SPECTER VIPER

Installation

# Clone and install
$ git clone https://github.com/RichardBarron27/red-specter-specter-viper
$ cd red-specter-specter-viper
$ pip install -e .

# Verify
$ specter-viper --version
specter-viper, version 1.0.0

# Generate Ed25519 key pair (required for INJECT / UNLEASHED gates)
$ specter-viper genkey --out-dir ~/.nightfall

Gate Structure

CLI Reference

Full Pipeline

$ specter-viper full [OPTIONS]

Options:
  --target TEXT          Platform profile key (see list-profiles)
  --url TEXT             Base URL of the target platform
  --api-token TEXT       API token for authenticated operations
  --tenant-id TEXT       Tenant / organisation ID (if required)
  --config PATH          JSON file listing multiple targets
  --gate TEXT            OPEN | INJECT | UNLEASHED  [default: OPEN]
  --key PATH             Path to NIGHTFALL Ed25519 private key
  --fire                 Deliver INJECT-gate payloads to live endpoints
  --execute-write        Execute UNLEASHED write-access actions
  --fp-count INTEGER     FP storm event count per platform  [default: 200]
  --flood-count INTEGER  BLIND log flood event count  [default: 500]
  --output TEXT          text | json | markdown  [default: text]
  --out-dir PATH         Report output directory  [default: .]
  --verbose              Verbose subsystem output

Per-Subsystem Commands

Target Platform Profiles

Subsystem Architecture

RECON

Probes known API paths for each vendor. Scores responses against fingerprint dictionaries (response body patterns, vendor-specific headers). Returns SOCPlatform objects with capability maps, write-access flags (requires authenticated 200 response), and confidence scores (0.0–1.0). TLS certificate inspection via ssl.create_default_context() for CN/SAN vendor confirmation.

INJECT

Builds vendor-matched payloads using seven event formats. Each payload embeds one of ten adversarial instruction templates via format-appropriate field injection (CEF msg=, ECS rule.description, Splunk analyst_notes, STIX description, CVE description). Bypass techniques are selected per-vendor: zero-width space prefix (Microsoft), base64 nested (CrowdStrike), BiDi override (Elastic), HTML comment (Splunk), JSON key smuggling (Palo Alto), Markdown code fence (Google), null byte separator (SentinelOne). Delivery via vendor ingest APIs requires INJECT gate.

MISDIRECT — Four Techniques

WRITE — Actions by Vendor

PERSIST — Survival Mechanisms

BLIND — Coverage Gap Reference

Multi-Target Config

# targets.json
[
  {
    "profile": "crowdstrike_charlotte",
    "url": "https://api.crowdstrike.com",
    "api_token": "YOUR_CS_TOKEN"
  },
  {
    "profile": "elastic_ai",
    "url": "http://kibana.corp.internal:5601",
    "api_token": "YOUR_ELASTIC_APIKEY"
  },
  {
    "profile": "splunk_ai",
    "url": "http://splunk.corp.internal:8089",
    "api_token": "YOUR_SPLUNK_TOKEN"
  },
  {
    "profile": "sentinelone_purple",
    "url": "https://corp.sentinelone.net",
    "api_token": "YOUR_S1_TOKEN"
  }
]

$ specter-viper full --config targets.json \
    --gate INJECT --fire \
    --key ~/.nightfall/nightfall.key \
    --output markdown --out-dir ./reports

Report Format

All reports are prefixed VPR-{hex12} and signed with the operator's Ed25519 private key. The evidence chain is SHA-256 hash-chained. Reports are available in JSON, Markdown, and plain text.

# Example report metadata
{
  "report_id": "VPR-a3f9c2e1b8d4",
  "target": "https://api.crowdstrike.com",
  "timestamp": 1779226921.7,
  "gate_level": "INJECT",
  "risk_score": 0.72,
  "risk_label": "HIGH",
  "chain_hash": "7f3a9c2b...",
  "signature": "ed25519:3d9f2a...",
  "mitre_techniques": ["AML.T0043", "AML.T0051", "T1562.001"],
  "owasp_refs": ["OWASP Agentic A02", "OWASP LLM01"]
}

MITRE ATT&CK & ATLAS