RedAmon AI Tool that Chains Reconnaissance, Exploitation, and Post-exploitation
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A new open-source offensive security platform called RedAmon is redefining automated penetration testing<\/a> by chaining reconnaissance, exploitation, post-exploitation, AI-driven triage, and automated code remediation all into a single end-to-end pipeline that culminates in a GitHub pull request with the fix already written.<\/p>\n RedAmon is a modular, containerized penetration testing framework<\/a> built on Docker that requires no security tools installed directly on the host system.<\/p>\n The platform is architected around six core pillars: a parallelized Reconnaissance Pipeline, an AI Agent Orchestrator, an Attack Surface Graph, EvoGraph for cross-session intelligence, the CypherFix remediation engine, and a 500+ parameter Project Settings Engine. Its complete kill chain is summarized as:<\/p>\n Reconnaissance \u2192 Exploitation \u2192 Post-Exploitation \u2192 AI Triage \u2192 CodeFix Agent \u2192 GitHub PR<\/p>\n RedAmon\u2019s recon pipeline launches over 40 industry-standard security tools in parallel, including Subfinder, Amass, Naabu, Masscan, Nuclei, Katana, FFuf, and Arjun inside a Kali Linux container.<\/p>\n Each tool\u2019s output feeds directly into a shared Neo4j knowledge graph with 17 node types and 20+ relationship types, giving the AI agent a structured, fully connected, and queryable attack surface in minutes rather than hours.<\/p>\n A dedicated AI Gauntlet module extends reconnaissance to AI\/LLM surfaces, attacking discovered endpoints with four red-team tools \u2014 garak, PyRIT, Giskard, and promptfoo to test for prompt injection, jailbreaks, and data leakage, all mapped to OWASP-LLM and MITRE-ATLAS classifications.<\/p>\n At the heart of RedAmon is a LangGraph-based autonomous agent implementing the ReAct (Reasoning + Acting) pattern. The agent progresses through three sequential phases: Informational, Exploitation, and Post-Exploitation, and has access to 14+ security tools via Model Context Protocol (MCP) servers<\/a> running in a sandboxed Kali environment.<\/p>\n