DARKMOON

Autonomous security platform

DARKMOON

Autonomous penetration testing

18 AI agents, 80+ integrated tools and a live command center — Darkmoon runs the full offensive campaign and delivers validated, evidence-backed findings.

Get Darkmoon

[](https://buy.stripe.com/eVq28k3prcNG10i9m22Nq00)

Live demo

[](https://demo.dark-moon.org/)

Scroll

demo.dark-moon.org/dashboard

Dashboard

statistics

projects

targets

campaigns

vulnerabilities

Vulnerabilities by severity

critical

14.04 %

high

42.11 %

medium

36.84 %

low

7.02 %

Last campaigns

| # | target | date | duration | risk | vulnerabilities | status | | -------------------- | ---------- | ------------ | -------- | -------- | --------------- | --------- | | camp\_20260426\_3d2f | 172.19.0.3 | Apr 26, 2026 | 28.5 min | critical | 57 | completed | | camp\_20260419\_a1b2 | 172.19.0.3 | Apr 19, 2026 | 32 min | critical | 49 | completed | | camp\_20260412\_e5f6 | 172.19.0.3 | Apr 12, 2026 | 25.6 min | high | 44 | completed | | camp\_20260405\_c9d0 | 172.19.0.3 | Apr 5, 2026 | 22 min | high | 38 | completed |

The autonomous offensive security platform.

camp\_20260426\_3d2f · 172.19.0.3

Running

Projects

Targets

Campaigns

Vulns

Vulnerabilities · by severity57 total

Critical

014.0%

High

042.1%

Medium

036.8%

Low

07.0%

Last 6 campaigns · vulnsavg 39

02957

3d2f

a1b2

e5f6

c9d0

a3b4

f1e2

Agent event streamlive

Get Darkmoon

[](https://buy.stripe.com/eVq28k3prcNG10i9m22Nq00)

Live demo

[](https://demo.dark-moon.org/)

Specialized AI agents

80+

Integrated tools

Live

SSE dashboard

AES-256

Sealed runtime

80+ integrated tools — every one coordinated by AI

subfinder

httpx

naabu

katana

nuclei

ffuf

wpscan

sqlmap

hydra

hashcat

netexec

bloodhound

impacket

mimikatz

kubectl

kubescape

whatweb

wafw00f

arjun

playwright

subfinder

httpx

naabu

katana

nuclei

ffuf

wpscan

sqlmap

hydra

hashcat

netexec

bloodhound

impacket

mimikatz

kubectl

kubescape

whatweb

wafw00f

arjun

playwright

Why Darkmoon

Not a scanner. An autonomous security conductor.Not a scanner. An autonomous security conductor.

Darkmoon reasons about your target, models the attack surface and dispatches the right agents — with full cascade control.

Core engine

Multi-agent dispatch14 signals

The master agent detects 14 technology signals and routes the campaign to the right specialists — sequential or parallel, with cascade depth capped at three levels so there is never runaway recursion.

#recon#web#k8s#ad

Streaming

Live SSE streamrealtime

Every finding, infrastructure node and agent event streams to the dashboard the instant it happens.

#sse#events

Export

Publication-ready reportsISO 27001

ISO 27001, HackerOne and Bugcrowd formats — Markdown and branded, password-protected PDF with CVSS 3.1 scoring and MITRE ATT&CK mapping.

#pdf#cvss#mitre

Sealed

Hardened runtimeAES-256

Sealed storage, hardware-bound licensing and a continuous integrity watchdog.

#seccomp

Infrastructure Map

Campaign · camp\_20260426\_3d2f… · 26 Apr 2026

Refresh

11Nodes

10Connections

57Vulnerabilities

8critical

24high

21medium

4low

🎯acme.test🛡edge-fw🖥172.19.0.331🖥172.19.0.8⚙:443 nginx🗄:6379 redis4🔑:88 kerberos3🏛DC016🌍/login9🌍/search5</>api v23

⤢+−

Severity

critical

high

medium

low

info

· Infra graph

Every host, every path, every vuln mapped.

Pricing

Open source at the core. One licence to run the full autonomous platform.

MonthlyYearly

###

Community

Open source — self-host it forever

Free

Free forever — GPLv3

Full autonomous engine on GitHub
GPLv3 — audit & modify freely
18 AI agents + 80 integrated tools
MCP-gatekept tool execution
Community support

Star on GitHub

###

Pro

For professional pentesters & teams

€149

Billed €1788 annually

Everything in Community, and:

Hardened, sealed runtime
Managed live command center
All report formats & branded PDF
Hardware-bound licence
Priority email support

Get Darkmoon

###

Custom

For enterprises, MSSPs & resellers

Let's talk

Tailored to your scope

Everything in Pro, and:

Multi-seat shared workspace
Custom report branding
Partner / reseller program
Dedicated onboarding & SLA

Contact sales

AI agents

18 specialists. One orchestrator. Zero manual pivoting.18 specialists. One orchestrator. Zero manual pivoting.

The master agent detects your target's stack and dispatches the right specialists automatically.

pentest · orchestrator

wordpress

graphql

headless-browser

node · express

nestjs · nextjs

flask · django

aspnet · blazor

spring boot

ruby on rails

php · laravel

drupal

joomla

moodle

magento

prestashop

kubernetes

active directory

pentest · orchestrator

wordpress

graphql

headless-browser

node · express

nestjs · nextjs

flask · django

aspnet · blazor

spring boot

ruby on rails

php · laravel

drupal

joomla

moodle

magento

prestashop

kubernetes

active directory

11 classes

Full-stack exploitationWeb & API

SQLi, XSS, SSRF, IDOR, RCE, SSTI, deserialization, JWT abuse, file upload and path traversal — validated with real payloads, not signatures.

