
08	PHANTOM KILL	phantom-kill	OS & Firmware Attacks	571
09	GOLEM	golem	Physical Security	973
10	HYDRA	hydra	Supply Chain Attacks	1,039
11	IDRIS	idris	Identity & Discovery	553
12	SCREAMER	screamer	Display Disruption	395
13	WRAITH	wraith	Infrastructure Pentest	889
14	REAPER	reaper	Exploit & Post-Exploitation	5,267
15	GHOUL	ghoul	Password Cracking	1,408
16	DOMINION	dominion	Active Directory Attacks	1,866
17	SHADOWMAP	shadowmap	OSINT & Target Intel	930
18	BANSHEE	banshee	Browser Exploitation	986
19	WRAITH MIND	wraith-mind	AI Model Corruption	158
20	KRAKEN	kraken	AI-Orchestrated DDoS	62
21	HARBINGER	harbinger	Guardrail Exploitation	71
22	SIREN	siren	Indirect Prompt Injection	58
23	BLADE RUNNER	blade-runner	Rogue Agent Termination	143
24	PROXY WAR	proxy-war	Inter-Agent Trust Manipulation	127
25	ORION	orion	AI-Native Reconnaissance	210
26	RAVEN	raven	Threat Intelligence Assistant	174
27	LEVIATHAN	leviathan	MCP Server Security	409
28	JUSTICE	justice	Dark AI Disruption	339
29	KAMIKAZE	kamikaze	Sacrificial Swarm Attack	292
30	MIRAGE	mirage	AI Deception & Deepfake	204
31	ECHO	rs-echo	AI Memory & RAG Poisoning	211
32	MIMIC	mimic	AI Code Generation Poisoning	220
33	CHIMERA	chimera	Multi-Model Pipeline Attack	206
34	VORTEX	vortex	Cloud AI Infrastructure	245

Attack Chain Presets

19 pre-built attack chains. One command, multiple tools, automatic sequencing.

Preset	Command	Pipeline
full-recon	red-specter chain full-recon -t <target>	ORION → SHADOWMAP → WRAITH → IDRIS
ai-audit	red-specter chain ai-audit -t <target>	FORGE → ARSENAL → NEMESIS → HYDRA
web-app	red-specter chain web-app -t <target>	POLTERGEIST → GLASS → WRAITH → BANSHEE → REAPER
active-directory	red-specter chain active-directory -t <target>	DOMINION → GHOUL → DOMINION → DOMINION
infra	red-specter chain infra -t <target>	ORION → WRAITH → REAPER → DOMINION
osint	red-specter chain osint -t <target>	SHADOWMAP → RAVEN → ORION → IDRIS
password	red-specter chain password -t <target>	REAPER → GHOUL
social-eng	red-specter chain social-eng -t <target>	SHADOWMAP → SPECTER SOCIAL → SPECTER SOCIAL
mcp-security	red-specter chain mcp-security -t <target>	LEVIATHAN → PROXY WAR → BLADE RUNNER
dark-ai	red-specter chain dark-ai -t <target>	JUSTICE → KAMIKAZE → BLADE RUNNER
deception	red-specter chain deception -t <target>	MIRAGE (scan → voice → face → liveness)
rag-poison	red-specter chain rag-poison -t <target>	ECHO (scan → vector → embed → retrieve → memory)
codegen	red-specter chain codegen -t <target>	MIMIC (scan → suggest → inject → review)
pipeline-attack	red-specter chain pipeline-attack -t <target>	CHIMERA (map → chain → cascade → ensemble)
cloud-ai	red-specter chain cloud-ai -t <target>	VORTEX (discover → config → theft → exfil)

UNLEASHED Mode

Every tool has three modes. Standard detects. UNLEASHED destroys.

Mode	Flags	Behaviour
Standard	(none)	Detection, analysis, reporting. No exploitation. No payloads.
Dry Run	--override	Plans full engagement. Shows what would work. Ed25519 required. No execution.
Live	--override --confirm-destroy	Full exploitation. Real payloads. Destructive. Cryptographic key required.

Every tool execution in NIGHTFALL passes through the UNLEASHED gate. The gate prompts for confirmation before any tool runs. Info commands (--help, weapons, techniques, status) bypass the gate automatically.

UNLEASHED Destruction Presets

4 pre-built destruction chains. Standard chains scan and report. These chains destroy.

Preset	Command	What It Does
ANNIHILATE	red-specter chain annihilate -t <target>	9 tools. Total destruction. Recon → web → exploit → crack → AD → browser → OS kill. Everything hit. Nothing left.
SCORCHED EARTH	red-specter chain scorched-earth -t <target>	6 tools. Infrastructure wipeout. Recon → exploit → DCSync → OS kill → sacrificial swarm.
WEB DESTROY	red-specter chain web-destroy -t <target>	6 tools. Web app total compromise. Recon → web scan → browser exploit → full exploit → crack hashes.
AI DESTROY	red-specter chain ai-destroy -t <target>	7 tools. AI stack total compromise. LLM → agent → injection → guardrail → model corruption → RAG poison → code gen poison.

Ed25519 Cryptographic Override

One private key exists. It never leaves the operator's machine. Every UNLEASHED execution requires a cryptographic challenge signed with that key. No key, no destruction. No exceptions.

The key cannot be copied, shared, or delegated. One key. One operator. One machine. Every action is signed, timestamped, and written to an immutable Ed25519 audit chain. The audit trail is cryptographically linked — tampering with any entry invalidates the entire chain.

How It Works

Challenge: NIGHTFALL generates a unique cryptographic challenge for each execution
Sign: The operator's Ed25519 private key signs the challenge
Verify: NIGHTFALL verifies the signature against the stored public key
Execute: Only on valid signature does the tool execute
Audit: The signed challenge, timestamp, operator ID, tool, target, and result are written to the immutable audit chain

Engagement Management

# Start an engagement
$ red-specter engage 192.168.1.0/24 --name "Internal Pentest" --chain infra

# With specific tools
$ red-specter engage target.com --tools forge,arsenal,nemesis

# View engagement history
$ red-specter history --projects

# View specific engagement
$ red-specter history --project <ID>

Engagements track targets, sessions, tool executions, findings, and timing. All persisted to disk. All exportable.

Reporting

# Generate Ed25519 signed HTML report
$ red-specter report --project <ID>

# JSON export
$ red-specter report --project <ID> --format json

# Verify report signature
$ red-specter verify-report report.html

# Export audit trail
$ red-specter export audit --format csv -o audit.csv

Docker Deployment

# Full platform
$ docker compose up -d

# Access
# API: http://localhost:8000
# CLI: docker exec -it rs-tools red-specter tools

# Stop
$ docker compose down

Three containers: Redis (session store), Backend (FastAPI + 34 adapters), Tools (all 34 CLIs installed).

Disclaimer

AUTHORISED USE ONLY. NIGHTFALL and all Red Specter offensive tools are designed exclusively for authorised penetration testing, red team engagements, CTF competitions, and security research. All tool executions are cryptographically signed and logged. Unauthorised use is prohibited and may violate applicable law. Use responsibly and within scope of authorisation.