DarkMoon

DarkMoon is an open-source autonomous penetration testing platform. An LLM "brain" plans the assessment, a privacy gateway strips real IPs, hostnames, URLs, and credentials before anything reaches the model, and an MCP gatekeeper runs curated workflows inside an isolated Docker toolbox — so the AI reasons and coordinates but never touches the target directly.

Architecture Overview

DarkMoon enforces a strict separation of concerns: OpenCode plans, the Privacy Gateway tokenizes, the MCP gatekeeper decides what runs, and the Docker Toolbox executes isolated tools. The model never issues raw commands or sees raw target data.

Where It Fits in an Engagement

DarkMoon is a breadth-first accelerator, not a replacement for manual depth. Point it at a scoped surface to enumerate technologies, run the relevant agents, and surface candidate findings quickly — then have an analyst reproduce anything it flags. Treat every autonomous result as a lead, not a deliverable.

Privacy Gateway

The defining feature of the v1.2.0 line. Sensitive values are replaced with deterministic placeholders (IP_PRIVATE_001, CRED_SECRET_001) before any request leaves the host, then rehydrated locally inside the toolbox at execution time and re-masked on the way back. This keeps client IPs, hostnames, URLs, and credentials out of the LLM provider entirely.

# Privacy gateway — what the model actually sees.
# Real values are deterministically tokenized locally before any LLM call
# and rehydrated only inside the Docker toolbox at execution time.

# Operator target:
TARGET: vpn.acme-corp.com  (10.20.4.8)  creds: svc_scan / Winter2026!

# What leaves the host to the LLM provider:
TARGET: HOST_PUBLIC_001 (IP_PRIVATE_001) creds: CRED_USER_001 / CRED_SECRET_001

# Tool results are re-masked on the way back so the model never
# reasons over raw IPs, hostnames, URLs, or secrets.

# Privacy gateway — what the model actually sees.
# Real values are deterministically tokenized locally before any LLM call
# and rehydrated only inside the Docker toolbox at execution time.

# Operator target:
TARGET: vpn.acme-corp.com  (10.20.4.8)  creds: svc_scan / Winter2026!

# What leaves the host to the LLM provider:
TARGET: HOST_PUBLIC_001 (IP_PRIVATE_001) creds: CRED_USER_001 / CRED_SECRET_001

# Tool results are re-masked on the way back so the model never
# reasons over raw IPs, hostnames, URLs, or secrets.

Specialized Agents

DarkMoon dispatches four autonomous domain agents reactively: it discovers technologies, selects the relevant agent, validates findings with evidence, and iterates until attack-surface coverage is exhausted.

Beneath the four domain agents, the assessment engine dispatches technology-reactive sub-agents as it fingerprints the target: stack-specific agents (PHP, Node.js, Flask, ASP.NET, Spring Boot, Ruby on Rails), a GraphQL agent, a headless-browser agent, and CMS engines (WordPress, Drupal, Joomla, Magento, PrestaShop, Moodle). Coverage therefore adapts to what the target actually runs rather than following a fixed checklist.

MCP Workflows & Toolbox

The AI never runs raw shell. MCP exposes workflows — Python modules that encapsulate a complete task (port scanning, vulnerability scanning, crawling) with structured inputs/outputs and timeout management. Those workflows drive a compiled Docker toolbox of 50+ utilities.

Installation

1. Clone & Install

# Clone the repository
git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon

# Interactive installer: pick LLM provider, pull the toolbox image,
# and build the OpenCode + MCP + Docker stack
./install.sh

# Clone the repository
git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon

# Interactive installer: pick LLM provider, pull the toolbox image,
# and build the OpenCode + MCP + Docker stack
./install.sh

2. Configure the LLM Provider

The interactive installer writes a .env. The docs' reference configuration is an Opus-class frontier model; any current top-tier model works, and cloud and local providers are interchangeable.

# .env — provider selection for the OpenCode "AI brain"
# Reference configuration in the docs is an Opus-class frontier model.
OPENCODE_MODEL="anthropic/claude-opus-4-8"     # or the current Opus-class frontier model
OPENROUTER_PROVIDER="anthropic"                # anthropic | openai | groq | mistral | openrouter | local
ANTHROPIC_API_KEY="sk-..."

# Local / self-hosted alternative (Ollama or llama.cpp).
# NOTE: sub-32B models cannot sustain autonomous campaigns.
# OPENROUTER_PROVIDER="local"
# OPENCODE_MODEL="ollama/qwen3-coder:32b"

# .env — provider selection for the OpenCode "AI brain"
# Reference configuration in the docs is an Opus-class frontier model.
OPENCODE_MODEL="anthropic/claude-opus-4-8"     # or the current Opus-class frontier model
OPENROUTER_PROVIDER="anthropic"                # anthropic | openai | groq | mistral | openrouter | local
ANTHROPIC_API_KEY="sk-..."

