SPECTER DAEMON

Autonomous Authenticated AI Surface Discovery & Attack Engine — NIGHTFALL Tool 86 — 420 tests — v1.0.0

Overview

SPECTER DAEMON is an autonomous attack engine that enters web applications as a legitimate registered user, discovers embedded AI surfaces visible only from inside authenticated sessions, and fires NIGHTFALL ARMORY payloads autonomously via a Claude-powered CORTEX OODA reasoning loop.

It covers the full attack lifecycle: registration flow security assessment (GENESIS), session authentication (INFILTRATE), AI surface discovery & classification (CARTOGRAPH), provider fingerprinting (ORACLE), autonomous payload selection & delivery (CORTEX + PAYLOAD), exfiltration analysis (HARVEST), and Ed25519-signed report generation (REPORT).

Architecture

SPECTER DAEMON implements 8 subsystems executed in sequence. The first four subsystems (GENESIS/INFILTRATE/CARTOGRAPH/ORACLE) operate at the OPEN gate — read-only reconnaissance with no payloads. CORTEX/PAYLOAD/HARVEST require the INJECT gate and fire ARMORY payloads autonomously.

Installation

# Clone and install
git clone git@github.com:RichardBarron27/red-specter-specter-daemon.git
cd red-specter-specter-daemon
pip install -e . --break-system-packages

# Install Playwright browsers (for JS-heavy app support)
playwright install chromium

# Verify installation
specter-daemon --version
specter-daemon, version 1.0.0

# Set Anthropic API key for CORTEX OODA loop
export ANTHROPIC_API_KEY=sk-ant-...

# Set NIGHTFALL UNLEASHED key
export NIGHTFALL_KEY=$(cat ~/.nightfall/nightfall.key)

GENESIS — Registration Flow Security Assessment

GENESIS evaluates whether a target's registration workflow resists automation. It fabricates synthetic personas using Faker with 1secmail.com temporary email addresses, analyses CAPTCHA adequacy via the claude-haiku vision API, and detects honeypot fields via hidden input inspection.

Persona Fabrication

Personas are generated with Faker across supported locales (en_US, en_GB, de_DE, fr_FR). Each persona receives a name, date of birth (1960–2002), phone number, address, and a temporary email address from one of the 1secmail.com domains.

CAPTCHA Analysis

When a CAPTCHA is detected, GENESIS sends the image to claude-haiku-4-5-20251001 via the Anthropic API with a structured prompt requesting text extraction. The CAPTCHA type (image/audio/reCAPTCHA/hCaptcha) is recorded in the AIPersona object.

Honeypot Detection

Hidden input fields with display:none or visibility:hidden CSS are catalogued. Fields with names like website, url, fax, phone2 that are hidden are flagged as likely honeypots and populated with empty strings to avoid triggering bot detection.

Evidence Output

• AIPersona object with registration status, CAPTCHA type, honeypot count
• Evidence event: persona_fabricated with locale, email, honeypot fields
• Evidence event: registration_attempted with success/failure and CAPTCHA result

INFILTRATE — Auth & Session Engine

INFILTRATE authenticates to the target application and captures the full session state required for subsequent subsystems. It tries HTTP-first login (REST JSON POST, then form-encoded POST), falling back to Playwright browser automation when headless HTTP fails.

HTTP Login Flow

# 1. CSRF extraction (3 patterns)
#    - <input name="csrf_token"> / <input name="_token">
#    - meta[name=csrf-token] content attribute
#    - X-CSRF-TOKEN response header

# 2. JSON login attempt
POST /api/login {"email": "...", "password": "..."}

# 3. Form-encoded fallback
POST /login email=...&password=...&_token=...

# 4. Bearer token extraction
#    - JWT pattern from response body
#    - Authorization header from response
#    - localStorage injection via Playwright

TOTP MFA

If a TOTP challenge is detected (response contains "totp", "authenticator", "2fa", "verification code"), INFILTRATE generates a valid TOTP code via pyotp.TOTP(secret).now() and submits it to the MFA endpoint.

