Red Specter POLTERGEIST

10-agent web application penetration testing swarm — 55 attack vectors, 532 payloads, 17 mutation techniques, triple OWASP + CWE mapping.

v1.0.0

Contents

Overview Installation Quick Start The Ten Agents Attack Campaigns Attack Vectors (55) Payloads & Mutations Output & Reports Flags & Options Key Features The Pipeline Packaging Disclaimer

Overview

POLTERGEIST is a 10-agent web application penetration testing swarm. Ten coordinated autonomous attack agents probe web applications across 55 attack vectors simultaneously — reconnaissance, injection, evasion, authentication, API assault, client-side, infrastructure, business logic, orchestration, and exfiltration.

Existing web scanners run one check at a time. Real attackers don't. POLTERGEIST deploys a coordinated swarm where each agent has a distinct specialisation: Wraith maps the surface, Specter injects, Shade evades WAFs, Banshee cracks auth, Phantom storms APIs, Ghoul attacks the client, Lich probes infrastructure, Wendigo exploits logic flaws, Poltergeist commands the swarm, and Revenant persists and exfiltrates. All ten operate simultaneously.

Every finding is mapped to OWASP Web Top 10 2021, OWASP API Top 10 2023, and CWE IDs. Every report is Ed25519 signed with RFC 3161 timestamps and SHA-256 evidence chains.

Installation

$ pip install red-specter-poltergeist

Also available as .deb (Kali Linux, Parrot, REMnux, Tsurugi) and PKGBUILD (BlackArch).

Quick Start

Full swarm assault

$ poltergeist scan https://target.com

Named campaign

$ poltergeist scan https://target.com --campaign full_assault

Selective agents with stealth mode

$ poltergeist scan https://target.com --agents WRAITH,SPECTER,SHADE --stealth

Authenticated scan with scope

$ poltergeist scan https://target.com --scope "*.target.com,/api/" --auth-type bearer --token eyJ...
    

CI/CD grade gate

$ poltergeist grade reports/scan.json --fail-below C

The Ten Agents

ID	Agent	Role	Vectors	Description
G-01	Wraith	Reconnaissance	5	Surface mapping, fingerprinting, hidden endpoints
G-02	Specter	Injection	8	SQLi, XSS, SSRF, RCE, SSTI, XXE, LDAP, command injection
G-03	Shade	Evasion	5	WAF bypass, encoding chains, payload mutation
G-04	Banshee	Authentication	6	Session hijack, OAuth, JWT, MFA bypass
G-05	Phantom	API Assault	8	REST, GraphQL, WebSocket, gRPC, BOLA, BFLA
G-06	Ghoul	Client-Side	5	DOM XSS, prototype pollution, CSP bypass
G-07	Lich	Infrastructure	6	Path traversal, LFI/RFI, misconfig, CORS, TLS
G-08	Wendigo	Business Logic	5	Race conditions, IDOR, privilege escalation
G-09	Poltergeist	Swarm Commander	3	Attack chain discovery, finding correlation
G-10	Revenant	Exfiltration	4	Data extraction, CSRF, lateral movement, persistence

G-01 Wraith Reconnaissance

Maps the entire attack surface before a single payload fires.

V-001 Surface Mapper — crawl target, parse sitemap.xml and robots.txt
V-002 Technology Fingerprint — identify server, frameworks, CMS, security headers
V-003 Hidden Endpoint Discovery — probe for admin panels, debug endpoints, backup files
V-004 JavaScript Route Extraction — parse JS for API routes, fetch calls, hardcoded secrets
V-005 API Discovery — probe for OpenAPI, GraphQL, well-known configs

G-02 Specter Injection

Eight injection vectors covering the full injection attack surface.

V-006 SQL Injection — error-based, blind boolean, time-based, UNION
V-007 Cross-Site Scripting — reflected, stored, mutation XSS across contexts
V-008 SSRF — URL parameters, internal IPs, cloud metadata
V-009 Remote Code Execution — OS command injection via shell metacharacters
V-010 SSTI — Jinja2, Twig, Mako, Freemarker, Smarty
V-011 XXE — classic, blind OOB, parameter entity
V-012 LDAP Injection — filter injection via auth and search
V-013 Command Injection — newlines, separators, encoding bypass, env abuse

G-03 Shade Evasion

Bypasses WAFs and security controls using adaptive evasion techniques.

