T3MP3ST

No entries match these filters. Clear filters

1. changes since 2026-09-04 Sep 4, 2026 · issue 065

   T3MP3ST adds a WPScan JSON parser, known-debt adapter templates, a format-string CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. lab, and a synthetic memory-forensics fixture.

   └──▷ TRY IT
   Regenerate the memory-forensics fixture byte-for-byte to verify provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. before running the CTF challenge.
   copy

   $ python3 ctf/challenges/artifacts/memory-forensics/generate.py

   • Adds parseWpscan to src/arsenal/parsers.ts, ingesting wpscan --format json output and mapping WordPress core, plugin, and theme vulnerabilities to structured ToolFinding records with severity levels (high for core insecure labels, medium for confirmed component vulns, info for interesting findings).
   • Adds ARG_TEMPLATES for five previously KNOWN_DEBT adapters — feroxbuster (-u/-w, --json -q), osv-scanner (--format json --recursive <path>), hashcat (receipt-gated with --potfile-disable), apktool (d -f <apk> -o apk-out), and yara (explicit ruleset required) — emptying the invocation-honesty guard's KNOWN_DEBT set.
   • Adds a reproducible native format-string CTF lab (ctf/docker/pwn/format-string/vuln.c) exposing an intentional dprintf format-string write primitive on port 9002, with digest-pinned images, loopback-only publish, and a deterministic solver.
   • Adds a deterministic synthetic memory-forensics fixture (ctf/challenges/artifacts/memory-forensics/memdump.raw) generated from generate.py, using FORMAT_VERSION = 'T3MP3ST-SYNTH-MEM-v1', a fixed 32 768-byte size, and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.-seeded deterministic noise — replacing an opaque host-mounted dump with a fully reproducible offline artifact.
   • Adds parseWpscan to src/arsenal/parsers.ts, ingesting wpscan --format json output and mapping WordPress core, plugin, and theme vulnerabilities to structured ToolFinding records with severity levels (high for core insecure labels, medium for confirmed component vulns, info for interesting findings).
   • Adds a reproducible native format-string CTF lab (ctf/docker/pwn/format-string/vuln.c) exposing an intentional dprintf format-string write primitive on port 9002, with digest-pinned images, loopback-only publish, and a deterministic solver.
   • Adds a deterministic synthetic memory-forensics fixture (ctf/challenges/artifacts/memory-forensics/memdump.raw) generated from generate.py, using FORMAT_VERSION = 'T3MP3ST-SYNTH-MEM-v1', a fixed 32 768-byte size, and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.-seeded deterministic noise — replacing an opaque host-mounted dump with a fully reproducible offline artifact.

   1 more in Everything

2. changes since 2026-09-03 Sep 4, 2026 · issue 064

   T3MP3ST gains CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal./EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. feed ingestion, CVE correlation API, alert delivery, honeytoken lifecycle, CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. labs, and more.

   └──▷ TRY IT
   Route honeytoken trigger alerts to Slack by setting the webhook URL before running T3MP3ST.
   copy

   $ export SLACK_WEBHOOK_URL='https://hooks.slack.com/services/T00/B00/xxxx'
   export DISCORD_WEBHOOK_URL=''
   export SIEM_WEBHOOK_URL=''

   • Adds provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build.-safe threat feed ingestion for cisa-kev and first-epss sources (via CISA_KEV_URL and FIRST_EPSS_URL), with typed KevRecord and EpssRecord normalization, bounded HTTP reads, deterministic deduplication, independent per-source failure isolation, and stale-cache fallback via a FeedCache interface.
   • Adds a CVE correlation API that maps technology names to KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use./EPSS candidates using caller-supplied ThreatFeedSnapshot data, with provenance preserved on every result and all matches classified as unverified candidates — no network access at correlation time.
   • Adds secure alert delivery (src/integrations/alerts.ts) supporting 'slack', 'discord', and 'siem' providers, configured via SLACK_WEBHOOK_URL, DISCORD_WEBHOOK_URL, and SIEM_WEBHOOK_URL environment variables, with AlertDestinationSpec controls for proxyPolicy, maxAttempts, rateLimitMs, and maxPayloadBytes.
   • Adds a scoped honeytoken lifecycle with a HoneytokenAlertSink / HoneytokenTrigger interface wired into the alert delivery layer.
   • Adds opt-in bounded context compression (src/llm/context-compression.ts) with explicit ContextKind and ContextTrust classification, token budgeting via CompressionOptions (tokenBudget, summaryTokenBudget), and full ContextAccounting reporting of retained, summarized, dropped, and overflowed items — system policy, authorization, evidence, citations, and unresolved errors are never summarized or dropped.

