Dark Moon

Darkmoon is an open-source, self-hosted penetration testing platform that orchestrates a team of specialized AI agents to run full offensive security campaigns — from reconnaissance and exploitation to reporting. It models the attack surface of web apps, cloud infrastructure, Active Directory, Kubernetes, and IoT devices, then dispatches the right agents with cascade control to chain real exploits and deliver validated, evidence-backed findings. The live SSE dashboard streams every finding, infrastructure node, and agent event in real time, while the platform exports publication-ready reports in ISO 27001, HackerOne, and Bugcrowd formats with CVSS 3.1 scoring and MITRE ATT&CK mapping. The core engine detects 14 technology signals from the target and routes campaigns to specialist agents covering full-stack web exploitation, Active Directory takeover, cloud identity pivots, and IoT firmware analysis. A Privacy Gateway tokenizes every sensitive value — IPs, hostnames, emails, credentials — before it reaches the LLM, so the model reasons only on deterministic placeholders while real values are re-injected locally. Exfiltration attempts are blocked, and all outputs are sanitized before returning to the model. Darkmoon runs in a hardened runtime: AES-256 sealed storage (resealed every 30 seconds), hardware-bound licensing, a binary integrity watchdog, anti-tamper detection, a read-only rootfs with seccomp sandbox, and secret redaction in logs. Recent real-world campaigns documented by the team show Darkmoon chaining complex attack paths: an Entra ID tenant takeover via a deleted blob and ROPC without MFA, an Azure helpdesk-to-Global Admin chain across four identities, and SSRF via gopher to GCP metadata to steal a service account token. Static firmware analysis found a backdoor and credentials in an IoTGoat image without ever touching the device, and a GitLab CE audit uncovered 13 findings. Darkmoon comes in three editions: the free Community edition (18 agents,