DarkMoon is an open-source, self-hosted autonomous AI penetration testing platform that runs multi-agent assessments against authorized infrastructure on a local LLM, documenting every finding with exact commands and raw output.
| Tool | ASCIT31/Dark-Moon — GPLv3 autonomous AI penetration testing platform with 50+ specialist agents |
| Category | Autonomous offensive security / agentic pentesting platform |
| Primary Use | Running fully automated, evidence-backed penetration tests against your own authorized infrastructure across web, API, Active Directory, Kubernetes, cloud, CI/CD and LLM endpoints |
| Safe Use | Strictly for authorized security assessments: pentesting infrastructure you own, lab environments, and DevSecOps pipelines with explicit permission |
| Telemetry Note | Every agent action flows through a controlled, logged MCP interface; defenders can review full timestamped command/output streams via ./darkmoon.sh --log <session_id>, making activity fully auditable on the tested network |
DarkMoon (ASCIT31/Dark-Moon) positions itself as autonomous AI penetration testing for your own infrastructure: you point it at an authorized target, and a multi-agent system runs the entire assessment — reconnaissance, vulnerability discovery, exploitation, and qualification — without step-by-step human orchestration. What distinguishes it from the current wave of LLM-assisted scanners is its insistence on evidence over scores: every finding ships with the exact command executed and its raw output, so a human reviewer can verify what the agent actually proved rather than trusting a heuristic severity label. The project is GPLv3, written in Python, self-hosted, and sits at just under a thousand stars at the time of writing, which for a tool of this ambition suggests real community traction rather than vaporware.
The architecture, as the README describes it, is a supervisory agentic system that reasons, plans, and dispatches roughly fifty specialist agents depending on what it detects on the target — a signal-to-agent dispatch matrix maps discovered technologies to the agents that get deployed. Coverage is broad: web applications, APIs, Active Directory, Kubernetes, cloud environments across AWS, Azure and GCP, CI/CD pipelines, databases, IoT firmware, and AI/LLM inference endpoints, with findings chained end to end rather than treated as isolated surfaces. The orchestration layer is MCP (Model Context Protocol), through which the platform coordinates more than 140 offensive tools. Critically, the README states that the AI never runs a command directly; every action flows through a controlled, logged MCP interface — a sensible safety boundary that gives operators an audit trail of each agent decision.
Privacy is where DarkMoon makes its most interesting engineering claim. The Privacy Gateway performs reversible local tokenization: real IPs, hostnames, URLs and credentials are replaced with deterministic placeholders before anything reaches the model, and rehydration happens only locally at the moment a tool actually executes. This addresses the most common objection to cloud-LLM pentesting agents — that you are shipping a map of your internal network to a third-party inference provider. The platform supports cloud providers (Anthropic, OpenAI, OpenRouter) but equally runs end to end on local models via Ollama or llama.cpp, keeping infrastructure values entirely on your own perimeter.
Installation is conventional for a Docker-based stack: git clone the repository, run ./install.sh, and the script interactively configures your LLM provider and builds the full stack via docker-compose — Docker and Docker Compose are prerequisites, plus an LLM API key or local model. The ./install.sh --init flag forces reconfiguration, and --help documents usage. Launching an assessment is deliberately minimal: a single invocation of ./darkmoon.sh "TARGET: example.com" starts a run, and every agent, command, and finding streams past in the terminal in real time, which matters for professionals who want to watch the reasoning rather than receive an opaque report an hour later.
The documentation culture is worth calling out separately. Every agent's methodology is plain Markdown that you can read, diff, and fork — meaning the tradecraft baked into each specialist agent is inspectable rather than hidden in a compiled binary or a remote service. For a team adopting autonomous tooling, this matters: you can review what the Active Directory or Kubernetes agent will actually attempt before you unleash it, adjust it for your environment's risk tolerance, and track methodology changes between versions under version control. This is the difference between an auditable offensive framework and a black box.
Findings semantics are carefully hedged in a way experienced assessors will appreciate. Exploitation is agent-asserted — the sub-agent runs the command, captures the output, and asserts the vulnerability is real based on the evidence — while the machine-verified step is the Pro-tier remediation retest, which re-runs the original exploit after a fix to confirm remediation. The open-source edition therefore gives you strong evidence-backed findings with near-zero triage overhead, but the automated fix-verification loop is a paid feature. The Pro tier also adds a web dashboard with CVSS, MITRE ATT&CK and ISO 27001 mapping per finding, plus human-reviewed pull requests that turn findings into remediation code.
Unusually for an offensive platform, DarkMoon also turns its agents against AI systems themselves: a dedicated LLM agent probes AI/LLM inference endpoints for the OWASP LLM Top 10 using garak-backed probes. As organizations deploy inference endpoints and RAG pipelines without dedicated adversarial testing, having this capability inside the same orchestration layer that handles traditional surfaces is a pragmatic consolidation — one assessment covers the web app and the model API behind it.
The integration surface is extensive and clearly aimed at DevSecOps adoption. The open-source edition pairs with CI/CD and CLI-based integrations: a GitHub Actions marketplace action that fails pipelines on findings by severity, GitLab CI/CD publishing findings as Code Quality and SAST reports, a Jenkins plugin distributed as an .hpi that surfaces findings through Warnings-NG, a VS Code extension, a JetBrains plugin, and a Splunk app for SOC ingestion over HEC. Pro-only integrations (n8n nodes, Grafana dashboards) consume a REST API. Notably, every integration emits safe metadata only — severity, status, MITRE mappings, identifiers — never evidence, secrets, or tokens, which is the right default when findings flow through shared CI systems.
The README reports a benchmark against OWASP Juice Shop with 57 real vulnerabilities found, and links press coverage from Help Net Security and other outlets; treat these as vendor-claimed numbers until you reproduce them in your own lab, but the choice of a deliberately vulnerable training application as the benchmark target is itself a signal about the intended authorized context. For teams evaluating the platform, reproducing that benchmark on a local Juice Shop instance is the natural first exercise before pointing it at production scope.
Operationally, defenders and blue teams should understand what DarkMoon looks like from the other side: because every action goes through the logged MCP interface and sessions are reviewable via ./darkmoon.sh --log <session_id> with timestamped commands and raw responses, the tooling footprint on the network is conventional scanner traffic wrapped in agentic decision-making. Any assessment run should be accompanied by clear scope declarations, and the tokenization gateway means the LLM logs themselves are less useful as a data-leak vector than raw transcripts would be. As with any autonomous offensive tool, the gap between what an agent asserts and what a human validates remains the central review obligation.
DarkMoon fits a specific and growing niche: security teams and DevSecOps engineers who want continuous, evidence-dense, self-hosted automated assessment of infrastructure they own, with privacy guarantees around the reasoning engine. It is not a replacement for a scoped human engagement, and its Pro upsell boundaries (dashboard, remediation) are clearly delineated in the README rather than disguised. For authorized professionals, it reads as a serious, architecturally thoughtful entry in the agentic-offense space — worth cloning into a lab and evaluating against Juice Shop before any wider rollout.
ASCIT31/Dark-Moon.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.