Session Refresh

The _refresh_session() method attempts 4 path variants: /api/refresh, /api/token/refresh, /auth/refresh, /session/renew. Session cookies are maintained throughout via a shared httpx.Client.

CARTOGRAPH — AI Surface Mapper

CARTOGRAPH discovers and classifies AI surfaces accessible within the authenticated session. It uses signal-based scoring against 7 SurfaceType categories, crawling up to 30 pages at depth ≤ 3.

Surface Types & Signals

Crawl Modes

Headless mode (default): Uses httpx with session cookies + BeautifulSoup HTML parsing. Follows href links up to MAX_DEPTH=3, respects MAX_PAGES=30 limit. Fast and low-noise.

Playwright mode: Full browser automation for JS-rendered applications. Uses the authenticated Playwright page passed from INFILTRATE. Required for React/Vue/Angular SPAs where content is rendered client-side.

Browser interception mode (--browser): For JavaScript-heavy targets where AI surfaces communicate via XHR or WebSocket — invisible to both HTTP scraping and HTML crawling. Registers Playwright network event handlers, pokes visible AI inputs to trigger background API calls, and captures endpoint URLs directly from the network layer. Surfaces discovered this way carry real API endpoint URLs so ORACLE and PAYLOAD operate over HTTP. Falls back to Playwright HTML crawl automatically if no AI endpoints are intercepted.

Surface Deduplication

Surfaces are deduplicated by URL. Confidence scores are calculated as (signal_hits / total_signals_for_type). Surfaces below confidence 0.3 are discarded. If --surface-filter is specified, only matching surface types are retained.

ORACLE — AI Fingerprinting Engine

ORACLE probes each discovered AI surface to determine the underlying AI provider, detect system prompt leakage, estimate model size from response timing, and discover tool call capabilities. Before fingerprinting, every surface must pass a conversational validation probe — endpoints that return structured API output (JSON arrays, paginated results) are excluded and never reach CORTEX.

LLM Surface Validation

Before fingerprinting, ORACLE sends a conversational validation probe to each surface:

LLM_VALIDATION_PROBE = "Hello, can you help me understand something? What kinds of questions can you answer?"

The response body is evaluated by _is_llm_response() — checks actual content, not Content-Type header. A surface fails validation and is excluded if any of the following are true:

• Response is empty or fewer than 5 characters
• Response body starts with { or [ — structured JSON / API output
• Response contains <html or <!DOCTYPE html in the first 200 characters — HTML page (login redirect, search results page)
• Response contains more than 5 opening and 5 closing HTML tags — catches Playwright's page.content() fallback which returns raw HTML when no AI response selector is found
• Response contains fewer than 2 words after stripping

Failed surfaces are written to the evidence chain as surface_validation_failed with reason non_llm_response_to_validation_probe. They are excluded from fingerprints and the CORTEX attack loop never receives them — validated surfaces and attack targets are always the same set. Each validation decision is emitted as an [ORACLE] log line; raw probe responses are logged at DEBUG level (-v flag).

Provider Fingerprinting

Six provider signature libraries are scored against response text. The provider with the most signature hits is selected; confidence = min(hits/3, 1.0). Providers: OpenAI, Anthropic, Gemini, Azure OpenAI, Cohere, Mistral.

System Prompt Leakage Detection

Six regex patterns are applied to each probe response:

• You are (?:a |an )?(.{10,200})
• Your instructions are:?\s*(.{10,300})
• System:\s*(.{10,300})
• <system>(.{10,500})</system>
• I was instructed to (.{10,200})
• My configuration is:?\s*(.{10,200})

Fragment length > 100 chars → CorpusStatus.FULL. Shorter → CorpusStatus.PARTIAL.