#sqli#xss#rce

14 phases

Kubernetes attack chainInfrastructure

RBAC escalation, DIND exploitation, node escape, etcd SSRF, privileged container breakout, crypto-miner detection and CIS benchmarking.

#rbac#etcd#cis

8 phases

Active Directory takeoverIdentity

AS-REP roasting, Kerberoasting, BloodHound, NTLM relay, LSASS dump, DCSync and ADCS ESC1–ESC8, Golden & Silver tickets.

#kerberos#ntlm#adcs

Runtime security

Built like a vault.

Darkmoon's runtime guard enforces tamper-proof execution, sealed storage and hardware-bound licensing from the moment the container starts.

30s reseal

AES-256-GCM sealed storageat rest

Agents and workflows are encrypted at rest. Keys derive from your licence and hardware fingerprint, resealed every 30 seconds.

#aes-256

SHA-256

Hardware-bound licensingmachine code

Machine code derives from MAC address and CPU model. No deployment ID to spoof, no env var to manipulate.

#fingerprint

2s checks

Binary integrity watchdogcontinuous

SHA-256 hashes of critical binaries are re-verified every 2 seconds. Any tampering triggers an immediate zeroize.

#watchdog

Live scan

Debugger & tracer detectionanti-tamper

Continuous scanning for gdb, strace, ltrace, frida and lldb. Any tracer triggers a breach and full state zeroize.

#frida#gdb

UID 10001

Read-only rootfs + seccompsandbox

Read-only filesystem, tmpfs writable paths, seccomp and no-new-privileges. The process runs unprivileged.

#seccomp

Scrubbed

Secret redaction in logsstdout/stderr

Every model API key and the licence key are scrubbed from stdout and stderr before any log output.

#redaction

Dashboard

statistics

projects

targets

campaigns

vulnerabilities

Vulnerabilities by severity

critical

14.04 %

high

42.11 %

medium

36.84 %

low

7.02 %

Last campaigns

· Overview

Every campaign at a glance.

Open source

The model plans. It never gets a shell.

Darkmoon's architecture is its security guarantee — and it's fully auditable. The AI reasons and writes the plan. An MCP gateway gatekeeps every tool call. Read it, then run it yourself.

Star on GitHub

[](https://github.com/ASCIT31/Dark-Moon)

Read the docs

[](https://docs.dark-moon.org/)

\# clone the open-source engine

$ git clone github.com/ASCIT31/Dark-Moon

$ cd Dark-Moon

\# launch a campaign

$ ./darkmoon.sh "TARGET: acme.test"

✓ recon complete · 14 tech signals

✓ 6 agents dispatched · streaming live

Get started

Three ways to run Darkmoon.Three ways to run Darkmoon.

Self-host the platform, order a managed engagement, or resell it to your own clients.

Licence

Get the Darkmoon licenceself-hosted

Run the full platform on your own infrastructure. Hardware-bound licence, Docker install, monthly or annual.

#docker#self-host

Service

Pentest on Demandmanaged

Describe your target, sign the framework online, pay a flat rate. Our experts run it and deliver a debriefed report.

#managed

Partner

Partner Programresellers

Resell Darkmoon under your own commercial wrapper. One dashboard, every licence, Stripe-powered billing built in.

#reseller#mssp

Pentest on DemandManaged

€799/ engagement

Legal framework & authorizations included
Run end to end by our security experts
Debriefed report in a secure client space

Managed service

Don't self-host? We run the pentest for you.

Describe your target, sign the framework online, pay a flat rate — our experts run the full offensive engagement and deliver a debriefed, evidence-backed report to your secure client space.

Order a pentest

[](https://dark-moon.org/pentest-on-demand)

FAQ

Questions security teams ask first.Questions security teams ask first.

###

How is Darkmoon different from a vulnerability scanner?Platform

Darkmoon orchestrates an end-to-end offensive campaign — it reasons about the target, dispatches domain specialists, validates findings with real payloads, builds an infrastructure graph and produces a structured report. A scanner runs one-pass signatures. Darkmoon runs a pentest.

###

Why does the AI never get shell access?Architecture

###

Is Darkmoon really open source?Open source

###

What report formats does Darkmoon produce?Reporting

###

How does licensing work?Licensing

###

Is it safe to run against production environments?Safety

Replace static pentests with autonomous security testing.

Live visibility, validated evidence and a report your team can act on the same day.

Get Darkmoon

[](https://buy.stripe.com/eVq28k3prcNG10i9m22Nq00)

Talk to the team

[](https://dark-moon.org/contact)

DARKMOON

DARKMOON

DARKMOON

The autonomous offensive security platform.

Not a scanner. An autonomous security conductor.Not a scanner. An autonomous security conductor.

Multi-agent dispatch14 signals

Live SSE streamrealtime

Publication-ready reportsISO 27001

Hardened runtimeAES-256

Every host, every path, every vuln mapped.

Pricing

18 specialists. One orchestrator. Zero manual pivoting.18 specialists. One orchestrator. Zero manual pivoting.

Full-stack exploitationWeb & API

Kubernetes attack chainInfrastructure

Active Directory takeoverIdentity

Built like a vault.

AES-256-GCM sealed storageat rest

Hardware-bound licensingmachine code

Binary integrity watchdogcontinuous

Debugger & tracer detectionanti-tamper

Read-only rootfs + seccompsandbox

Secret redaction in logsstdout/stderr

Every campaign at a glance.

The model plans. It never gets a shell.

Three ways to run Darkmoon.Three ways to run Darkmoon.

Get the Darkmoon licenceself-hosted

Pentest on Demandmanaged

Partner Programresellers

Don't self-host? We run the pentest for you.

Questions security teams ask first.Questions security teams ask first.

Replace static pentests with autonomous security testing.

Comments (0)