Agent API_p10 - grisuno/LazyOwn GitHub Wiki

API (page 10 of 23)

Previous: API_p9.md

modules/c2_profile_engine.py

Depends on: cli/commands/enum.py, core/config.py, core/logging.py Imported by: cli/commands/c2_profile.py, modules/beacon_config_builder.py, tests/test_c2_profile_engine.py

modules/c2_surfaces.py

Depends on: core/logging.py, skills/lazyown_mcp_helpers.py Imported by: cli/commands/c2_session.py, lazyc2.py, modules/atomic_exploit_bridge.py, tests/test_c2_surfaces.py

  • publish_banner (function) modules/c2_surfaces.py:73 def publish_banner(hostname, port, protocol, service, extra, sessions_dir) -- Append a service banner to sessions/banners.json (deduplicated).
  • publish_cve (function) modules/c2_surfaces.py:115 def publish_cve(title, description, operator, risk, sessions_dir) -- Append a CVE finding to sessions/cves.json (deduplicated by title).
  • append_note (function) modules/c2_surfaces.py:155 def append_note(line, sessions_dir) -- Append one timestamped line to sessions/notes.txt (never overwrites).
  • register_loot_event (function) modules/c2_surfaces.py:184 def register_loot_event(name, path_glob, description, event_config) -- Register an event_config.json rule watching an artefact glob.
  • refresh_session_report (function) modules/c2_surfaces.py:229 def refresh_session_report(timeout) -- Regenerate sessions/sessionLazyOwn.json via modules/session_state.py.
  • severity_to_risk (function) modules/c2_surfaces.py:251 def severity_to_risk(severity) -- Map exploit severity words to /cves risk levels.
  • group_tasks_for_display (function) modules/c2_surfaces.py:261 def group_tasks_for_display(tasks) -- Group tasks for the /tasks page: unique hits with counts + noise tally.

modules/cal.sh

  • is_leap_year (function) modules/cal.sh:4 -- Función para calcular si un año es bisiesto
  • days_in_month (function) modules/cal.sh:14 -- Función para obtener el número de días en un mes
  • first_day_of_month (function) modules/cal.sh:31 -- Función para obtener el día de la semana del primer día del mes

modules/chain_registry.py

Depends on: core/logging.py Imported by: cli/commands/command_and_control_migrated.py, cli/lazy_orchestrator.py, skills/lazyown_mcp.py, tests/test_chain_registry.py

  • Chain.resolve (method) modules/chain_registry.py:57 def resolve(self, tokens) -- Substitute tokens and evaluate guards.
  • validate_chain (function) modules/chain_registry.py:93 def validate_chain(data, filename, chains_dir) -- Validate raw YAML data against the chain schema.
  • load_all (function) modules/chain_registry.py:134 def load_all(chains_dir) -- Load every valid, enabled chain file (skips the rest loudly).
  • get (function) modules/chain_registry.py:215 def get(name, chains_dir) -- Return one chain by name, or None.
  • scan_all (function) modules/chain_registry.py:220 def scan_all(chains_dir) -- List every chain file including disabled ones (for administration).
  • set_enabled (function) modules/chain_registry.py:264 def set_enabled(name, enabled, chains_dir) -- Flip a chain's enabled flag in its YAML file (round-trip).
  • generate_for_playbook (function) modules/chain_registry.py:291 def generate_for_playbook(engine_key, apt_display, description, chains_dir, overwrite) -- Write a per-APT chain file inheriting the base APT chain.

modules/cicd_enumerator.py

Imported by: cli/commands/cicd.py

modules/cli_auth.py

Depends on: cli/engagement_hooks.py, core/config.py, modules/lazy_rbac.py Imported by: cli/auto_crypto.py, cli/banner_config.py, cli/commands/cli_auth.py, cli/engagement_hooks.py, cli/tips_engine.py, cli/wizard.py, lazyown.py, modules/redteam_gym.py, tests/test_cli_auth_remember.py, tests/test_engagement_elo_and_methodology.py