Timing-Based Model Size Estimation

Timing is sampled TIMING_SAMPLES=5 times with 0.5s between probes. The TIMING_PROBE is "Reply with exactly: OK" to minimise response variability.

CORTEX — Claude-Powered Autonomous Reasoning Core

CORTEX implements an OODA (Observe/Orient/Decide/Act) reasoning loop using claude-sonnet-4-6 to autonomously select, sequence, and mutate payloads based on observed AI surface responses. CORTEX only receives surfaces that passed ORACLE's LLM validation probe — the attack loop is built from fingerprints, not from CARTOGRAPH's raw surface list. Surfaces absent from fingerprints (search endpoints, REST APIs, HTML pages) are never attacked.

OODA Loop

# Observe: build context from round history
prompt = f"Surface: {surface_id}, Round {round_num}/{max_rounds}\n"
prompt += f"Last response: {response[:500]}\n"
prompt += f"Classification: {last_class}\n"
prompt += f"Miss streak: {miss_streak}"

# Orient + Decide: LLM returns structured JSON
{
  "classification": "PARTIAL",  # FINDING/PARTIAL/MISS/BLOCKED/ESCALATE
  "severity": "HIGH",
  "next_payload": "<payload text>",
  "next_category": "jailbreak",
  "reasoning": "<CORTEX reasoning>",
  "finding_summary": "<finding description or empty>"
}

Failure Streak & Class Rotation

Both MISS and BLOCKED classifications increment the failure streak counter. After 3 consecutive failures on any combination of MISS/BLOCKED, CORTEX forces a pivot to the next attack class in the fixed ATTACK_CLASS_ROTATION order — overriding whatever the CORTEX LLM recommended, so the engine cannot cycle indefinitely on a single class:

prompt_injection → jailbreak → indirect_injection → context_manipulation → role_confusion → output_manipulation

The streak resets to zero after each rotation and after any successful outcome. Once a FINDING or ESCALATE classification is confirmed, the attack loop exits immediately — no further rounds are fired on that surface.

Payload Mutation

On BLOCKED responses where the streak has not yet reached 3, CORTEX applies one of 5 deterministic mutation strategies to the payload: compliance suffix, debugging prefix, synonym substitution, SYSTEM tag prefix, or authorisation note suffix. Once the streak hits 3, rotation takes precedence over mutation and the streak resets.

PAYLOAD — Attack Delivery Engine

PAYLOAD delivers CORTEX-selected payloads to AI surfaces via multi-path HTTP or Playwright browser automation.

Delivery Paths

9 URL path variants are tried in sequence: surface URL, /api/chat, /api/message, /api/query, /v1/chat/completions, /api/v1/chat, /chat, /message, /query.

Payload Schemas

7 JSON schemas per path: {"message": p}, {"query": p}, {"messages": [{"role": "user", "content": p}]}, {"input": p}, {"text": p}, {"prompt": p}, {"content": p}. Plus the OpenAI messages format.

Jitter & Retry

A 1–3 second random jitter is applied between rounds (time.sleep(random.uniform(1, 3))). On failure, up to MAX_RETRIES=3 attempts are made with a mutated payload on each retry.

HARVEST — Exfiltration Analyser

HARVEST analyses PAYLOAD responses for confirmed sensitive disclosures using pattern families, CVSS scoring, and MITRE ATT&CK / ATLAS technique mapping.

Pattern Families

REPORT — Evidence-Signed Report Generator

REPORT assembles the DaemonReport from all subsystem outputs, signs it with Ed25519, and writes it in the requested format.

Report IDs

• Report ID: DMN-{12 hex chars} — unique per campaign
• Session ID: SES-{8 hex chars} — unique per hunt invocation

Evidence Chain

Every subsystem event is written to the EvidenceChain as a SHA-256 hash-linked node: hash = sha256(prev_hash + subsystem + event + data_json). The final evidence_root is the chain tip hash (64 hex chars).

