SPECTER VICIOUS

No key required. RECONNAISSANCE and REPORT subsystems available. Performs passive target profiling, WAF fingerprinting, and attack surface mapping without sending any attack payloads. Returns a scored target profile with recommended attack vectors.

Requires VICIOUS_INJECT_KEY + ROE file. Unlocks REASONING, ARMORY-SELECT, PRION-MUTATE, ORCHESTRATE, and ADAPT. Activates the full DeepSeek R1 planning loop with live attack execution, WAF evasion mutation, and real-time adaptive feedback.

Requires VICIOUS_EVOLVE_KEY + ROE phrase "autonomous evolution authorised". Unlocks continuous learning mode — SPECTER VICIOUS never stops refining its attack model. Mutations are retained across sessions, building a target-specific evasion corpus. Requires --confirm-evolve.

Requires VICIOUS_UNLEASHED_KEY + ROE phrase "vicious unleashed authorised" + --confirm-destroy. Unlocks PERSIST and HARVEST — durable web foothold implantation and full credential, session token, and data extraction operations.

Target profiling, WAF fingerprinting, and attack surface mapping. Probes HTTP response headers, error page signatures, and timing behaviour to fingerprint WAF vendor and version (ModSecurity, Cloudflare, AWS WAF, Akamai, Imperva, F5 AWAF, Barracuda, Sucuri). Maps injectable parameters, endpoint inventory, and authentication surface. Scores exploitation feasibility per endpoint. Returns structured target profile used by REASONING and ARMORY-SELECT.

DeepSeek R1 strategic attack planning and adaptive pivots. Consumes the RECONNAISSANCE target profile and formulates a multi-phase attack plan: initial injection vector selection, bypass hypothesis generation, fallback pivot tree, and success criteria. Re-invoked after each ADAPT cycle to revise strategy based on observed WAF responses. Does not follow a fixed script — reasons about the specific target configuration and refines its model of the defence in real time.

Payload selection from ARMORY database filtered by target profile. Queries the ARMORY v13.1.0 payload corpus (3,406 payloads across 170 categories) using the WAF fingerprint and attack vector class identified by RECONNAISSANCE. Retrieves the highest-CVSS, WAF-class-matched payload candidates. Applies semantic similarity ranking to select payloads most likely to evade the identified WAF variant. Seeds the PRION mutation engine with the selected base payloads.

GPU-accelerated WAF-evading payload mutation at 20× CPU speed. Generates thousands of semantically-equivalent but syntactically distinct variants per minute using the PRION engine: token substitution, encoding transformation (URL/HTML/Unicode/double-encoding), whitespace normalisation attacks, comment insertion, case variation, concatenation fragmentation, and null-byte injection. Each variant is scored against a learned WAF bypass probability model. Only high-confidence variants proceed to ORCHESTRATE.

Adaptive attack execution with timing and rate limit management. Dispatches PRION-generated payload variants against target endpoints with configurable concurrency, jitter, and back-off logic. Manages rate limit detection and automatic throttling to avoid triggering volumetric blocks. Tracks per-endpoint response signatures and classifies each result: BYPASS / BLOCKED / PARTIAL / ERROR. Routes results to ADAPT for real-time strategy feedback.

Real-time WAF defence analysis and strategy feedback loop. Analyses ORCHESTRATE response classifications to infer WAF detection rule behaviour: which payload classes are blocked, which bypass patterns succeed, and which response codes indicate partial bypass vs hard block. Updates the PRION mutation model with observed block signatures to drive away from detected patterns. Triggers REASONING re-invocation when the attack plan requires strategic revision based on observed defence behaviour.

Continuous learning mode — SPECTER VICIOUS never stops evolving. Retains successful bypass patterns, blocked payload signatures, and target WAF behavioural fingerprints in a persistent session store. Each successive engagement against the same or similar WAF configuration starts from the accumulated evasion knowledge of all prior sessions. Builds a target-class-specific mutation corpus that improves bypass rate over time. Requires VICIOUS_EVOLVE_KEY + ROE "autonomous evolution authorised" + --confirm-evolve.

Durable web foothold implantation. Exploits BYPASS-confirmed injection vectors to plant persistent backdoors: webshell upload via unrestricted file upload, SQL-backed authentication bypass with persisted backdoor account, server-side template injection for durable code execution, and deserialization-chain-based remote code execution. Tests persistence across WAF rule updates and server restarts. Requires VICIOUS_UNLEASHED_KEY + ROE + --confirm-destroy.

Credential, session token, and data extraction. Leverages BYPASS-confirmed injection vectors for structured data exfiltration: SQL injection data dump, credential table extraction, session token harvest via XSS, admin panel credential brute-force using harvested password hashes, API key extraction from configuration endpoints, and cloud metadata service (IMDS) credential retrieval via SSRF. Requires VICIOUS_UNLEASHED_KEY + ROE + --confirm-destroy.

Generates VCS-{hex12} session report. Collects all subsystem results: WAF fingerprint, REASONING attack plan, payload mutation statistics (variants generated, bypass rate, blocked rate), ORCHESTRATE execution log, ADAPT strategy revisions, bypass-confirmed injection vectors, PERSIST foothold status, and HARVEST extraction inventory. Ed25519 signs with ~/.red-specter/vicious/signing_key.pem. ML-DSA-65 countersigns. MITRE ATT&CK and ATLAS mapping. Saves to ~/.red-specter/vicious/reports/.

T1190 — Exploit Public-Facing Application T1059 — Command and Scripting Interpreter T1552 — Unsecured Credentials T1505 — Server Software Component T1056 — Input Capture T1499 — Endpoint Denial of Service

AML.T0043 — Craft Adversarial Data AML.T0040 — ML Supply Chain Compromise AML.T0048 — External Harms AML.T0054 — LLM Prompt Injection via RAG AML.T0051 — LLM Jailbreak