Red Team Assessment

CyberDoc's Red Team feature provides AI-powered autonomous penetration testing using PentestAgent. An AI agent (Claude Sonnet) autonomously decides what to scan, adapts based on findings, chains tools together, and produces a comprehensive assessment report with structured findings and remediation steps.

How It Works

1. Domain Verification — Users must verify ownership of the target domain via DNS TXT record or file upload before launching an engagement. Admins bypass this requirement.
2. Launch Engagement — Select a target, playbook (Recon, Web, Network, or Full), and infrastructure mode. The request is proxied to the PentestAgent backend.
3. AI Agent Loop — PentestAgent creates a fresh AI agent that autonomously executes security tools, analyses results, and decides next steps. The agent runs until the task is complete or max iterations reached.
4. Structured Findings — All discoveries are saved as structured notes (credentials, vulnerabilities, findings, artifacts) and mapped to CyberDoc's severity format.
5. Report — A comprehensive markdown report is generated with executive summary, findings by severity, technical details, risk matrix, and remediation recommendations.

Infrastructure Modes

Playbooks

Agent Tools

The PentestAgent has access to these tool categories:

• terminal — Execute shell commands (nmap, nuclei, curl, sqlmap, metasploit, etc.). Output truncated at 50K chars.
• browser — Playwright headless browser for web interaction (navigate, click, type, screenshot, extract links/forms).
• notes — Structured finding storage with category validation (credential, vulnerability, finding, artifact). Persists across the engagement.
• web_search — Web search integration for OSINT and CVE lookup.

Finding Severity Mapping

PentestAgent's structured notes are mapped to CyberDoc severity levels:

Domain Verification

Before launching a red team engagement, you must verify ownership of the target domain. Two methods are supported:

• DNS TXT Record — Add a TXT record to the domain with a generated verification token.
• File Upload — Place a file at /.well-known/cyberdoc-verify.txt containing the token.

Verification is checked in real time via Google DNS (for TXT) or HTTP fetch (for file). Once verified, the domain remains verified for future engagements.

Security Guardrails

Tool output from untrusted sources is filtered through prompt injection guardrails adapted from the CAI framework:

• 40+ regex patterns detecting instruction overrides, hidden commands, encoding tricks
• Unicode homograph normalization (Cyrillic/Greek to Latin)
• Content sanitization with security delimiters
• Prevents target servers from hijacking the agent via crafted responses

API Endpoints

All red team endpoints require authentication. Business or Enterprise plan required.