  • user_exists (function) modules/cli_auth.py:122 def user_exists(username) -- Check if a username already exists in users.json or RBAC store.
  • register (function) modules/cli_auth.py:145 def register(username, password) -- Register a new operator in users.json.
  • verify_password (function) modules/cli_auth.py:214 def verify_password(username, password) -- Verify a username/password against users.json using werkzeug.
  • login (function) modules/cli_auth.py:240 def login(username, password, remember) -- Authenticate a CLI operator and optionally persist a remember-me token.
  • logout (function) modules/cli_auth.py:293 def logout() -- Log out the current CLI operator and clear the remember-me token.
  • try_auto_login (function) modules/cli_auth.py:328 def try_auto_login() -- Attempt auto-login using the remember-me token from payload.json.
  • whoami (function) modules/cli_auth.py:366 def whoami() -- Return the currently logged-in CLI operator's identity.
  • get_current_operator (function) modules/cli_auth.py:396 def get_current_operator() -- Return the current operator username, or None if not logged in.
  • sync_elo_from_session (function) modules/cli_auth.py:408 def sync_elo_from_session(elo) -- Update the CLI session ELO from engagement state.
  • needs_login (function) modules/cli_auth.py:487 def needs_login() -- Check if the current session has a logged-in operator.

modules/cloud_enum.py

Imported by: cli/commands/cloud.py

  • CloudEnumerator.__init__ (method) modules/cloud_enum.py:34 def __init__(self, provider, session, timeout)
  • CloudEnumerator.detect_provider (method) modules/cloud_enum.py:47 def detect_provider(self) -- Auto-detect which cloud provider the host is running on.
  • CloudEnumerator.enumerate_metadata (method) modules/cloud_enum.py:75 def enumerate_metadata(self) -- Enumerate cloud instance metadata (IMDS).
  • CloudEnumerator.enumerate_storage (method) modules/cloud_enum.py:251 def enumerate_storage(self, target_bucket) -- Enumerate cloud storage buckets and objects.
  • CloudEnumerator.enumerate_iam (method) modules/cloud_enum.py:372 def enumerate_iam(self) -- Enumerate IAM roles, users, and policies.
  • CloudEnumerator.full_enumeration (method) modules/cloud_enum.py:576 def full_enumeration(self) -- Run full cloud enumeration: metadata + storage + IAM.

modules/collab_bp.py

Depends on: core/logging.py, modules/lazy_rbac.py Imported by: cli/commands/collaboration.py, lazyc2.py, modules/engagement_hooks.py, modules/event_bus.py, skills/lazyown_mcp.py, tests/test_collab_and_onboarding.py, tests/test_core_modules.py

modules/colors.py

Imported by: contrib/legacy/lazygptcli.py, contrib/legacy/lazygptcli_unified.py, contrib/legacy/lazyproxy.py, contrib/legacy/lazyseo.py, lazyc2.py, modules/llm_prompts.py, static/js/xterm.js

modules/command_executor.py

Depends on: core/logging.py, core/safe_exec.py, modules/auto_registry.py, modules/event_bus.py Imported by: lazyown.py, modules/auto_registry.py, tests/test_executor_kernel.py, tests/test_lazy_runner.py

