Darkmoon
DarkMoon is an open-source AI penetration testing platform that autonomously runs full security assessments against authorized targets. It orchestrates 50 specialist AI agents to execute real offensive operations across web, cloud, Active Directory, and Kubernetes, providing proof for every finding. Designed for security teams, DevSecOps engineers, red teamers, and ethical hackers, it ensures data privacy by running on local LLMs and never exposing real IPs or credentials to the model.
🎬 Darkmoon — AI-Powered Automated Pentesting · asc-it
✨ Key features
- Autonomous pentesting with 50 specialist AI agents
- Covers web, cloud, AD, Kubernetes, CI/CD, and more
- Privacy Gateway: local tokenization hides real IPs and credentials
- Proof-of-exploitation with exact commands and raw output
- Runs on local LLMs (Ollama, llama.cpp) or cloud providers
- CI/CD native with findings as artifacts
🎯 Use cases
- Continuous automated penetration testing for security teams
- Integrating AI-driven security research into DevSecOps pipelines
- Accelerating bug bounty hunting with autonomous target analysis
- Exploring attack surfaces for security research
- Training and education in offensive security
📦 Installation
🧰 Requirements: Requires Docker & Docker Compose and an LLM API key (OpenRouter, Anthropic, OpenAI, or local models).
git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon
./install.sh
install.sh handles provider configuration interactively. Use ./install.sh --init to force reconfiguration.
🚀 Usage
./darkmoon.sh "TARGET: http://172.19.0.3:3000"
Monitor in real-time with:
./darkmoon.sh --log <session_id>
❓ FAQ
Does DarkMoon require a cloud LLM?
No, it supports local models via Ollama or llama.cpp, ensuring data never leaves your infrastructure.
How does DarkMoon protect sensitive data?
It uses reversible local tokenization to replace real IPs, hostnames, URLs, and credentials with placeholders like IP_PRIVATE_001, which are rehydrated only when tools run and masked out of results.
What tools are included?
DarkMoon ships with 50+ offensive tools including Nuclei, NetExec, BloodHound, sqlmap, Impacket, Naabu, httpx, and ffuf, all accessible without path configuration.
Can I run DarkMoon in CI/CD?
Yes, it is CI/CD native; you can trigger a pentest in the pipeline and get findings as artifacts.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.