samugit83/redamon

Description Implement a cross-session learning system where the agent generates structured reflections after failures and stores complete engagement episodes. On future sessions, relevant reflections and past experiences are retrieved and injected into the agent's context — so it never repeats the same mistake twice. Why this matters Today, every session starts from zero. The agent has no memory of: "Last time I tried CVE-2021-41773 on Apache 2.4.49, it failed because mod_cgi was disabled — I should check mod_cgi first" "Nuclei template xyz always false-positives on Cloudflare targets — skip it" "SSH brute force with admin:admin worked on this target last week — try that first" "sqlmap with --tamper=space2comment bypassed the WAF on similar PHP apps" A human pentester builds this institutional knowledge over years. The agent discards it after every session. Reflexion + episodic memory closes this gap. Two components 1. Reflexion (failure-triggered) After a tool execution fail

Description Replace the flat todo list with a two-level Planner → Executor hierarchy. The Planner sets strategic milestones with success criteria, iteration budgets, and contingency plans. The Executor (existing ReAct loop) works within the current milestone's scope. The Planner re-evaluates after each milestone completes or when the Executor gets stuck. Why this matters The agent's #1 failure mode on long engagements is losing strategic direction. After 15+ iterations, the flat todo list becomes stale and the agent drifts — repeating scans, trying random exploits, or spending 30 iterations on recon when it should have started exploitation 20 iterations ago. A Planner solves this by: Budget enforcement: each milestone gets a max iteration count. "Reconnaissance" gets 5 iterations — if it's not done by then, the planner forces a decision: proceed with what you have or ask the user. Contingency planning: "If SQL injection fails on the web app, pivot to SSH brute force." Without th

Description Expand the agent's toolset from 9 tools to ~15+ by adding the highest-ROI capabilities identified in the GAP analysis. The #1 gap between RedAmon and competing frameworks is tools, not architecture — more tools in the existing ReAct agent yields immediate capability gains with zero architectural changes. Why new tools (not just better prompts) The agent's ceiling is defined by what it can DO, not what it can THINK. Today, when the agent needs to: Find exposed assets on the internet → it has web_search (generic results) but no Shodan (structured service/banner/CVE data per IP). A pentester's first move is shodan host <target> — the agent can't do this. Discover exposed admin panels, backup files, or sensitive endpoints → it can't Google dork. site:target.com filetype:sql, inurl:admin intitle:login — these are OSINT fundamentals the agent is blind to. Craft a custom exploit or parse complex output → it can't write and run code. When sqlmap output needs parsing, o

Description Implement a dedicated classified attack path for client-side browser exploitation — targeting the victim's browser via malicious pages, browser_autopwn2, and JavaScript-based payloads. Why the unclassified fallback isn't enough Client-side attacks have a fundamentally different topology from server-side exploits — the target connects to YOU, not the other way around: Reversed connection model: in CVE exploitation, the agent connects to the vulnerable server. In client-side exploitation, the agent hosts a malicious server and the victim visits it. This inverted model requires setting up auxiliary/server/browser_autopwn2 or crafting a custom page, getting the URL, and delivering it — a multi-phase workflow the unclassified path doesn't guide. Browser fingerprinting determines the payload: browser_autopwn2 automatically selects exploits based on the victim's User-Agent (IE vs Chrome vs Firefox, OS, Java/Flash version). The agent needs to understand that it cannot pre-se

Description Implement a dedicated classified attack path for local privilege escalation — systematic enumeration of privesc vectors followed by targeted exploitation to escalate from low-privilege shell to root/SYSTEM. Why the unclassified fallback isn't enough Privilege escalation is the most methodical and OS-dependent phase of a pentest. The agent fails without structured guidance because: Enumeration must be exhaustive and OS-specific: on Linux, check SUID binaries, cron jobs, writable /etc/passwd, kernel version, sudo -l, capabilities, NFS shares, Docker group membership. On Windows, check SeImpersonatePrivilege, unquoted service paths, AlwaysInstallElevated, scheduled tasks, stored credentials, UAC bypass vectors. The unclassified fallback doesn't know any of these — the agent runs whoami and stops. The right exploit depends on enumeration results: a SUID find binary → GTFOBins one-liner. A writable cron job → inject reverse shell. SeImpersonatePrivilege → PrintSpoofer