modules/compliance.py

Depends on: core/logging.py Imported by: lazyc2.py

  • EvidenceChain.__init__ (method) modules/compliance.py:357 def __init__(self, sessions_dir)
  • EvidenceChain.add_file (method) modules/compliance.py:383 def add_file(self, filepath, operator, description)
  • EvidenceChain.verify (method) modules/compliance.py:410 def verify(self)
  • EvidenceChain.get_chain_digest (method) modules/compliance.py:429 def get_chain_digest(self)
  • EvidenceChain.to_report (method) modules/compliance.py:432 def to_report(self)
  • export_pdf (function) modules/compliance.py:449 def export_pdf(report_md, output_path, title, classification) -- Export a Markdown report to PDF using fpdf2.
  • export_to_elastic_ndjson (function) modules/compliance.py:533 def export_to_elastic_ndjson(findings, output_path, index_prefix) -- Export findings as Elasticsearch NDJSON bulk format.
  • export_to_cef (function) modules/compliance.py:572 def export_to_cef(findings, output_path, vendor, product, version) -- Export findings in CEF (Common Event Format) for ArcSight/QRadar/Splunk.
  • ComplianceEngine.__init__ (method) modules/compliance.py:635 def __init__(self, sessions_dir)
  • ComplianceEngine.map_findings_to_compliance (method) modules/compliance.py:639 def map_findings_to_compliance(self, findings, frameworks) -- Map findings to compliance framework controls.
  • ComplianceEngine.generate_compliance_report (method) modules/compliance.py:710 def generate_compliance_report(self, findings, include_evidence_chain, include_siem_formats) -- Generate a full compliance report with evidence chain and optional SIEM export.
  • ComplianceEngine.export_pdf (method) modules/compliance.py:831 def export_pdf(self, report, output_path)
  • ComplianceEngine.add_evidence (method) modules/compliance.py:901 def add_evidence(self, filepath, operator, description)
  • ComplianceEngine.verify_evidence_chain (method) modules/compliance.py:904 def verify_evidence_chain(self)

modules/conditional_hooks.py

Depends on: core/logging.py, core/safe_exec.py, modules/credential_reuse.py, modules/state_manager.py Imported by: cli/commands/automation.py, lazyc2.py, lazyc2/blueprints/beacon.py, tests/test_conditional_hooks_extended.py

modules/config_store.py

Depends on: core/config.py, core/logging.py Imported by: tests/test_core_modules.py

modules/credential_reuse.py

Depends on: core/logging.py Imported by: cli/commands/automation.py, lazyc2.py, lazyc2/blueprints/beacon.py, modules/conditional_hooks.py

  • ReuseCandidate.to_dict (method) modules/credential_reuse.py:43 def to_dict(self)
  • CredentialReuseEngine.__init__ (method) modules/credential_reuse.py:80 def __init__(self)
  • CredentialReuseEngine.mark_failed (method) modules/credential_reuse.py:107 def mark_failed(self, username, password, host) -- Record that a credential did NOT work against a host.
  • CredentialReuseEngine.mark_confirmed (method) modules/credential_reuse.py:112 def mark_confirmed(self, username, password, host) -- Record that a credential worked against a host.
  • CredentialReuseEngine.rank (method) modules/credential_reuse.py:226 def rank(self, hosts, creds, host_services, limit) -- Score all (cred, host) pairs and return top candidates.
  • CredentialReuseEngine.suggest_from_state_manager (method) modules/credential_reuse.py:278 def suggest_from_state_manager(self, state_manager, limit) -- Convenience: rank creds using hosts and creds from StateManager.
  • CredentialReuseEngine.suggest_from_world_model (method) modules/credential_reuse.py:308 def suggest_from_world_model(self, world_model, limit) -- Convenience: rank creds using hosts and creds from WorldModel.
  • CredentialReuseEngine.get_summary (method) modules/credential_reuse.py:338 def get_summary(self, candidates) -- Format candidates as a human-readable summary string.
  • get_credential_reuse_engine (function) modules/credential_reuse.py:358 def get_credential_reuse_engine() -- Return the singleton :class:CredentialReuseEngine.

