From 1a3fea615ae11f57b833c218bac315082b93ac95 Mon Sep 17 00:00:00 2001 From: salvacybersec Date: Mon, 6 Apr 2026 21:04:47 +0300 Subject: [PATCH] =?UTF-8?q?feat:=20major=20expansion=20=E2=80=94=203=20new?= =?UTF-8?q?=20variants,=20enhanced=20build=20system,=20platform=20auto-ins?= =?UTF-8?q?tall?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New persona variants: - forge/frontend-design — DESIGN.md methodology, 58-brand reference, UI/UX intelligence - oracle/source-verification — 5-section forensic verification protocol (ethos/pathos/context/intent/logos) - sentinel/c2-hunting — 6-phase C2 hunting with beaconing detection, detection engineering Enhanced existing personas: - neo: Added Active Directory exploitation (Kerberoasting, DCSync, delegation), network pivoting, cloud attacks - frodo: Added response mode auto-detection, claim extraction, Devil's Advocate, explicit uncertainty tracking - ghost: Added cognitive warfare expertise (behavioral science weaponization, algorithmic amplification) Build system enhancements: - Cross-persona escalation graph auto-extracted → generated/_index/escalation_graph.json - Trigger→persona routing index → generated/_index/trigger_index.json - Quality validation with warnings for thin/missing sections - Section word counts injected into every output - Richer CATALOG.md with depth stats, escalation paths, trigger index Platform auto-install: - python3 build.py --install claude — 111 slash commands → ~/.claude/commands/ - python3 build.py --install antigravity — personas → ~/.config/antigravity/personas/ - python3 build.py --install gemini — Gems → generated/_gems/ - python3 build.py --install openclaw — IDENTITY.md + personas → generated/_openclaw/ - python3 build.py --install all — deploy to all platforms Shared reference library: - personas/_shared/kali-tools/ — 16 Kali Linux tool reference docs - personas/_shared/osint-sources/ — OSINT master reference - personas/_shared/ad-attack-tools/ — AD attack chain reference Stats: 29 personas, 111 variants, 59,712 words Co-Authored-By: Claude Opus 4.6 (1M context) --- CLAUDE.md | 60 +++ build.py | 289 +++++++++++- personas/CATALOG.md | 413 +++++++++++++++++- personas/_shared/ad-attack-tools/tools.md | 10 + .../_shared/kali-tools/01-network-scanning.md | 241 ++++++++++ .../kali-tools/02-web-vuln-scanning.md | 362 +++++++++++++++ .../kali-tools/03-fuzzing-bruteforce.md | 265 +++++++++++ .../kali-tools/04-password-cracking.md | 378 ++++++++++++++++ .../_shared/kali-tools/05-exploitation.md | 39 ++ personas/_shared/kali-tools/06-osint-recon.md | 178 ++++++++ personas/_shared/kali-tools/07-dns-tools.md | 240 ++++++++++ personas/_shared/kali-tools/08-smb-enum.md | 283 ++++++++++++ .../_shared/kali-tools/09-network-utils.md | 213 +++++++++ .../kali-tools/10-forensics-ssl-wireless.md | 348 +++++++++++++++ .../kali-tools/11-web-attacks-advanced.md | 205 +++++++++ .../kali-tools/12-windows-ad-attacks.md | 225 ++++++++++ .../_shared/kali-tools/13-osint-frameworks.md | 88 ++++ .../kali-tools/14-wireless-netdiscovery.md | 256 +++++++++++ .../kali-tools/15-python-security-libs.md | 129 ++++++ personas/_shared/kali-tools/README.md | 25 ++ .../_shared/osint-sources/osint-sources.md | 160 +++++++ .../_shared/osint-sources/social-platforms.md | 220 ++++++++++ personas/forge/_meta.yaml | 13 + personas/forge/frontend-design.md | 238 ++++++++++ personas/frodo/general.md | 24 +- personas/ghost/general.md | 8 + personas/neo/general.md | 15 + personas/oracle/_meta.yaml | 3 + personas/oracle/source-verification.md | 223 ++++++++++ personas/sentinel/_meta.yaml | 4 + personas/sentinel/c2-hunting.md | 223 ++++++++++ 31 files changed, 5357 insertions(+), 21 deletions(-) create mode 100644 CLAUDE.md create mode 100644 personas/_shared/ad-attack-tools/tools.md create mode 100644 personas/_shared/kali-tools/01-network-scanning.md create mode 100644 personas/_shared/kali-tools/02-web-vuln-scanning.md create mode 100644 