🛡️ Cybermes

Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework

📑 Table of Contents

• Overview
• Architecture & Core Engine
• Operational Methodology (Phases 1–6)
• Offensive Skills Layer (50+ Modules)
• Integrated Security Knowledge Base
• Toolchain & Integration
• Repository Structure
• Installation & Quick Start
  • Method 1: Docker & Docker Compose (Recommended)
  • Method 2: Native Host Setup
• 🤖 Telegram Bot Integration
• 🎯 Prompt Engineering & Anti-Filter Guidelines
• 📚 Extended Documentation
• Configuration & Scope Rules
• Local Validation with Mock Target
• 📦 Release & Version History
• ⚖️ License
• ⚠️ Legal & Ethical Disclaimer
• 👥 Contributors

📖 Overview

Cybermes bridges modern LLM reasoning with automated offensive security workflows. Built upon the Hermes Agent runtime, it empowers security teams and researchers to conduct deep, context-aware security assessments within authorized boundaries.

Unlike traditional heuristic scanners that generate noisy alerts, Cybermes combines:

• Autonomous Multi-Step Reasoning: Dynamically formulates attack plans based on observed server technologies and response signatures.
• Deep Skill Matrix: 50+ domain-specific skills covering authorization, business logic, injections, cryptographic flaws, and cloud vectors.
• Multi-Source Knowledge Retrieval: Integrated offline knowledge bases from PayloadsAllTheThings, HackTricks, Claude-BugHunter, and Strix.
• Client-Side & Browser MCP Automation: Full browser interaction via Playwright / Chromium for DOM inspection, SPA routing, and headless client verification.
• Zero-Noise PoC Validation: Every finding is validated programmatically with executable proof scripts before entering the final report.

🏛️ Architecture & Core Engine

┌────────────────────────────────────────────────────────────────────────┐
│                          CYBERMES CORE ENGINE                          │
├────────────────────────────────────────────────────────────────────────┤
│  [ Operator Prompt / Target Queue ]  ──>  [ Scope Validator: scope.yaml ]
│                                                     │
│                                                     ▼
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │                    Hermes Reasoning Loop                         │  │
│  │  - Context Window Memory       - Multi-Model LLM Orchestration   │  │
│  │  - Action Planning & Recovery  - Decision Confidence Grading     │  │
│  └──────────────────────────────────────────────────────────────────┘  │
│          │                                         │                   │
│          ▼                                         ▼                   │
│  ┌─────────────────────────┐             ┌──────────────────────────┐  │
│  │   50+ Security Skills   │             │  Curated Knowledge Base  │  │
│  │  - IDOR / BOLA / Auth   │             │  - PayloadsAllTheThings  │  │
│  │  - SSRF / XSS / SQLi    │ <─────────> │  - HackTricks Wiki       │  │
│  │  - Cloud / K8s / SAML   │             │  - Claude-BugHunter      │  │
│  │  - Prompt Injection     │             │  - Strix Multi-Agent DB  │  │
│  └─────────────────────────┘             └──────────────────────────┘  │
│          │                                         │                   │
│          ▼                                         ▼                   │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │                  Security Toolchain & MCP Bridge                 │  │
│  │  • Recon: subfinder, amass, assetfinder, httpx                   │  │
│  │  • Mining & Crawling: katana, gau, waybackurls, arjun            │  │
│  │  • Fuzzing & Exploitation: ffuf, sqlmap, dalfox, nuclei, nmap    │  │
│  │  • Headless Browser MCP: Chromium Playwright DOM Automation      │  │
│  └──────────────────────────────────────────────────────────────────┘  │
│                                     │                                  │
│                                     ▼                                  │
│              [ Validated PoC Scripts & CVSS v3.1 Report ]              │
└────────────────────────────────────────────────────────────────────────┘

🔄 Operational Methodology (Phases 1–6)

Cybermes operates through a structured six-phase pipeline:

Phase 1: Recon & Port Surface     ──> Subdomain enumeration, DNS resolution, port probing
Phase 2: Endpoint & URL Mining   ──> Active crawling, historical URL scraping, SPA analysis
Phase 3: Fuzzing & Parameter Hunt ──> Directory discovery, hidden parameter mining, JS secret audit
Phase 4: Vulnerability Analysis   ──> Nuclei templating, OOB callback verification, DOM XSS checks
Phase 5: Logic, Auth & IDOR       ──> Dual-account matrix testing, JWT abuse, privilege escalation
Phase 6: Verification & Reporting ──> Reproducible PoC script execution, CVSS v3.1 scoring, remediation

1. Phase 1 — Reconnaissance & Asset Discovery: Subdomain discovery (subfinder, amass), DNS resolution, and live endpoint probing (httpx).
2. Phase 2 — Content, URL & SPA Mining: Active crawling (katana), historical URL scraping (gau, waybackurls), stream deduplication, and browser rendering for SPAs (React, Vue, Angular).
3. Phase 3 — Parameter Discovery & Fuzzing: Directory/vhost fuzzing (ffuf, feroxbuster), hidden parameter identification (arjun), and client-side JavaScript secret hunting.
4. Phase 4 — Automated Testing & Callback Verification: Targeted nuclei evaluation, Out-of-Band callback checks (interactsh) for blind SSRF/RCE, and DOM-level browser evaluation.
5. Phase 5 — Business Logic, Auth & IDOR: Dual-session testing across permission boundaries, token replay, mass assignment, and tenant boundary validation.
6. Phase 6 — Verification & Structured Reporting: End-to-end Python PoC verification, CWE mapping, CVSS v3.1 vector calculation, and remediation advisory generation.

🎯 Offensive Skills Layer (50+ Modules)

Cybermes bundles 50+ domain-specific offensive security skills:

📚 Integrated Security Knowledge Base

The repository includes curated knowledge repositories located under knowledge/:

• PayloadsAllTheThings: Comprehensive repository of payloads, filter bypasses, and injection cheatsheets across 50+ vulnerability types.
• HackTricks: Industry-standard penetration testing wiki covering service enumeration, web exploitation, lateral movement, and privilege escalation.
• Claude-BugHunter: Specialized engagement patterns, automated triage playbooks, and assessment strategies.
• Strix Knowledge: Multi-agent collaborative security coordination patterns and technology fingerprints.

🧰 Toolchain & Integration

|