modules/cross_cloud.py

Imported by: cli/commands/cloud_attacks.py

  • CrossCloudAttackEngine.__init__ (method) modules/cross_cloud.py:64 def __init__(self, config)
  • CrossCloudAttackEngine.azure_saml_to_aws (method) modules/cross_cloud.py:67 def azure_saml_to_aws(self) -- Abuse Azure AD SAML federation to gain AWS access.
  • CrossCloudAttackEngine.gcp_oidc_to_azure (method) modules/cross_cloud.py:104 def gcp_oidc_to_azure(self) -- Abuse GCP OIDC federation to gain Azure access.
  • CrossCloudAttackEngine.aws_oidc_to_gcp (method) modules/cross_cloud.py:133 def aws_oidc_to_gcp(self) -- Abuse AWS OIDC federation to gain GCP access.
  • CrossCloudAttackEngine.multi_cloud_imds_harvesting (method) modules/cross_cloud.py:167 def multi_cloud_imds_harvesting(self) -- Harvest metadata from all cloud providers simultaneously.
  • CrossCloudAttackEngine.entra_id_to_gcp_workforce_federation (method) modules/cross_cloud.py:204 def entra_id_to_gcp_workforce_federation(self) -- Exploit Entra ID to GCP workforce identity federation.
  • CrossCloudAttackEngine.detect_cross_cloud_federation (method) modules/cross_cloud.py:234 def detect_cross_cloud_federation(self) -- Detect cross-cloud federation configurations for attack surface mapping.
  • CrossCloudAttackEngine.summary (method) modules/cross_cloud.py:258 def summary(self)

modules/custom_tools.py

Depends on: modules/auto_registry.py, modules/lazy_loop.py, modules/notify.py Imported by: cli/commands/lazyops.py, modules/lazy_loop.py, modules/lazy_runner.py, tests/test_lazy_loop.py

modules/cve_matcher.py

Depends on: core/logging.py Imported by: skills/lazyown_mcp.py, tests/test_core_modules.py

modules/dacl_abuse.py

Imported by: cli/commands/active_directory.py

  • DACLAbuseEngine.__init__ (method) modules/dacl_abuse.py:136 def __init__(self, domain, domain_sid, acl_data)
  • DACLAbuseEngine.parse_bloodhound_acls (method) modules/dacl_abuse.py:143 def parse_bloodhound_acls(self, edges) -- Parse BloodHound edge data to extract exploitable ACLs.
  • DACLAbuseEngine.parse_raw_aces (method) modules/dacl_abuse.py:182 def parse_raw_aces(self, raw_nthashes) -- Parse raw ACE data from ntSecurityDescriptor parsing.
  • DACLAbuseEngine.compute_attack_chains (method) modules/dacl_abuse.py:224 def compute_attack_chains(self) -- Generate exploitation plans for all discovered ACL targets.
  • DACLAbuseEngine.adminsdholder_abuse_plan (method) modules/dacl_abuse.py:291 def adminsdholder_abuse_plan(self, target_sid) -- Generate an AdminSDHolder abuse plan.
  • DACLAbuseEngine.dcsync_rights_assignment_plan (method) modules/dacl_abuse.py:318 def dcsync_rights_assignment_plan(self, target_sid, domain_dn) -- Generate a DCSync rights assignment plan.
  • DACLAbuseEngine.owner_takeover_plan (method) modules/dacl_abuse.py:348 def owner_takeover_plan(self, target_dn, attacker_sid) -- Generate an ownership takeover plan.
  • DACLAbuseEngine.summary (method) modules/dacl_abuse.py:418 def summary(self) -- Return a summary of all DACL/SACL abuse findings.

modules/dashboard_bp.py

Imported by: lazyc2.py, tests/test_core_modules.py, tests/test_dashboard_routes.py

modules/dashboard_engine.py

Imported by: cli/commands/pwn.py, modules/rich_tui.py, modules/unified_dashboard.py, skills/lazyown_mcp.py

modules/db.py

Depends on: core/config.py, core/crypto.py, core/logging.py Imported by: cli/commands/campaign.py, cli/commands/collaboration.py, cli/commands/database.py, lazyc2/blueprints/api_v1.py, modules/autonomous_exploit_engine.py, modules/estorides_importer.py, modules/hash_cracker.py, modules/integrations/nuclei_parser.py, modules/opsec_scorer.py, modules/state_manager.py, scripts/devtools/core_smoke.py, skills/autonomous_daemon.py, skills/lazyown_mcp.py, tests/test_api_v1.py, tests/test_autonomous_ops.py, tests/test_daemon_loop.py, tests/test_db.py, tests/test_mutation_verification.py, tests/test_security_hardening.py

