Red Specter SPECTER FORGERY

Enumerates AI identity surfaces exposed by the target and classifies each discovery by identity type and vendor.

• OIDC discovery — fetches /.well-known/openid-configuration, extracts issuer, JWKS URI, token endpoint
• A2A agent cards — fetches /.well-known/agent.json, parses capabilities, skills, authentication
• SPIFFE trust bundles — probes SPIFFE trust domain endpoints, enumerates SVID validation paths
• KYA attestation — discovers Know Your Agent attestation endpoints and attestation schemas
• JWKS enumeration — fetches JWKS endpoints, inventories key IDs, algorithms, and key ages
• Classification — maps each discovery to one of 7 identity types across 10 vendor targets
• Gate — OPEN, no flags required

Credential forgery factory — generates cryptographically valid forged credentials for the specified identity type.

• OIDC JWT — real PyJWT signing with RS256 (2048-bit key), ES256 (P-256), or HS256. Configurable claims (sub, iss, aud, exp, iat, email, roles, oid, tid)
• SPIFFE SVID — X.509 certificate with spiffe://<trust_domain>/<workload> in UniformResourceIdentifier SAN extension. RSA-2048 + SHA-256
• KYA attestation — JSON attestation document with agent_id, capabilities, policy_hash, timestamp, and operator_signature field
• A2A agent card — Google A2A-compatible JSON card with name, description, url, capabilities array, skills array, authentication block
• Entra service principal — Azure AD-format JWT with appid, tid, oid, roles, scp claims
• Gate — INJECT, requires --override

Manipulates captured credentials for replay with elevated privilege or extended validity.

• expiry_bypass — modifies exp claim to far future timestamp, re-signs where possible
• signature_strip — sets alg to none, removes signature, tests for vulnerable verifiers
• scope_creep — injects additional scopes into scp / scope claim (e.g., adds admin, write)
• obo_chain — constructs On-Behalf-Of token chain, escalating from subject token to higher-privilege service token
• cross_tenant — injects foreign tid (tenant ID) to test cross-tenant isolation
• audience_confusion — modifies aud claim to target a different service than the original token
• Gate — INJECT, requires --override

Attacks A2A agent card trust — manipulates published agent discovery cards to inject malicious capabilities or redirect agent interactions.

• card_substitution — replaces the agent card at the discovery endpoint with an attacker-controlled card
• skill_injection — appends malicious skill entries to the agent's advertised capability list
• capability_escalation — elevates existing capabilities by adding credential_access, admin, and destructive actions
• url_redirection — modifies the card's endpoint URL to redirect agent interactions to an attacker server
• registry_injection — injects the forged card into agent discovery registries
• Gate — INJECT, requires --override

Confused deputy attack chain — exploits the relationship between caller identity and service permissions.

• alg_confusion — RS256→HS256 algorithm confusion (CVE-2025-68664, CVSS 9.3). Fetches RSA public key from JWKS, constructs HS256 token using public key PEM as HMAC secret via manual HMAC-SHA256 construction
• obo_privilege — OBO flow scope escalation — constructs an OBO token with scopes not present in the original assertion
• multi_hop — multi-hop privilege amplification through a chain of OBO flows
• cross_service_reuse — presents a service A token to service B to test cross-service scope enforcement
• Gate — INJECT, requires --override

JWKS root-of-trust poisoning — attacks the key discovery mechanism used to validate JWT signatures.

• key_injection — injects attacker RSA or EC key into the JWKS key set. Tokens signed with the corresponding private key are then accepted
• kid_confusion — path traversal in the kid JWT header parameter: ../../etc/passwd, ../../proc/self/environ
• alg_confusion_jwks — injects a key with alg: HS256 into the JWKS, then uses the key bytes as HMAC secret for forged tokens
• empty_keys — returns an empty JWKS ("keys": []), exploiting verifiers that accept all tokens when no keys are present
• rotation_poison — times key injection to coincide with JWKS rotation windows, exploiting the dual-key transition period
• Gate — INJECT, requires --override

Post-publication identity drift detection — monitors for silent mutations to published AI agent identity attributes.

• Baseline comparison — fetches current identity document, compares attribute-by-attribute to stored baseline
• Attribute mutation scoring — scores trust degradation based on which attributes changed (algorithm change = high severity, URL change = medium, capability add = medium)
• Dead-man sentinel — background heartbeat thread writes a timestamp every 30 seconds. If the thread is interrupted (e.g., by an active attacker terminating the monitoring process), the sentinel fires and emits a high-severity DRIFT_SENTINEL_FIRED finding
• Supported identity types — A2A agent cards, KYA attestations, OIDC discovery documents, SPIFFE trust bundles
• Gate — OPEN, no flags required

Cross-vendor identity transmutation — converts a credential from one trust domain to a form accepted by another vendor's authentication system.

• entra → openai — Azure AD JWT converted to OpenAI-accepted API token format
• entra → anthropic — Azure AD JWT converted to Anthropic API credential
• salesforce → workday — Salesforce Connected App token transmuted to Workday OAuth format
• gcp → azure — Google Cloud service account identity token converted to Entra access token
• aws → gcp — AWS Cognito/IAM credential transmuted to Google Cloud identity
• openai → google_a2a — OpenAI API identity converted to Google A2A agent card credential
• kya → lyrie_atp — KYA attestation document transmuted to Lyrie ATP protocol format
• okta → dify — Okta OIDC token converted to Dify platform authentication
• CVE mapping — CVE-2026-44843 (SVID cross-boundary trust domain confusion)
• Gate — DESTROY, requires --override --confirm-destroy and scope file

Generates an Ed25519-signed ForgeReport aggregating all subsystem findings into a single evidence chain.

• Report ID — FORGE-{12 hex chars} format (e.g. FORGE-a3f7c91b2e4d)
• EvidenceChain — SHA-256 hash-chained list of findings, each linking to the previous hash
• MITRE ATT&CK mapping — T1134, T1552, T1078, T1550, T1606, T1111 auto-annotated per finding
• MITRE ATLAS mapping — AML.T0012, AML.T0051, AML.T0056, AML.T0043, AML.T0048
• OWASP LLM mapping — LLM01, LLM02, LLM06 per finding category
• Ed25519 signature — report signed with operator private key; verifiable with public key
• SIEM NDJSON — newline-delimited JSON format for ingestion into Splunk, Sentinel, QRadar
• Gate — OPEN, no flags required