# Local / self-hosted alternative (Ollama or llama.cpp).
# NOTE: sub-32B models cannot sustain autonomous campaigns.
# OPENROUTER_PROVIDER="local"
# OPENCODE_MODEL="ollama/qwen3-coder:32b"

3. Run an Authorized Campaign

# Bring the stack up
docker compose up -d

# Launch an authorized assessment against a scoped target
./darkmoon.sh "TARGET: example.com"

# Scope- and safety-bounded run. Note: OUT excludes HOSTS,
# EXCLUDE/FOCUS tune attack CLASSES, and NOISE bounds intensity.
./darkmoon.sh "TARGET: example.com \
  TARGETS: *.example.com \
  OUT: admin.example.com, payments.example.com \
  FOCUS: sqli, ssrf, idor \
  SEVERITY: high \
  NOISE: low \
  SAFE_HARBOR: yes \
  FORMAT: h1"

# Bring the stack up
docker compose up -d

# Launch an authorized assessment against a scoped target
./darkmoon.sh "TARGET: example.com"

# Scope- and safety-bounded run. Note: OUT excludes HOSTS,
# EXCLUDE/FOCUS tune attack CLASSES, and NOISE bounds intensity.
./darkmoon.sh "TARGET: example.com \
  TARGETS: *.example.com \
  OUT: admin.example.com, payments.example.com \
  FOCUS: sqli, ssrf, idor \
  SEVERITY: high \
  NOISE: low \
  SAFE_HARBOR: yes \
  FORMAT: h1"

4. Validate Against a Lab Target First

Before pointing DarkMoon at a client, run it against a deliberately vulnerable target you control. This confirms the Docker stack, GPU/CPU inference, and the privacy gateway all work, and shows you exactly what EXPLOITED vs Confirmed output looks like on a known-vulnerable app.

# Stand up a deliberately vulnerable target you control
docker run -d -p 3000:3000 bkimminich/juice-shop   # OWASP Juice Shop

# Point a tight, low-noise campaign at it
./darkmoon.sh "TARGET: http://localhost:3000 \
  TARGETS: http://localhost:3000 \
  NOISE: low \
  SAFE_HARBOR: yes"

# In a second shell, stream what the agents are actually doing
./darkmoon.sh --log <session_id>

# Confirm output landed and inspect the evidence
ls ./reports/

# Stand up a deliberately vulnerable target you control
docker run -d -p 3000:3000 bkimminich/juice-shop   # OWASP Juice Shop

# Point a tight, low-noise campaign at it
./darkmoon.sh "TARGET: http://localhost:3000 \
  TARGETS: http://localhost:3000 \
  NOISE: low \
  SAFE_HARBOR: yes"

# In a second shell, stream what the agents are actually doing
./darkmoon.sh --log <session_id>

# Confirm output landed and inspect the evidence
ls ./reports/

While it runs, capture the outbound LLM traffic and confirm your canary hostnames and credentials were tokenized before anything left the host — that is the only real proof the privacy gateway holds.

Community vs Pro

Pro activation

# Pro Edition: activate with a licence key
sudo ./install.sh LICENSE-KEY

# Add or rotate LLM providers on a live stack
./darkmoon.sh --connect

# Web UI (change the default admin/admin credentials immediately)
# http://localhost:80

# Pro Edition: activate with a licence key
sudo ./install.sh LICENSE-KEY

# Add or rotate LLM providers on a live stack
./darkmoon.sh --connect

# Web UI (change the default admin/admin credentials immediately)
# http://localhost:80

Pro runtime hardening

Scope & Safety Flags

Campaign behavior is controlled through directives passed in the run prompt. Scope is defined with TARGETS (in-scope) and OUT (out-of-scope); EXCLUDE and FOCUS tune attack classes, not hosts. Set these deliberately — defaults are permissive enough to wander outside a tight engagement.

Usage example

TARGET: example.com
PROGRAM: acme-public-bbp
TARGETS: *.example.com
OUT: status.example.com, blog.example.com
FOCUS: idor, ssrf, sqli
SAFE_HARBOR: yes
SEVERITY: high

# I have written authorization to test *.example.com under the Acme
# public bug bounty program. Run an authorized assessment, validate
# findings with evidence, and produce a HackerOne-format report.

TARGET: example.com
PROGRAM: acme-public-bbp
TARGETS: *.example.com
OUT: status.example.com, blog.example.com
FOCUS: idor, ssrf, sqli
SAFE_HARBOR: yes
SEVERITY: high

# I have written authorization to test *.example.com under the Acme
# public bug bounty program. Run an authorized assessment, validate
# findings with evidence, and produce a HackerOne-format report.

Monitoring, Output & Control

Campaigns run unattended, so know how to watch and bound them before you launch.

Evidence & Reporting

Findings are reported only with supporting HTTP requests, payloads, and responses, and are triaged into two states so a human knows what still needs review:

Reports export to standard, HackerOne, and Bugcrowd formats (signed PDF on Pro), alongside an interactive attack-surface graph and, on Pro, vulnerability-evolution tracking across campaigns.

Pre-Flight Checklist

Clear every item before pointing DarkMoon at anything you do not own.

Troubleshooting