  • LazyOwnDB.__init__ (method) modules/db.py:159 def __init__(self, db_path)
  • LazyOwnDB.db_path (method) modules/db.py:182 def db_path(self) -- Path to the SQLite database file.
  • LazyOwnDB.migration_status (method) modules/db.py:222 def migration_status(self) -- Return the current and latest migration versions.
  • LazyOwnDB.workspace_create (method) modules/db.py:292 def workspace_create(self, name, description) -- Create a new workspace.
  • LazyOwnDB.workspace_list (method) modules/db.py:307 def workspace_list(self) -- Return all workspaces as dicts.
  • LazyOwnDB.workspace_get (method) modules/db.py:313 def workspace_get(self, name) -- Get a workspace by name, or None.
  • LazyOwnDB.default_workspace (method) modules/db.py:320 def default_workspace(self, name) -- Return the id of the named workspace, creating it when absent.
  • LazyOwnDB.workspace_delete (method) modules/db.py:333 def workspace_delete(self, name) -- Delete a workspace and all its data.
  • LazyOwnDB.host_add (method) modules/db.py:357 def host_add(self, workspace_id, address, mac, hostname, os, state) -- Add or update a host.
  • LazyOwnDB.host_delete (method) modules/db.py:390 def host_delete(self, host_id) -- Delete a host and its related data.
  • LazyOwnDB.host_list (method) modules/db.py:401 def host_list(self, workspace_id) -- List all hosts in a workspace.
  • LazyOwnDB.host_find (method) modules/db.py:410 def host_find(self, workspace_id, query) -- Search hosts by address, hostname, or os.
  • LazyOwnDB.service_add (method) modules/db.py:427 def service_add(self, host_id, port, protocol, state, name, product, version) -- Add a service to a host.
  • LazyOwnDB.service_list (method) modules/db.py:447 def service_list(self, host_id) -- List all services on a host.
  • LazyOwnDB.vuln_add (method) modules/db.py:460 def vuln_add(self, host_id, name, severity, description, refs) -- Add a vulnerability to a host.
  • LazyOwnDB.vuln_get (method) modules/db.py:478 def vuln_get(self, vuln_id) -- Return one vuln row with its host address, or None.
  • LazyOwnDB.vuln_update (method) modules/db.py:490 def vuln_update(self, vuln_id, refs, severity, description) -- Update mutable vuln fields; returns True when a row changed.
  • LazyOwnDB.vuln_list (method) modules/db.py:528 def vuln_list(self, workspace_id, severity) -- List vulns in workspace, optionally filtered by severity.
  • LazyOwnDB.cred_add (method) modules/db.py:557 def cred_add(self, host_id, username, password, realm, cred_type, origin) -- Add a credential (password encrypted at rest).
  • LazyOwnDB.cred_list (method) modules/db.py:577 def cred_list(self, workspace_id) -- List all creds in workspace (passwords decrypted).
  • LazyOwnDB.loot_add (method) modules/db.py:596 def loot_add(self, workspace_id, name, loot_type, path, notes, host_id) -- Add a loot entry.
  • LazyOwnDB.loot_list (method) modules/db.py:615 def loot_list(self, workspace_id) -- List all loot in workspace.
  • LazyOwnDB.note_add (method) modules/db.py:631 def note_add(self, workspace_id, data, note_type, host_id) -- Add a note.
  • LazyOwnDB.note_list (method) modules/db.py:648 def note_list(self, workspace_id) -- List all notes in workspace.
  • LazyOwnDB.import_nmap_xml (method) modules/db.py:664 def import_nmap_xml(self, workspace_id, xml_path) -- Import an Nmap XML file into the database.
  • LazyOwnDB.export_csv (method) modules/db.py:740 def export_csv(self, table, workspace_id) -- Export a table to CSV string.
  • LazyOwnDB.status (method) modules/db.py:775 def status(self, workspace_id) -- Return counts for every entity type in a workspace.
  • LazyOwnDB.close (method) modules/db.py:804 def close(self) -- Close the database connection for the current thread.
  • get_db (function) modules/db.py:821 def get_db(db_path) -- Get or create a :class:LazyOwnDB instance.

