Darkmoon

Key Features

• •Multi-agent dispatch: The master agent detects 14 technology signals and dispatches specialist agents sequentially or in parallel, with cascade depth capped at three levels. This adapts the campaign to the target's attack surface, ensuring thorough coverage without runaway recursion.
• •Live SSE stream: Every finding, infrastructure node, and agent event streams to the dashboard in real time. Teams gain immediate visibility into critical vulnerabilities, enabling faster response and informed decision-making.
• •Publication-ready reports: Exports in ISO 27001, HackerOne, and Bugcrowd formats as Markdown or branded, password-protected PDFs with CVSS 3.1 scoring and MITRE ATT&CK mapping. This streamlines compliance and bug bounty submissions.
• •Hardened sealed runtime: AES-256-GCM sealed storage, hardware-bound licensing, binary integrity watchdog every two seconds, and anti-tamper detection for debuggers. This ensures tamper-proof, secure execution safe for production environments.
• •Infrastructure map: Graphical visualization of all hosts, paths, and vulnerabilities. The interactive map shows attack paths and severity, helping teams understand the full scope of the security posture.
• •Full-stack exploitation: Validates web and API vulnerabilities including SQLi, XSS, SSRF, RCE, SSTI, and JWT abuse using real payloads, not signatures. This confirms actual exploitability and reduces false positives.
• •Kubernetes attack chain: Covers RBAC escalation, DIND exploitation, node escape, etcd SSRF, privileged container breakout, and CIS benchmarking. This automates deep infrastructure security testing for cloud-native environments.
• •Active Directory takeover: Executes AS-REP roasting, Kerberoasting, BloodHound analysis, NTLM relay, LSASS dump, DCSync, and ADCS ESC1-ESC8 attacks. It simulates a full AD compromise to identify critical identity risks.

Use Cases

• •Self-hosted continuous pentesting: A security team runs weekly campaigns against their staging environment, automatically detecting and validating critical vulnerabilities like SQL injection and misconfigured Kubernetes RBAC. They receive a complete evidence-backed report each time, reducing manual effort by 80%.
• •Managed pentest on demand: An organization describes their target, signs the framework online, and pays a flat rate of €799 per engagement. Darkmoon experts run the full offensive campaign and deliver a debriefed report in a secure client space, eliminating the need for in-house expertise.
• •Partner/reseller program for MSSPs: Managed security service providers resell Darkmoon under their own brand using a Stripe-powered billing dashboard. They can run multiple campaigns for clients, generating branded reports and scaling their offensive testing services.
• •Bug bounty reconnaissance: A security researcher uses Darkmoon to automate reconnaissance and validation for bug bounty targets. The AI agents discover unique attack paths and validate them with real payloads, surfacing critical vulnerabilities that manual testing might miss.
• •Compliance reporting for ISO 27001: An organization needing ISO 27001 certification runs Darkmoon campaigns against their production environment. The platform produces structured reports with CVSS scoring and MITRE ATT&CK mapping, directly supporting audit evidence collection.

Who is this for?

Professional penetration testers, security engineers, DevSecOps teams, managed security service providers (MSSPs), enterprises requiring continuous security testing, and bug bounty hunters. The platform is also suitable for compliance officers needing evidence-backed reports for audits and for resellers who want to offer offensive security services under their own brand. It serves organizations of all sizes, from individual security researchers to large enterprises with complex hybrid infrastructures including Kubernetes and Active Directory environments.