V-014 WAF Bypass — chunked transfer, header manipulation, multipart abuse
V-015 Encoding Chain Evasion — double URL-encoding, Unicode, hex, octal, base64
V-016 Payload Mutation — case randomisation, comment insertion, whitespace
V-017 Fingerprint Rotation — user-agent and header rotation
V-018 Rate Limit Evasion — IP spoofing headers and timing manipulation

G-04 Banshee Authentication

Full authentication and session management attack battery.

V-019 Session Hijack Analysis — session fixation, low entropy, tokens in URLs
V-020 Default Credential Test — common credentials on login endpoints
V-021 OAuth Abuse — redirect_uri manipulation, missing state parameter
V-022 JWT Attacks — alg:none, algorithm confusion, kid injection, expiry bypass
V-023 MFA Bypass — response manipulation and step-skipping
V-024 Cookie Security — Secure, HttpOnly, SameSite, prefix audit

G-05 Phantom API Assault

Comprehensive API attack coverage across all modern API technologies.

V-025 REST API Assault — method tampering, HPP, content-type switching
V-026 GraphQL Assault — introspection, deep nesting DoS, batch, aliases
V-027 WebSocket Assault — CSWSH and message injection
V-028 gRPC Assault — reflection API exposure, message tampering
V-029 BOLA — IDOR via sequential IDs and object reference manipulation
V-030 BFLA — accessing privileged endpoints without authorisation
V-031 Mass Assignment — injecting hidden parameters (isAdmin, role, price)
V-032 Schema Abuse — type confusion, integer overflow, validation bypass

G-06 Ghoul Client-Side

Client-side vulnerability analysis and exploitation.

V-033 DOM-based XSS — source-sink analysis in JavaScript
V-034 Prototype Pollution — __proto__ and constructor.prototype
V-035 CSP Bypass — unsafe-inline, unsafe-eval, JSONP gadgets
V-036 JS Dependency Check — known vulnerable libraries, missing SRI
V-037 Clickjacking — X-Frame-Options and frame-ancestors

G-07 Lich Infrastructure

Infrastructure-level vulnerabilities and misconfigurations.

V-038 Path Traversal — directory traversal (../../../etc/passwd)
V-039 LFI/RFI — local and remote file inclusion
V-040 Misconfiguration — common infrastructure misconfigurations
V-041 CORS Abuse — improper CORS allowing cross-origin access
V-042 Header Injection — HTTP header injection and response splitting
V-043 TLS Weakness — SSL/TLS configuration weaknesses

G-08 Wendigo Business Logic

Business logic vulnerabilities that automated scanners miss.

V-044 Race Conditions — TOCTOU in sensitive operations
V-045 IDOR — insecure direct object references
V-046 Privilege Escalation — horizontal and vertical
V-047 Workflow Bypass — business logic step-skipping
V-048 Payment Tampering — payment system manipulation

G-09 Poltergeist Swarm Commander

Coordinates the swarm and discovers multi-step exploitation paths.

V-049 Chain Finder — chain vulnerabilities into exploitation paths
V-050 Finding Correlator — correlate findings for compound attacks
V-051 Effort Redistributor — redistribute effort by vulnerability density

G-10 Revenant Exfiltration & Persistence

Data extraction, persistence validation, and lateral movement testing.

V-052 Data Extraction — sensitive data through exfiltration channels
V-053 Session Riding — CSRF vulnerability testing
V-054 Lateral Movement — privilege expansion and pivoting
V-055 Respawn — persistent attack vectors and backdoors

Attack Campaigns

Each campaign orchestrates specific combinations of agents and vectors for a targeted objective.

Campaign	Command	Description
Full Assault	--campaign full_assault	All 10 agents, all 55 vectors, maximum aggression
Silent Recon	--campaign silent_recon	Passive reconnaissance, zero active probing
Auth Blitz	--campaign auth_blitz	Full authentication and session attack battery
API Siege	--campaign api_siege	REST, GraphQL, WebSocket, gRPC total assault
Client Harvest	--campaign client_harvest	Client-side XSS, DOM, prototype pollution, CSP bypass
Infrastructure Sweep	--campaign infrastructure_sweep	Path traversal, misconfig, CORS, TLS weakness
Injection Storm	--campaign injection_storm	SQLi, XSS, SSRF, RCE, SSTI, XXE, LDAP, commands
Logic Bomb	--campaign logic_bomb	Race conditions, IDOR, privilege escalation, workflow
Exfil Express	--campaign exfil_express	Data extraction, CSRF, lateral movement, persistence
WAF Buster	--campaign waf_buster	WAF bypass, encoding chains, payload mutation, evasion