modules/delegation_attacks.py

Imported by: cli/commands/active_directory.py

  • DelegationEnumerator.__init__ (method) modules/delegation_attacks.py:98 def __init__(self, domain, raw_ldap_output)
  • DelegationEnumerator.enumerate_from_uac_flags (method) modules/delegation_attacks.py:104 def enumerate_from_uac_flags(self, accounts) -- Enumerate delegation targets from parsed account data.
  • DelegationEnumerator.parse_bloodhound_output (method) modules/delegation_attacks.py:151 def parse_bloodhound_output(self, bloodhound_json) -- Parse BloodHound JSON output for delegation data.
  • DelegationEnumerator.find_unconstrained_targets (method) modules/delegation_attacks.py:181 def find_unconstrained_targets(self) -- Return all accounts with unconstrained delegation enabled.
  • DelegationEnumerator.find_constrained_targets (method) modules/delegation_attacks.py:189 def find_constrained_targets(self) -- Return all accounts with constrained delegation configured.
  • DelegationEnumerator.find_rbcd_targets (method) modules/delegation_attacks.py:197 def find_rbcd_targets(self) -- Return all accounts with RBCD configured.
  • DelegationEnumerator.find_dc_targets (method) modules/delegation_attacks.py:205 def find_dc_targets(self) -- Return domain controllers with delegation configured.
  • DelegationEnumerator.compute_attack_paths (method) modules/delegation_attacks.py:215 def compute_attack_paths(self) -- Compute delegation-based attack paths.
  • DelegationEnumerator.summary (method) modules/delegation_attacks.py:296 def summary(self) -- Return a summary of all delegation findings.

modules/detailed_search.py

modules/detection_feed.py

Depends on: core/logging.py, modules/detection_oracle.py Imported by: modules/detection_oracle.py, tests/test_detection_feed.py

modules/detection_oracle.py

Depends on: core/logging.py, modules/detection_feed.py Imported by: modules/auto_purple.py, modules/detection_feed.py, modules/loop_ai_bridge.py, skills/autonomous_daemon.py, skills/lazyown_policy.py, skills/swan_agent.py, tests/test_detection_feed.py, tests/test_loop_ai_bridge.py, tests/test_moe_rl_swan.py

modules/dns_beacon.py

Depends on: core/safe_exec.py Imported by: cli/commands/dns_exfil.py

  • DNSBeacon.__init__ (method) modules/dns_beacon.py:38 def __init__(self, domain, dns_server, sleep_seconds, jitter_percent, dns_type, encode_method)
  • DNSBeacon.check_in (method) modules/dns_beacon.py:105 def check_in(self) -- Send heartbeat and check for pending commands.
  • DNSBeacon.send_result (method) modules/dns_beacon.py:135 def send_result(self, command, output, exit_code) -- Send command output via DNS TXT queries.
  • DNSBeacon.run (method) modules/dns_beacon.py:171 def run(self) -- Main beacon loop: check-in -> execute command -> send result -> sleep.
  • DNSC2Server.__init__ (method) modules/dns_beacon.py:211 def __init__(self, domain, log_source, interface)
  • DNSC2Server.register_beacon (method) modules/dns_beacon.py:225 def register_beacon(self, beacon_id, hostname) -- Register a new DNS beacon.
  • DNSC2Server.list_beacons (method) modules/dns_beacon.py:235 def list_beacons(self) -- List all registered DNS beacons.
  • DNSC2Server.send_task (method) modules/dns_beacon.py:239 def send_task(self, beacon_id, command) -- Queue a command for a DNS beacon.
  • DNSC2Server.process_query_log (method) modules/dns_beacon.py:248 def process_query_log(self, line) -- Process a single DNS query log line and extract beacon data.
  • DNSC2Server.get_results (method) modules/dns_beacon.py:327 def get_results(self, beacon_id) -- Get received results for a beacon.

