Always running.
Always hunting.
An AI operator that reasons across your attack surface, executes real exploitation, and unifies offense with defense in one pane — scope-gated, approval-gated, fully audited.
From detecting attacks to proving them
1.1 turns RedDaemon from a scanner into an operator — real credential and Active-Directory execution, post-exploitation, and a purple loop that no competitor ships. Everything below runs behind a default-deny scope guard and human approval gates.
Autonomous Purple Loop
Attacks its own detections — mutates the attack through real evasions until it finds the blind spot, then hands you a hardened Sigma/SPL/KQL rule that closes it.
Signature · nobody else has thisCredential & AD Execution
Kerberoast, AS-REP, password spray, pass-the-hash, secretsdump, DCSync, ADCS abuse — via NetExec, Impacket, Certipy, Kerbrute. Real, gated, audited.
NetExec · Impacket · CertipyC2 & Post-Exploitation
Sliver integration: generate implants, drive live sessions, pivot — allowlisted by default, dangerous actions gated, implants auto-killed at engagement close.
Sliver · sessions · pivotBlind-Vuln Confirmation
An out-of-band (OAST) callback server confirms blind SSRF, XXE, and RCE actually fired — turning "possible" findings into proven ones.
OAST · HTTP + DNSEncrypted Loot Vault
Every captured credential, hash, ticket, and certificate — AES-256 encrypted, engagement-scoped, chainable (crack a hash, reuse it downstream), purged on close.
AES-256 · chainingThousands of Templates
Nuclei template pipeline — catalog, search, select, author your own — widening detection from a handful of checks to the full community library.
Nuclei · custom rulesDownloads paused
Downloads are paused pending safety review. You can ask about release status; contacting us does not bypass the review or guarantee a release date.
Windows
macOS
Linux
Android
Ask about release status
RedDaemon is distributed privately to authorized red teams and security orgs. Tell us who you are — we can discuss your intended use and current release status.
The safety review also applies to team downloads. Existing credentials do not bypass this hold.
- 01You request
Tell us your org and intended use. Authorized offensive-security use only.
- 02We verify & approve
Quick check that you're a legitimate red team or security org.
- 03Check release status
Downloads remain paused pending safety review. An access request does not unlock a build or guarantee a release date.
- 04Safe by default
Ships loopback-only. Every intrusive action re-checks scope and stops at an approval gate you control.