Attack Vectors (55)

55 vectors spanning the full web application attack surface:

V-001 Surface Mapper — crawl, sitemap, robots.txt
V-002 Technology Fingerprint — server, framework, CMS identification
V-003 Hidden Endpoint Discovery — admin panels, debug endpoints, backups
V-004 JavaScript Route Extraction — API routes from JS bundles
V-005 API Discovery — OpenAPI, GraphQL, well-known configs
V-006 SQL Injection — error-based, blind, time-based, UNION
V-007 Cross-Site Scripting — reflected, stored, mutation
V-008 SSRF — internal IPs, cloud metadata
V-009 Remote Code Execution — OS command injection
V-010 SSTI — template engine injection
V-011 XXE — XML external entity injection
V-012 LDAP Injection — filter injection
V-013 Command Injection — advanced command injection
V-014 WAF Bypass — chunked transfer, header tricks
V-015 Encoding Chain Evasion — multi-layer encoding
V-016 Payload Mutation — case, comment, whitespace
V-017 Fingerprint Rotation — UA and header rotation
V-018 Rate Limit Evasion — IP spoofing, timing
V-019 Session Hijack — fixation, entropy, URL tokens
V-020 Default Credentials — common credential testing
V-021 OAuth Abuse — redirect_uri, missing state
V-022 JWT Attacks — alg:none, confusion, kid injection
V-023 MFA Bypass — response manipulation, step-skip
V-024 Cookie Security — flag audit
V-025 REST API Assault — method tampering, HPP
V-026 GraphQL Assault — introspection, nesting, batch
V-027 WebSocket Assault — CSWSH, message injection
V-028 gRPC Assault — reflection, message tampering
V-029 BOLA — IDOR via sequential IDs
V-030 BFLA — privilege endpoint access
V-031 Mass Assignment — hidden parameter injection
V-032 Schema Abuse — type confusion, overflow
V-033 DOM XSS — source-sink analysis
V-034 Prototype Pollution — __proto__ injection
V-035 CSP Bypass — policy weakness analysis
V-036 JS Dependencies — vulnerable libraries, SRI
V-037 Clickjacking — framing protection
V-038 Path Traversal — directory traversal
V-039 LFI/RFI — file inclusion
V-040 Misconfiguration — infrastructure misconfig
V-041 CORS Abuse — cross-origin access
V-042 Header Injection — response splitting
V-043 TLS Weakness — SSL/TLS config
V-044 Race Conditions — TOCTOU, double-spend
V-045 IDOR — direct object references
V-046 Privilege Escalation — horizontal and vertical
V-047 Workflow Bypass — logic step-skipping
V-048 Payment Tampering — payment manipulation
V-049 Chain Finder — multi-vuln exploitation paths
V-050 Finding Correlator — compound attack discovery
V-051 Effort Redistributor — dynamic effort allocation
V-052 Data Extraction — exfiltration channels
V-053 Session Riding — CSRF testing
V-054 Lateral Movement — pivoting and expansion
V-055 Respawn — persistence and backdoors

Payloads & Mutations

POLTERGEIST ships with 532 static payloads across 6 categories:

SQL Injection — 124 payloads (error-based, blind, time-based, UNION)
Cross-Site Scripting — 111 payloads (reflected, stored, DOM, mutation)
Remote Code Execution — 79 payloads (command injection, metacharacters)
SSRF — 70 payloads (internal IPs, cloud metadata, protocols)
SSTI — 70 payloads (Jinja2, Twig, Mako, Freemarker, Smarty)
Path Traversal — 78 payloads (directory traversal, null bytes, encoding)

Mutation Engine

The mutation engine applies 17 mutation techniques to generate unlimited payload variants from the static corpus. This finds vulnerabilities that static payloads miss.

Case randomisation
Comment insertion
Whitespace manipulation
URL encoding (single and double)
Unicode normalisation
Hex encoding
Octal encoding
Base64 wrapping
HTML entity encoding
Concatenation splitting
Null byte insertion
Newline injection
Tab injection
Alternative syntax
Keyword substitution
Padding noise
Mixed encoding chains

Output & Reports

POLTERGEIST produces structured reports in JSON and HTML formats.