modules/domain_dominance.py

Depends on: core/hardening.py Imported by: cli/commands/lateral_migrated.py, tests/test_security_alerts_fix.py

modules/dotnet_payload.py

Imported by: cli/commands/payload_arsenal.py

  • DotNetPayloadFactory.__init__ (method) modules/dotnet_payload.py:327 def __init__(self, output_dir)
  • DotNetPayloadFactory.list_templates (method) modules/dotnet_payload.py:364 def list_templates() -- Return available .NET payload template names.
  • DotNetPayloadFactory.generate_source (method) modules/dotnet_payload.py:389 def generate_source(self, config) -- Generate C# source code from a template.
  • DotNetPayloadFactory.compile (method) modules/dotnet_payload.py:403 def compile(self, config, source_code) -- Compile C# source to an assembly.
  • DotNetPayloadFactory.generate (method) modules/dotnet_payload.py:454 def generate(self, config) -- Generate a .NET payload — source code plus optional binary.
  • DotNetPayloadFactory.generate_powershell_reflective (method) modules/dotnet_payload.py:481 def generate_powershell_reflective(self, config) -- Generate a PowerShell script that reflectively loads a .NET assembly.
  • DotNetPayloadFactory.generate_inline_assembly (method) modules/dotnet_payload.py:500 def generate_inline_assembly(self, config) -- Generate self-decompiling inline .NET assembly load command.
  • DotNetPayloadFactory.to_format (method) modules/dotnet_payload.py:520 def to_format(self, data, fmt) -- Convert a payload result to the requested output format.

modules/dpapi_harvester.py

Imported by: cli/commands/dpapi.py

modules/edr_detector.py

Imported by: cli/commands/edr_detect.py

  • EDRDetector.detect_local (method) modules/edr_detector.py:202 def detect_local() -- Detect EDR products on the local Windows machine.
  • EDRDetector.detect_remote_commands (method) modules/edr_detector.py:221 def detect_remote_commands(remote_type) -- Generate commands for remote EDR detection.
  • EDRDetector.generate_edr_check_script (method) modules/edr_detector.py:440 def generate_edr_check_script(remote_type) -- Generate a PowerShell script for comprehensive EDR detection.

modules/eegg.sh

modules/engage_summary.py

Depends on: cli/recommendation_signals.py, modules/enrich.py, modules/evidence.py Imported by: skills/unified_orchestrator.py, tests/test_engage_summary.py

  • marker_lines (function) modules/engage_summary.py:35 def marker_lines(text, limit) -- Extract real log lines ([+] ... [+]) dropping panels and bars.
  • full_output (function) modules/engage_summary.py:51 def full_output(step, sessions_dir) -- Return the full step output from evidence, falling back to the tail.
  • held_scan_ports (function) modules/engage_summary.py:64 def held_scan_ports(target, sessions_dir) -- Parse held scan XMLs for open ports.
  • detail_for (function) modules/engage_summary.py:98 def detail_for(tool, text, target, sessions_dir) -- Extract the key facts from one step output for the summary.
  • next_actions (function) modules/engage_summary.py:150 def next_actions(target, sessions_dir, limit) -- Rank next actions via the unified recommendation engine.
  • render_text (function) modules/engage_summary.py:175 def render_text(engagement_id, target, shell, steps, sessions_dir) -- Render the console summary with per-step detail lines.
  • render_markdown (function) modules/engage_summary.py:210 def render_markdown(engagement_id, target, shell, steps, next_list, sessions_dir) -- Render the persisted per-engagement report.
  • write_report (function) modules/engage_summary.py:247 def write_report(engagement_id, target, shell, steps, sessions_dir) -- Persist the engagement report; return its relative path.

