pip install red-specter-poltergeist
Every serious web application has surfaces that automated scanners never reach. Business logic. Race conditions. GraphQL introspection. JWT algorithm confusion. DOM XSS in SPA routes. Prototype pollution chains. POLTERGEIST fields a 10-agent swarm that attacks every surface simultaneously, coordinating chains that no single scanner could discover.
Concurrent request testing requires tight timing coordination. WENDIGO fires controlled race condition attacks against every state-changing endpoint simultaneously. Payment double-spend. Coupon reuse. Transfer duplication. All systematically tested.
REST, GraphQL, WebSocket, gRPC — each has its own attack surface. PHANTOM assaults all four in one coordinated operation. BOLA via sequential IDs. BFLA across role boundaries. Mass assignment in every endpoint. Schema abuse and introspection.
A WAF blocks known signatures. SHADE breaks through with encoding chains, payload mutation, fingerprint rotation, and rate limit evasion. Every injection campaign runs through SHADE first. The WAF is the obstacle, not the end state.
JWT algorithm confusion. OAuth redirect abuse. Session fixation. Default credentials. MFA bypass. Cookie security gaps. BANSHEE runs the complete authentication attack battery against every auth mechanism the application exposes.
Modern SPAs run complex logic in the browser. DOM XSS in React routing. Prototype pollution chains. CSP bypasses. Vulnerable JS dependencies. Clickjacking on overlooked flows. GHOUL finds what server-side scanners never see.
The most dangerous findings aren't single vulnerabilities — they're chains. A reflected parameter plus an IDOR plus a race condition equals full account takeover. POLTERGEIST the swarm commander correlates findings and discovers these chains automatically.
Each agent specialises in a distinct phase of web application assault. Together they form the most comprehensive automated penetration testing swarm ever built.
Each campaign orchestrates specific agents and vectors for a targeted objective. From silent reconnaissance to full swarm assault.
| Campaign | Command | Description |
|---|---|---|
| Full Assault | --campaign full_assault | All 10 agents, all 55 vectors, maximum aggression |
| Silent Recon | --campaign silent_recon | Passive reconnaissance, zero active probing |
| Auth Blitz | --campaign auth_blitz | Full authentication and session attack battery |
| API Siege | --campaign api_siege | REST, GraphQL, WebSocket, gRPC total assault |
| Client Harvest | --campaign client_harvest | Client-side XSS, DOM, prototype pollution, CSP |
| Infrastructure Sweep | --campaign infrastructure_sweep | Path traversal, misconfig, CORS, TLS weakness |
| Injection Storm | --campaign injection_storm | SQLi, XSS, SSRF, RCE, SSTI, XXE, LDAP, command injection |
| Logic Bomb | --campaign logic_bomb | Race conditions, IDOR, privilege escalation, workflow bypass |
| Exfil Express | --campaign exfil_express | Data extraction, CSRF, lateral movement, persistence |
| WAF Buster | --campaign waf_buster | WAF bypass, encoding chains, payload mutation, evasion |
Full web application attack surface coverage across 10 categories. Every finding mapped to OWASP Web Top 10, OWASP API Top 10, and CWE IDs.
Ten tools. Every layer. Nothing assumed safe. One company. Full stack.
Most pen-testing frameworks are menus that shell out to sqlmap, nikto, and nmap behind a terminal UI. POLTERGEIST is actual engineering. Every payload, every mutation, every detection algorithm, every scoring engine — written from scratch in pure Python. Zero subprocess calls. Zero external tool dependencies.
Export every finding directly to your SIEM. One flag. Native format translation. Ed25519 signatures and RFC 3161 timestamps preserved across every export.
poltergeist scan https://target.com --export-siem splunk
Red Specter POLTERGEIST is intended for authorised security testing only. Unauthorised use against systems you do not own or have explicit permission to test may violate the Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act (US), and equivalent legislation in other jurisdictions. Always obtain written authorisation before conducting any security assessments. Apache License 2.0.