Ed25519 signed — cryptographic digital signatures on every report
RFC 3161 timestamped — legally defensible timestamps
OWASP Web Top 10 mapped — every finding mapped to OWASP categories
OWASP API Top 10 mapped — API findings mapped separately
CWE mapped — Common Weakness Enumeration IDs on every finding
CVSS 3.1 scored — severity scoring on every finding
SHA-256 evidence chains — tamper-evident linked hashes
Risk grade — A+ through F grade with percentage score

Report Structure

Each JSON report includes:

scan_id — unique scan identifier
target_name — the web application that was tested
agents_deployed — which agents participated
vectors_tested — which attack vectors were exercised
findings — array of findings with severity, CVSS, OWASP, CWE, evidence
risk_grade — overall risk grade (A+ to F)
risk_score — percentage risk score
summary — by_severity breakdown, total vulnerable vs total tested
signature — Ed25519 signature + RFC 3161 timestamp

Flags & Options

$ poltergeist scan --help

  target              Target base URL [required]
  --scope             Comma-separated scope patterns [optional]
  --exclude           Paths to exclude [optional]
  --auth-type         Auth type: bearer, basic, cookie, header [optional]
  --token             Bearer token or credential [optional]
  --username          Username for basic auth [optional]
  --password          Password for basic auth [optional]
  --cookie            Cookies as key=value;key2=value2 [optional]
  --header            Extra headers as key:value,key2:value2 [optional]
  --proxy             HTTP proxy URL [optional]
  --concurrency       Max concurrent requests [default: 10]
  --rate-limit        Requests per second (0 = unlimited) [default: 0]
  --timeout           Request timeout in seconds [default: 30]
  --agents            Comma-separated agent codenames [default: all]
  --vectors           Comma-separated vector IDs [default: all]
  --campaign          Named campaign playbook [optional]
  --stealth           Enable stealth mode [default: false]
  --no-sign           Skip Ed25519 signing [default: false]
  --name              Target name [default: target-webapp]
  --output            Output directory [default: reports]
  --format            Output: json, html, or all [default: all]
  --config            Load config from YAML [optional]
  --save-config       Save config to YAML [optional]
  --no-verify-ssl     Disable SSL verification [default: false]
  --follow-redirects  Follow HTTP redirects [default: true]
    

Other Commands

$ poltergeist campaigns      # List all campaign playbooks
$ poltergeist list-agents     # List all 10 agents
$ poltergeist list-vectors    # List all 55 vectors
$ poltergeist grade report.json --fail-below C  # CI/CD grade gate
$ poltergeist verify report.json     # Verify Ed25519 signature
$ poltergeist keygen          # Generate Ed25519 keypair
$ poltergeist version         # Show version
    

Key Features

10 Autonomous Agents Coordinated swarm with distinct specialisations

55 Attack Vectors Full web application attack surface coverage

532 Static Payloads SQLi, XSS, RCE, SSRF, SSTI, path traversal

17 Mutation Techniques Unlimited payload variants from mutation engine

Triple OWASP + CWE Web Top 10, API Top 10, CWE IDs on every finding

CVSS 3.1 Scoring Severity scoring on every finding

Ed25519 Signed Reports SHA-256 evidence chains, RFC 3161 timestamps

886 Tests Passing Full test suite, zero failures

Scope Enforcement Built-in scope controls and rate limiting

10 Named Campaigns Pre-built coordinated assault playbooks

CI/CD Integration Grade gate for deployment pipelines

YAML Config Save and load scan configurations

The Pipeline

POLTERGEIST is Stage 4 of the five-stage Red Specter security pipeline:

Stage 1 — Forge — Automated LLM security testing
Stage 2 — Arsenal — AI agent penetration testing
Stage 3 — PHANTOM Swarm — Coordinated multi-agent AI assault
Stage 4 — POLTERGEIST — Web application penetration testing swarm
Stage 5 — AI Shield — Runtime protection in production

Forge tests models. Arsenal attacks agents. PHANTOM assaults AI systems. POLTERGEIST destroys web applications. AI Shield defends everything in production. One company. Full stack.

Packaging

POLTERGEIST is available in three package formats for security-focused Linux distributions:

Debian / Kali / Parrot / REMnux / Tsurugi — .deb package
BlackArch — PKGBUILD
PyPI — pip install red-specter-poltergeist

For access, contact richard@red-specter.co.uk

Disclaimer

Red Specter POLTERGEIST is designed for authorised security testing, research, and educational purposes only. You must have explicit written permission from the system owner before running any POLTERGEIST tool against a target. Unauthorised use may violate the Computer Misuse Act 1990 (UK), the Computer Fraud and Abuse Act (US), or equivalent legislation in your jurisdiction. The authors accept no liability for misuse.