modules/engagement_hooks.py

Depends on: core/logging.py, modules/collab_bp.py Imported by: modules/event_bus.py, modules/pipeline_engine.py

modules/enrich.py

Imported by: cli/commands/pwn.py, cli/commands/session_ops.py, modules/engage_summary.py, skills/autonomous_daemon.py, tests/test_autonomous_ops.py

  • scan_files_for (function) modules/enrich.py:40 def scan_files_for(sessions_dir, target) -- Return existing scan artefacts for a target.
  • should_rescan (function) modules/enrich.py:57 def should_rescan(sessions_dir, target, fresh_sec) -- Return True when no fresh scan artefact exists for target.
  • resolve_dns (function) modules/enrich.py:73 def resolve_dns(target, timeout) -- Resolve A/AAAA for a target with a bounded timeout.
  • fetch_http (function) modules/enrich.py:86 def fetch_http(target, timeout) -- Fetch HTTP headers for a target without following credentials.
  • EnrichEngine.__init__ (method) modules/enrich.py:103 def __init__(self, max_workers) -- Create the pool and cooldown index.
  • EnrichEngine.submit (method) modules/enrich.py:108 def submit(self, target) -- Queue DNS+HTTP enrichment unless inside cooldown.
  • EnrichEngine.shutdown (method) modules/enrich.py:128 def shutdown(self, wait) -- Shut the pool down without blocking the loop by default.
  • shared_engine (function) modules/enrich.py:137 def shared_engine() -- Return the process-wide enrichment engine (LAZY parity).

modules/entra_id_attacks.py

Imported by: cli/commands/cloud_attacks.py

  • EntraIDAttackEngine.__init__ (method) modules/entra_id_attacks.py:92 def __init__(self, config)
  • EntraIDAttackEngine.device_code_phish (method) modules/entra_id_attacks.py:96 def device_code_phish(self, scope) -- Initiate a device code phishing flow.
  • EntraIDAttackEngine.poll_device_code (method) modules/entra_id_attacks.py:129 def poll_device_code(self, device_code, interval, timeout) -- Poll for device code completion to retrieve tokens.
  • EntraIDAttackEngine.oauth_consent_grant (method) modules/entra_id_attacks.py:166 def oauth_consent_grant(self, redirect_uri) -- Generate an OAuth consent grant phishing URL.
  • EntraIDAttackEngine.service_principal_credential_theft (method) modules/entra_id_attacks.py:203 def service_principal_credential_theft(self) -- Plan service principal credential theft via app registration abuse.
  • EntraIDAttackEngine.managed_identity_abuse (method) modules/entra_id_attacks.py:235 def managed_identity_abuse(self, resource) -- Exploit Azure managed identities from compromised VMs/containers.
  • EntraIDAttackEngine.entra_connect_sync_abuse (method) modules/entra_id_attacks.py:266 def entra_connect_sync_abuse(self) -- Exploit Entra Connect Sync for on-prem to cloud privilege escalation.
  • EntraIDAttackEngine.conditional_access_bypass (method) modules/entra_id_attacks.py:307 def conditional_access_bypass(self) -- Techniques for bypassing Entra ID Conditional Access policies.
  • EntraIDAttackEngine.enumerate_tenant (method) modules/entra_id_attacks.py:345 def enumerate_tenant(self) -- Enumerate tenant information via Graph API.
  • EntraIDAttackEngine.summary (method) modules/entra_id_attacks.py:368 def summary(self)

modules/estorides_fusion.py

Imported by: cli/commands/surface.py, modules/attack_surface3d.py, modules/intel_fusion.py, tests/test_estorides_fusion.py

Next: API_p11.md