INSTALLATION

Key files are stored at ~/.red-specter/litestrike/. The signing key pair is generated on first run and stored at signing_key.pem. Reports are written to ~/.red-specter/litestrike/reports/.

QUICKSTART

OPEN GATE — Reconnaissance

INJECT GATE — Cache Poisoning

HARVEST GATE — Key Extraction

INTERCEPT GATE — Traffic Interception

Generating a Report

GATE REQUIREMENTS

GATE	ENV VAR	ROE PHRASE	FLAG	SUBSYSTEMS UNLOCKED
OPEN	—	—	—	RECON, FINGERPRINT, REPORT
INJECT	LITESTRIKE_INJECT_KEY	"ai gateway injection authorised"	--roe <file>	SUBSTITUTE, CACHE-POISON, AMPLIFY, CALLBACK
HARVEST	LITESTRIKE_HARVEST_KEY	"ai gateway key harvest authorised"	--roe <file>	EXHAUST, HARVEST-KEYS
INTERCEPT	LITESTRIKE_INTERCEPT_KEY	"ai traffic interception authorised"	--roe <file> --confirm-intercept	INTERCEPT

Gate keys are Ed25519 private keys stored at ~/.red-specter/litestrike/keys/. ROE files are plain-text files containing the required ROE phrase on a single line. The --confirm-intercept flag is required for INTERCEPT-gate operations and must be explicitly passed on the command line — it cannot be set via environment variable.

SUBSYSTEM REFERENCE

01 — RECON OPEN

Network-wide discovery of AI gateway proxy instances. Probes LiteLLM default ports (4000, 8000), OpenRouter API endpoints, Portkey (8787), Helicone, Kong (8000/8001/8444), Traefik dashboard (8080), Azure APIM management endpoints, and PromptLayer. Returns per-endpoint: gateway type, version (if detectable), authentication status (none/api-key/oauth), admin panel accessibility, and exploitation feasibility score.

02 — SUBSTITUTE INJECT

Silent model substitution. Exploits LiteLLM admin API to reconfigure model routing, redirecting requests for a target model identifier to an attacker-specified upstream endpoint. Downstream applications receive identical JSON response format; substitution is invisible at the API layer.

03 — CACHE-POISON INJECT

Semantic cache poisoning. Injects a crafted prompt whose embedding is a nearest-neighbour match for the target query class in the semantic similarity space, causing the poisoned response to be served to all users whose queries fall within the similarity threshold.

04 — AMPLIFY INJECT

AI cost amplification. Routes requests to the most expensive available model and/or constructs context-expansion prompts that maximise token consumption per request. Measures amplification ratio: actual cost vs authorised cost per request class.

05 — EXHAUST HARVEST

Rate-limit exhaustion and quota burning. Identifies all API keys in the gateway vault and issues requests on behalf of each key at maximum rate until per-key quota is exhausted. Measures time-to-zero per key and estimated financial impact.

06 — HARVEST-KEYS HARVEST

Bulk API key extraction. Exploits GHSA-4xpc-pv4p-pm3w (LiteLLM auth bypass) to dump all virtual keys. Extracts Portkey virtual key plaintext, Helicone API keys via IDOR, Azure APIM subscription keys, and PromptLayer project credentials. Returns structured credential inventory with provider, key fragment, spend, and rate-limit status.

07 — CALLBACK INJECT

SSRF via gateway callback injection. Registers attacker-controlled URL as a success/failure callback in the LiteLLM configuration, receiving copies of all proxied request/response pairs. Enables passive harvest of all AI traffic without modifying responses or detection by downstream consumers.

08 — FINGERPRINT OPEN

Deep gateway fingerprinting. Extracts version, routing table, virtual key count, session count, semantic cache config, authentication configuration, plugin/middleware chain, and Kong/Traefik/APIM policy details. Scores exploitation feasibility per endpoint.

09 — INTERCEPT INTERCEPT

Full traffic interception. Exploits CVE-2026-42271 (CISA KEV, CVSS 9.8) to reconfigure LiteLLM's model routing, directing all upstream calls through an attacker-controlled proxy that logs, modifies, or replaces request/response payloads in real time. Supports selective interception by model ID, virtual key, or requesting IP.

10 — REPORT OPEN

Generates LTS-{hex12} session report. Collects all subsystem outputs into a structured JSON report. Ed25519 signs with ~/.red-specter/litestrike/signing_key.pem. ML-DSA-65 countersigns. Saves to ~/.red-specter/litestrike/reports/.

FULL CLI REFERENCE

Global Flags

FLAG	TYPE	DESCRIPTION
--target	string	Target URL or CIDR range
--roe	path	Rules of engagement file path
--output	string	Output format: text (default), json, csv
--timeout	int	Connection timeout in seconds (default: 10)
--session-id	string	Existing LTS-{hex12} session ID to resume
--verbose	flag	Enable verbose output
--dry-run	flag	Show what would be done without executing

Subsystem-Specific Flags

FLAG	SUBSYSTEM	DESCRIPTION
--model	substitute, intercept	Target model ID to redirect
--redirect	substitute	Upstream URL to substitute for target model
--query-class	cache-poison	Semantic topic class to target for cache poisoning
--payload	cache-poison	Attacker-controlled response content to inject into cache
--similarity-threshold	cache-poison	Cosine similarity threshold for cache hit (default: 0.92)
--provider	amplify, exhaust	Target upstream provider (openai/anthropic/gemini/azure)
--mode	amplify	Amplification mode: cost (most expensive model) or tokens (context expansion)
--key-id	exhaust	Target specific virtual key ID for exhaustion
--gateway-type	harvest-keys	Target gateway type for key extraction method selection
--callback-url	callback	Attacker-controlled callback URL to register
--proxy	intercept	Attacker-controlled proxy URL for traffic interception
--inject-response	intercept	Response injection template (Jinja2) for in-transit modification
--confirm-intercept	intercept	Required confirmation flag for INTERCEPT-gate operations
--deep	fingerprint	Enable deep fingerprinting including plugin/policy enumeration

REPORT FORMAT

All SPECTER LITESTRIKE reports use the prefix LTS-{hex12} where hex12 is a 12-character lowercase hexadecimal session identifier. Reports are Ed25519 signed using the tool signing key and ML-DSA-65 countersigned for post-quantum verifiability.

WMD CLASSES

SPECTER LITESTRIKE targets 6 WMD (Weapons-Mass-Destruction) attack classes against AI gateway infrastructure:

ai_gateway_proxy_exploitation silent_model_substitution semantic_cache_poisoning ai_cost_amplification api_key_proxy_harvest ai_traffic_interception

WMD THREAT MODEL

AI gateways represent a uniquely high-value attack surface because they are the single point of control for all AI traffic in an organisation. A compromised gateway provides: (1) silent access to all LLM requests and responses transiting the proxy — complete AI activity exfiltration without touching end-user applications; (2) the ability to modify any AI response in real time, injecting adversarial content into responses without alerting end users; (3) mass API key theft — gateways aggregate credentials for every AI provider an organisation uses; and (4) cost weaponisation — draining organisation AI budgets via amplified usage.

Unlike attacks on individual AI applications, gateway-layer attacks are organisation-wide and require no per-application exploitation — a single vulnerability in the gateway gives access to every AI workload simultaneously.