   +6 more show less

   • Adds a WPScan adapter with an argument template to the arsenal integration.
   • Adds optional Supabase persistence integration.
   • Adds resilient mission recovery.
   • Adds a bounded DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. toolkit.
   • Adds a CVE Vault interface.
   • Adds four isolated, deterministic CTF labs — weak-RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it., blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., stored XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.-mock-metadata — each running non-root with a read-only root filesystem, dropped capabilities, internal-only Docker networking, and an immutable base-image pin.

   11 details in Everything

3. changes since 2026-08-24 Sep 3, 2026 · issue 063

   T3MP3ST adds social OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. tools, headless-browser XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. probing, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.-aware scanning, and Windows parity

   • Adds username_search tool to the social_osint family: checks a username's existence across GitHub, GitLab, Reddit, Hacker News, Wikipedia, Steam, Keybase, VK, and Telegram using unauthenticated public surfaces — no API keys required (Sherlock-style).
   • Adds telegram_lookup tool: resolves a @username via the Telegram Bot API getChat call, returning public info (name, description, type, member count); reads the TELEGRAM_BOT_TOKEN environment variable when present and degrades gracefully without it.
   • Adds email_format tool: generates corporate email address candidates from a person's name and validates the domain's MX records via live DNS probe — no email sending.
   • Adds a headless-Chromium browser probe (browser.ts) that captures rendered DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime., page title, cookie flags (never values), and console errors, and performs a real XSS check by injecting a payload into a query parameter and detecting both reflection and alert-dialog execution.
   • Adds resolveSystemPrompt export to the prompts/index module, enabling dynamic system-prompt resolution for operators.

   5 details in Everything

4. changes since 2026-08-12 Aug 24, 2026 · issue 055

   T3MP3ST adds Novita AI as a native LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider and enables Claude Code session resume across kill-chain phases.

   • Adds NOVITA_API_KEY environment variable to enable Novita AI as a first-class LLM provider, dispatched through the OpenAI-compatible endpoint at https://api.novita.ai/openai/v1 with a default model and curated model catalog entries.
   • Adds T3MP3ST_TRUST_CLAUDE_SESSION environment variable (set to 1) to enable Claude Code session resume across kill-chain phases, persisting session state between agent turns instead of starting fresh each time.
   • Adds optional resetSession() method to the LLMProviderAdapter interface, allowing providers that support resumed backend sessions to expose a clean-session escape hatch.

   3 details in Everything

5. changes since 2026-07-13 Aug 12, 2026 · issue 043

   T3MP3ST gains LiteLLM gateway, Hugging Face + NanoGPT providers, SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, six OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. adapters, subdomain-takeover detection, and multi-language white-box ingest.

   └──▷ TRY IT
   Preview a safe upstream sync before committing any changes, to verify what would be updated without touching git state.
   copy

   $ pwsh scripts/update.ps1 -DryRun

   • Adds SOCKS5 egress proxy support plus hardened local-model path, enabling outbound traffic routing through a SOCKS5 proxy.
   • Adds LiteLLM as an AI gateway provider, broadening the range of LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. backends T3MP3ST can reach.
   • Adds Hugging Face provider and selectable local Claude Code models as new LLM backends.
   • Adds native NanoGPT provider support.
   • Adds six keyless recon/OSINT adapters with argument templates to the arsenal.

   +16 more show less

   • Adds built-in subdomain takeover detection to the arsenal.
   • Adds source and supply-chain parsers to the arsenal.
   • Adds multi-language white-box ingest via web-tree-sitter, with extraction of JS/TS arrow and function-expression definitions.
   • Adds live progress and recon bootstrap to the scan workflow.
   • Adds memcpy/memmove with non-constant length detection to the binary analysis arsenal.
   • Adds a Universal API Config panel (settings) with server-side model fetch.
   • Adds Docker deployment support including a Dockerfile healthcheck and localhost-only bind (127.0.0.1).
   • Updates DeepSeek models to V4 Flash and V4 Pro.
   • Adds support for OpenCode and Oh My Pi as local agents.
   • Adds a local-agent disconnect control to the UI.
   • Adds origin-scoped target headers configurable from environment variables.
   • Adds a portable strict War Room preflight check.
   • Adds a reproducible cross-model benchmark matrix.
   • Adds a safe cross-platform upstream updater (scripts/update.ps1) with DryRun, Hard, Force, and KeepBackup parameters.
   • Enhances function callingfunction callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. with richer schemas, validation, parallel execution, and Ollama native support.
   • Adds scope-receipt approval UI and target-scoped approval receipts for Admiral expanded scope.

   21 details in Everything