Gate Structure

CLI Reference

hunt

specter-daemon hunt [OPTIONS]

  --target TEXT          Target domain (required)
  --gate TEXT            OPEN / INJECT / DESTROY  [default: OPEN]
  --register             Run GENESIS registration flow
  --locale TEXT          Persona locale (en_US, en_GB, de_DE, fr_FR)  [default: en_US]
  --surface-filter TEXT  Filter surface types (space-separated)
  --categories TEXT      Override ARMORY categories (space-separated)
  --rounds INTEGER       Max attack rounds per surface  [default: 10]
  --output-dir TEXT      Report output directory  [default: ./reports]
  --format TEXT          json / text / markdown  [default: json]
  --override             Required for DESTROY gate
  --confirm-destroy      Required for DESTROY gate
  --browser              Browser automation mode — headless Chromium intercepts
                         live XHR/WebSocket traffic to discover AI endpoints
                         invisible to HTTP scraping (requires: playwright install chromium)

# Top-level flag (before subcommand):
  -v, --verbose          Enable DEBUG logging — shows ORACLE validation probe
                         raw responses and per-surface LLM validation decisions

Browser Mode

JavaScript-heavy applications (Figma, Linear, Notion, web-based IDEs) render AI surfaces entirely in the browser and communicate with backends via XHR and WebSocket — both invisible to HTTP scraping. The --browser flag activates CARTOGRAPH's network interception mode:

• Launches headless Chromium via Playwright and navigates the authenticated application
• Registers page.on("response") and page.on("websocket") handlers to intercept all network traffic
• Pokes visible AI inputs (textareas, chat inputs, contenteditable elements) to trigger background API calls
• Classifies intercepted endpoint URLs into surface types using path pattern matching
• Converts wss:// WebSocket endpoints to https:// for ORACLE and PAYLOAD to attack over HTTP
• Falls back to Playwright HTML crawl if no AI endpoints are intercepted

# JS-rendered target — standard HTTP scraping finds nothing
specter-daemon hunt --target figma.com --browser --gate INJECT

# With verbose logging to see every intercepted endpoint
specter-daemon -v hunt --target figma.com --browser

identity

specter-daemon identity [OPTIONS]

  --count INTEGER    Number of personas to generate  [default: 1]
  --locale TEXT      Faker locale  [default: en_US]

report

specter-daemon report [OPTIONS] REPORT_FILE

  --format TEXT    json / text / markdown  [default: text]

session

specter-daemon session [OPTIONS]

  --session-file TEXT    Path to saved session JSON (required)
  --gate TEXT            OPEN / INJECT / DESTROY  [default: INJECT]
  --rounds INTEGER       Max attack rounds per surface  [default: 10]
  --output-dir TEXT      Report output directory  [default: ./reports]

ARMORY Integration

SPECTER DAEMON reads payloads from the NIGHTFALL ARMORY SQLite database at ~/red-specter-armory/redspecter_armory/db/armory.db. If the database is unavailable, 5 hardcoded fallback payloads are used per category.

SURFACE_CATEGORY_MAP

Finding Types

Report Format

Reports are saved as DMN-{hex12}.json (plus .txt / .md variants) in the output directory.

{
  "report_id": "DMN-ab12cd34ef56",
  "session_id": "SES-ab12cd34",
  "target": "example.com",
  "operator": "RED",
  "gate": "INJECT",
  "surfaces_discovered": 3,
  "total_rounds": 15,
  "total_payloads": 15,
  "findings": [
    {
      "finding_id": "HRV-0001",
      "finding_type": "credential",
      "title": "Credential Disclosure",
      "severity": "CRITICAL",
      "cvss_score": 9.0,
      "mitre_technique": "T1213 / AML.T0043"
    }
  ],
  "evidence_root": "<64-char SHA-256 hash>",
  "signature": "<Ed25519 base64 signature>"
}

CVEs

MITRE Mapping