personas/_shared/kali-tools/03-fuzzing-bruteforce.md create mode 100644 personas/_shared/kali-tools/04-password-cracking.md create mode 100644 personas/_shared/kali-tools/05-exploitation.md create mode 100644 personas/_shared/kali-tools/06-osint-recon.md create mode 100644 personas/_shared/kali-tools/07-dns-tools.md create mode 100644 personas/_shared/kali-tools/08-smb-enum.md create mode 100644 personas/_shared/kali-tools/09-network-utils.md create mode 100644 personas/_shared/kali-tools/10-forensics-ssl-wireless.md create mode 100644 personas/_shared/kali-tools/11-web-attacks-advanced.md create mode 100644 personas/_shared/kali-tools/12-windows-ad-attacks.md create mode 100644 personas/_shared/kali-tools/13-osint-frameworks.md create mode 100644 personas/_shared/kali-tools/14-wireless-netdiscovery.md create mode 100644 personas/_shared/kali-tools/15-python-security-libs.md create mode 100644 personas/_shared/kali-tools/README.md create mode 100644 personas/_shared/osint-sources/osint-sources.md create mode 100644 personas/_shared/osint-sources/social-platforms.md create mode 100644 personas/forge/frontend-design.md create mode 100644 personas/oracle/source-verification.md create mode 100644 personas/sentinel/c2-hunting.md diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..3731779 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,60 @@ +# CLAUDE.md + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## What This Is + +A platform-agnostic system prompt library for LLM agents. 29 personas across 10 domains (cybersecurity, intelligence, military, law/economics, history, linguistics, engineering, academia). Each persona has a `general.md` base variant plus optional specialization and personalized (`salva.md`) variants. Total: ~108 variants. + +## Build + +```bash +pip install pyyaml # only dependency +python3 build.py # builds all personas → generated/ +``` + +Output goes to `generated//.{prompt.md,yaml,json}`. The `generated/` directory is gitignored. + +Optional: `cp config.example.yaml config.yaml` for dynamic variable injection. Build works without it. + +## Architecture + +**Build pipeline** (`build.py`): Reads persona `.md` files with YAML frontmatter → parses sections → applies config templating (`{{key}}`, `{{#if key}}...{{/if}}`, `{{#unless}}`) → outputs three formats per variant. + +**Persona structure**: Each persona lives in `personas//` with: +- `_meta.yaml` — metadata, triggers, relations, variants list +- `general.md` — base prompt (YAML frontmatter + markdown sections: Soul, Expertise, Methodology, Tools & Resources, Behavior Rules, Boundaries) +- `.md` — domain-narrowed variants +- `salva.md` — user-personalized variant + +**Templates**: `personas/_template.md` and `personas/_meta_template.yaml` are starting points for new personas. Files starting with `_` are skipped during build. + +**Config system**: `config.yaml` (gitignored) provides user-specific values. `build.py` flattens nested keys (`user.name`, `infrastructure.tools.sdr_scanner`) and injects them into persona templates. Supports `{{#if key}}` / `{{#unless key}}` conditional blocks. + +**Cross-persona escalation**: Each persona's Boundaries section defines handoff triggers to other personas, enabling multi-agent chains (e.g., Neo → Cipher → Sentinel → Frodo). Build auto-extracts these into `generated/_index/escalation_graph.json`. + +**Shared references** (`personas/_shared/`): Reusable knowledge bases (skipped during build): +- `kali-tools/` — 15 Kali Linux tool reference docs (nmap, hashcat, metasploit, AD attacks, OSINT, wireless, forensics) +- `osint-sources/` — OSINT master reference and investigation templates +- `ad-attack-tools/` — Active Directory attack chain references + +**Build outputs** (`generated/_index/`): +- `escalation_graph.json` — cross-persona handoff map extracted from Boundaries sections +- `trigger_index.json` — keyword→persona routing for multi-agent auto-switching + +## Install to Platforms + +```bash +python3 build.py --install claude # deploy to ~/.claude/commands/ +python3 build.py --install gemini # deploy to Gemini Gems format +python3 build.py --install antigravity # deploy to Antigravity IDE +``` + +## Conventions + +- Persona codenames are lowercase directory names (`neo`, `frodo`, `sentinel`) +- Every persona must have `general.md` with valid YAML frontmatter +- Frontmatter fields: `codename`, `name`, `domain`, `subdomain`, `version`, `address_to`, `address_from`, `tone`, `activation_triggers`, `tags`, `inspired_by`, `quote`, `language` +- Section headers use `## ` (H2) — the build parser splits on these +- Turkish honorific titles ("Hitap") are used for `address_to` fields +- `config.yaml` must never be committed (contains personal infrastructure details) diff --git a/build.py b/build.py index 29b0962..e2e7262 100755 --- a/build.py +++ b/build.py @@ -133,7 +133,7 @@ def parse_persona_md(filepath: Path, flat_config: dict) -> dict: } -def build_persona(persona_dir: Path, output_dir: Path, flat_config: dict, config: dict): +def build_persona(persona_dir: Path, output_dir: Path, flat_config: dict, config: dict, escalation_graph: dict = None): """Build all variants for a persona directory.""" md_files = sorted(persona_dir.glob("*.md")) if not md_files: @@ -179,6 +179,17 @@ def build_persona(persona_dir: Path, output_dir: Path, flat_config: dict, config "regional_focus": config.get("regional_focus", {}), } + # Inject escalation graph for this persona + if escalation_graph and persona_name in escalation_graph: + output["escalates_to"] = escalation_graph[persona_name] + + # Inject section word counts for quality tracking + output["_stats"] = { + "total_words": sum(len(s.split()) for s in parsed["sections"].values()), + "sections": list(parsed["sections"].keys()), + "section_count": len(parsed["sections"]), + } + # Write YAML yaml_out = out_path / f"{variant}.yaml" yaml_out.write_text( @@ -200,14 +211,78 @@ def build_persona(persona_dir: Path, output_dir: Path, flat_config: dict, config return count -def build_catalog(personas_dir: Path, output_dir: Path, config: dict): - """Generate CATALOG.md from all personas.""" +def build_escalation_graph(personas_dir: Path, flat_config: dict) -> dict: + """Extract cross-persona escalation paths from Boundaries sections.""" + graph = {} # {persona: [escalation_targets]} + for persona_dir in sorted(personas_dir.iterdir()): + if not persona_dir.is_dir() or persona_dir.name.startswith((".", "_")): + continue + general = persona_dir / "general.md" + if not general.exists(): + continue + parsed = parse_persona_md(general, flat_config) + if not parsed: + continue + boundaries = parsed["sections"].get("boundaries", "") + targets = re.findall(r"Escalate to \*\*(\w+)\*\*", boundaries) + graph[persona_dir.name] = [t.lower() for t in targets] + return graph + + +def build_trigger_index(personas_dir: Path) -> dict: + """Build reverse index: trigger keyword → persona codenames for multi-agent routing.""" + index = {} # {trigger: [persona_names]} + for persona_dir in sorted(personas_dir.iterdir()): + if not persona_dir.is_dir() or persona_dir.name.startswith((".", "_")): + continue + meta_file = persona_dir / "_meta.yaml" + if not meta_file.exists(): + continue + meta = yaml.safe_load(meta_file.read_text(encoding="utf-8")) or {} + triggers = meta.get("activation_triggers", []) + for trigger in triggers: + t = trigger.lower() + if t not in index: + index[t] = [] + index[t].append(persona_dir.name) + return index + + +def validate_persona(persona_name: str, parsed: dict) -> list: + """Validate persona structure and return warnings.""" + warnings = [] + required_sections = ["soul", "expertise", "methodology", "boundaries"] + for section in required_sections: + if section not in parsed.get("sections", {}): + warnings.append(f"Missing section: {section}") + elif len(parsed["sections"][section].split()) < 30: + warnings.append(f"Thin section ({len(parsed['sections'][section].split())} words): {section}") + + fm = parsed.get("metadata", {}) + for field in ["codename", "name", "domain", "address_to", "tone"]: + if field not in fm: + warnings.append(f"Missing frontmatter: {field}") + + return warnings + + +def build_catalog(personas_dir: Path, output_dir: Path, config: dict, flat_config: dict): + """Generate CATALOG.md with stats, escalation paths, and trigger index.""" addresses = config.get("persona_defaults", {}).get("custom_addresses", {}) + + # Build escalation graph and trigger index + escalation_graph = build_escalation_graph(personas_dir, flat_config) + trigger_index = build_trigger_index(personas_dir) + catalog_lines = [ "# Persona Catalog\n", f"_Auto-generated by build.py | User: {config.get('user', {}).get('name', 'default')}_\n", ] + total_words = 0 + total_sections = 0 + all_warnings = [] + for persona_dir in sorted(personas_dir.iterdir()): if not persona_dir.is_dir() or persona_dir.name.startswith((".", "_")): continue @@ -221,24 +296,86 @@ def build_catalog(personas_dir: Path, output_dir: Path, config: dict): address = addresses.get(persona_dir.name, meta.get("address_to", "N/A")) variants = [f.stem for f in sorted(persona_dir.glob("*.md")) if not f.name.startswith("_")] + # Parse general.md for stats + general = persona_dir / "general.md" + word_count = 0 + section_count = 0 + if general.exists(): + parsed = parse_persona_md(general, flat_config) + if parsed: + for s in parsed["sections"].values(): + word_count += len(s.split()) + section_count = len(parsed["sections"]) + # Validate + warns = validate_persona(codename, parsed) + for w in warns: + all_warnings.append(f" {codename}: {w}") + + total_words += word_count + total_sections += section_count + escalates_to = escalation_graph.get(persona_dir.name, []) + catalog_lines.append(f"## {codename} — {meta.get('role', 'Unknown')}") catalog_lines.append(f"- **Domain:** {meta.get('domain', 'N/A')}") catalog_lines.append(f"- **Hitap:** {address}") catalog_lines.append(f"- **Variants:** {', '.join(variants)}") + catalog_lines.append(f"- **Depth:** {word_count:,} words, {section_count} sections") + if escalates_to: + catalog_lines.append(f"- **Escalates to:** {', '.join(escalates_to)}") catalog_lines.append("") + # Add trigger index section + catalog_lines.append("---\n") + catalog_lines.append("## Activation Trigger Index\n") + catalog_lines.append("_Keyword → persona routing for multi-agent systems_\n") + for trigger in sorted(trigger_index.keys()): + personas = ", ".join(trigger_index[trigger]) + catalog_lines.append(f"- **{trigger}** → {personas}") + catalog_lines.append("") + + # Add stats + catalog_lines.append("---\n") + catalog_lines.append("## Build Statistics\n") + catalog_lines.append(f"- Total prompt content: {total_words:,} words") + catalog_lines.append(f"- Total sections: {total_sections}") + catalog_lines.append(f"- Escalation connections: {sum(len(v) for v in escalation_graph.values())}") + catalog_lines.append(f"- Unique triggers: {len(trigger_index)}") + catalog_lines.append("") + catalog_path = personas_dir / "CATALOG.md" catalog_path.write_text("\n".join(catalog_lines), encoding="utf-8") print(f" Catalog: {catalog_path}") + # Write escalation graph and trigger index as JSON for API consumers + index_path = output_dir / "_index" + index_path.mkdir(parents=True, exist_ok=True) -def print_summary(config: dict, total_personas: int, total_variants: int): + (index_path / "escalation_graph.json").write_text( + json.dumps(escalation_graph, indent=2, ensure_ascii=False), encoding="utf-8" + ) + (index_path / "trigger_index.json").write_text( + json.dumps(trigger_index, indent=2, ensure_ascii=False), encoding="utf-8" + ) + print(f" Index: {index_path}/escalation_graph.json, trigger_index.json") + + # Print validation warnings + if all_warnings: + print(f"\n WARNINGS ({len(all_warnings)}):") + for w in all_warnings: + print(f" {w}") + + return total_words + + +def print_summary(config: dict, total_personas: int, total_variants: int, total_words: int = 0): """Print build summary with config status.""" print("\n" + "=" * 50) print(f"BUILD COMPLETE") - print(f" Personas: {total_personas}") - print(f" Variants: {total_variants}") - print(f" Output: generated/") + print(f" Personas: {total_personas}") + print(f" Variants: {total_variants}") + print(f" Words: {total_words:,}") + print(f" Output: generated/") + print(f" Index: generated/_index/") if config: user = config.get("user", {}).get("name", "?") @@ -256,7 +393,121 @@ def print_summary(config: dict, total_personas: int, total_variants: int): print("=" * 50) +def install_claude(output_dir: Path): + """Install personas to Claude Code as slash commands (~/.claude/commands/).""" + commands_dir = Path.home() / ".claude" / "commands" + commands_dir.mkdir(parents=True, exist_ok=True) + count = 0 + for persona_dir in sorted(output_dir.iterdir()): + if not persona_dir.is_dir() or persona_dir.name.startswith("_"): + continue + for prompt_file in persona_dir.glob("*.prompt.md"): + variant = prompt_file.stem + codename = persona_dir.name + cmd_name = f"persona-{codename}" if variant == "general" else f"persona-{codename}-{variant}" + dest = commands_dir / f"{cmd_name}.md" + content = prompt_file.read_text(encoding="utf-8") + # Wrap as Claude command: $ARGUMENTS placeholder for user query + command_content = f"{content}\n\n---\nUser query: $ARGUMENTS\n" + dest.write_text(command_content, encoding="utf-8") + count += 1 + print(f" Claude: {count} commands installed to {commands_dir}") + return count + + +def install_antigravity(output_dir: Path): + """Install personas to Antigravity IDE system prompts.""" + # Antigravity stores system prompts in ~/.config/antigravity/prompts/ or project .antigravity/ + ag_dir = Path.home() / ".config" / "antigravity" / "personas" + ag_dir.mkdir(parents=True, exist_ok=True) + count = 0 + for persona_dir in sorted(output_dir.iterdir()): + if not persona_dir.is_dir() or persona_dir.name.startswith("_"): + continue + for prompt_file in persona_dir.glob("*.prompt.md"): + variant = prompt_file.stem + codename = persona_dir.name + dest = ag_dir / codename / f"{variant}.md" + dest.parent.mkdir(parents=True, exist_ok=True) + dest.write_text(prompt_file.read_text(encoding="utf-8"), encoding="utf-8") + count += 1 + print(f" Antigravity: {count} personas installed to {ag_dir}") + return count + + +def install_gemini(output_dir: Path): + """Install personas as Gemini Gems (JSON format for Google AI Studio).""" + gems_dir = output_dir / "_gems" + gems_dir.mkdir(parents=True, exist_ok=True) + count = 0 + for persona_dir in sorted(output_dir.iterdir()): + if not persona_dir.is_dir() or persona_dir.name.startswith("_"): + continue + for json_file in persona_dir.glob("*.json"): + data = json.loads(json_file.read_text(encoding="utf-8")) + variant = data.get("variant", json_file.stem) + codename = data.get("codename", persona_dir.name) + name = data.get("name", codename.title()) + # Build Gemini Gem format + gem = { + "name": f"{name} — {variant}" if variant != "general" else name, + "description": f"{data.get('role', '')} | {data.get('domain', '')}", + "system_instruction": data.get("sections", {}).get("soul", "") + "\n\n" + + data.get("sections", {}).get("expertise", "") + "\n\n" + + data.get("sections", {}).get("methodology", "") + "\n\n" + + data.get("sections", {}).get("behavior_rules", ""), + "metadata": { + "codename": codename, + "variant": variant, + "domain": data.get("domain", ""), + "address_to": data.get("address_to", ""), + "tone": data.get("tone", ""), + "activation_triggers": data.get("activation_triggers", []), + }, + } + dest = gems_dir / f"{codename}-{variant}.json" + dest.write_text(json.dumps(gem, ensure_ascii=False, indent=2), encoding="utf-8") + count += 1 + print(f" Gemini: {count} gems generated to {gems_dir}") + return count + + +def install_openclaw(output_dir: Path): + """Install personas to OpenClaw format (IDENTITY.md + individual persona files).""" + oc_dir = output_dir / "_openclaw" + oc_dir.mkdir(parents=True, exist_ok=True) + personas_dir = oc_dir / "personas" + personas_dir.mkdir(parents=True, exist_ok=True) + count = 0 + identity_sections = [] + for persona_dir in sorted(output_dir.iterdir()): + if not persona_dir.is_dir() or persona_dir.name.startswith("_"): + continue + general_prompt = persona_dir / "general.prompt.md" + if not general_prompt.exists(): + continue + content = general_prompt.read_text(encoding="utf-8") + codename = persona_dir.name + # Write individual persona file + (personas_dir / f"{codename}.md").write_text(content, encoding="utf-8") + # Extract first line as title for IDENTITY.md + first_line = content.split("\n")[0].strip("# ").strip() + identity_sections.append(f"### {first_line}\nSee: personas/{codename}.md\n") + count += 1 + # Write IDENTITY.md + identity = "# IDENTITY — Persona Definitions\n\n" + "\n".join(identity_sections) + (oc_dir / "IDENTITY.md").write_text(identity, encoding="utf-8") + print(f" OpenClaw: {count} personas + IDENTITY.md to {oc_dir}") + return count + + def main(): + import argparse + parser = argparse.ArgumentParser(description="Build persona library and optionally install to platforms.") + parser.add_argument("--install", choices=["claude", "antigravity", "gemini", "openclaw", "all"], + help="Install generated personas to a target platform") + args = parser.parse_args() + root = Path(__file__).parent personas_dir = root / "personas" @@ -282,12 +533,30 @@ def main(): output_dir.mkdir(parents=True, exist_ok=True) print(f"Building {len(persona_dirs)} personas -> {output_dir}\n") + # Pre-build escalation graph for cross-persona injection + escalation_graph = build_escalation_graph(personas_dir, flat_config) + total_variants = 0 for pdir in persona_dirs: - total_variants += build_persona(pdir, output_dir, flat_config, config) + total_variants += build_persona(pdir, output_dir, flat_config, config, escalation_graph) - build_catalog(personas_dir, output_dir, config) - print_summary(config, len(persona_dirs), total_variants) + total_words = build_catalog(personas_dir, output_dir, config, flat_config) + + # Platform installation + if args.install: + print(f"\n--- Installing to: {args.install} ---\n") + targets = ["claude", "antigravity", "gemini", "openclaw"] if args.install == "all" else [args.install] + for target in targets: + if target == "claude": + install_claude(output_dir) + elif target == "antigravity": + install_antigravity(output_dir) + elif target == "gemini": + install_gemini(output_dir) + elif target == "openclaw": + install_openclaw(output_dir) + + print_summary(config, len(persona_dirs), total_variants, total_words) if __name__ == "__main__": diff --git a/personas/CATALOG.md b/personas/CATALOG.md index 6003a97..0ff0938 100644 --- a/personas/CATALOG.md +++ b/personas/CATALOG.md @@ -6,143 +6,550 @@ _Auto-generated by build.py | User: Salva_ - **Domain:** law - **Hitap:** Kadı - **Variants:** general, salva, sanctions +- **Depth:** 2,880 words, 6 sections +- **Escalates to:** frodo, marshal, tribune, chronos ## architect — DevOps & Systems Engineer - **Domain:** engineering - **Hitap:** Mimar Ağa - **Variants:** general, salva +- **Depth:** 1,526 words, 6 sections +- **Escalates to:** forge, vortex, neo ## bastion — Blue Team Lead / DFIR Specialist - **Domain:** cybersecurity - **Hitap:** Muhafız - **Variants:** forensics, general, incident-commander, threat-hunting +- **Depth:** 1,523 words, 6 sections +- **Escalates to:** neo, specter, sentinel, vortex ## centurion — Military History & War Analysis Specialist - **Domain:** military - **Hitap:** Vakanüvis - **Variants:** general, ottoman-wars, salva, ukraine-russia +- **Depth:** 2,269 words, 6 sections +- **Escalates to:** marshal, warden, chronos, corsair ## chronos — World History & Civilization Analysis Specialist - **Domain:** history - **Hitap:** Tarihçibaşı - **Variants:** general, salva +- **Depth:** 2,581 words, 6 sections +- **Escalates to:** centurion, scholar, sage, tribune, scribe ## cipher — Cryptography & Crypto Analysis Specialist - **Domain:** cybersecurity - **Hitap:** Kriptoğraf - **Variants:** general +- **Depth:** 1,150 words, 6 sections +- **Escalates to:** neo, vortex, phantom, specter ## corsair — Special Operations & Irregular Warfare Specialist - **Domain:** military - **Hitap:** Akıncı - **Variants:** general, proxy-warfare, salva +- **Depth:** 2,352 words, 6 sections +- **Escalates to:** marshal, wraith, centurion, warden ## echo — SIGINT / COMINT / ELINT Specialist - **Domain:** intelligence - **Hitap:** Kulakçı - **Variants:** electronic-order-of-battle, general, nsa-sigint, salva +- **Depth:** 2,504 words, 6 sections +- **Escalates to:** cipher, vortex, frodo, wraith, sentinel ## forge — Software Development & AI/ML Engineer - **Domain:** engineering - **Hitap:** Demirci -- **Variants:** agent-dev, general, salva +- **Variants:** agent-dev, frontend-design, general, salva +- **Depth:** 1,882 words, 6 sections +- **Escalates to:** architect, cipher, sentinel ## frodo — Strategic Intelligence Analyst - **Domain:** intelligence - **Hitap:** Müsteşar - **Variants:** africa, china, energy-geopolitics, general, india, iran, middle-east, nato-alliance, nuclear, pakistan, russia, salva, turkey +- **Depth:** 1,776 words, 6 sections +- **Escalates to:** oracle, ghost, wraith, echo, sentinel, marshal ## gambit — Chess & Strategic Thinking Specialist - **Domain:** strategy - **Hitap:** Vezir - **Variants:** general, salva +- **Depth:** 2,548 words, 6 sections +- **Escalates to:** marshal, sage, tribune, corsair ## ghost — PSYOP & Information Warfare Specialist - **Domain:** intelligence - **Hitap:** Propagandist - **Variants:** cognitive-warfare, general, russian-info-war, salva +- **Depth:** 2,117 words, 6 sections +- **Escalates to:** oracle, frodo, herald, wraith ## herald — Media Analysis & Strategic Communication Specialist - **Domain:** media - **Hitap:** Münadi - **Variants:** general, salva +- **Depth:** 2,827 words, 6 sections +- **Escalates to:** ghost, polyglot, oracle, frodo ## ledger — Economic Intelligence & FININT Specialist - **Domain:** economics - **Hitap:** Defterdar - **Variants:** general, salva, sanctions-evasion +- **Depth:** 2,847 words, 6 sections +- **Escalates to:** arbiter, frodo, tribune, scribe ## marshal — Military Doctrine & Strategy Specialist - **Domain:** military - **Hitap:** Mareşal - **Variants:** chinese-doctrine, general, hybrid-warfare, iranian-military, nato-doctrine, russian-doctrine, salva, turkish-doctrine, wargaming +- **Depth:** 1,760 words, 6 sections +- **Escalates to:** centurion, warden, corsair, frodo ## medic — Biomedical & CBRN Specialist - **Domain:** science - **Hitap:** Hekim Başı - **Variants:** cbrn-defense, general, salva +- **Depth:** 2,309 words, 6 sections +- **Escalates to:** warden, frodo, marshal, corsair ## neo — Red Team Lead / Exploit Developer - **Domain:** cybersecurity - **Hitap:** Sıfırıncı Gün - **Variants:** exploit-dev, general, mobile-security, redteam, salva, social-engineering, wireless +- **Depth:** 1,090 words, 6 sections +- **Escalates to:** bastion, phantom, specter, vortex, sentinel ## oracle — OSINT & Digital Intelligence Specialist - **Domain:** intelligence - **Hitap:** Kaşif -- **Variants:** crypto-osint, general, salva +- **Variants:** crypto-osint, general, salva, source-verification +- **Depth:** 1,880 words, 6 sections +- **Escalates to:** ghost, sentinel, frodo, herald ## phantom — Web App Security Specialist / Bug Bounty Hunter - **Domain:** cybersecurity - **Hitap:** Beyaz Şapka - **Variants:** api-security, bug-bounty, general +- **Depth:** 1,129 words, 6 sections +- **Escalates to:** neo, vortex, cipher, sentinel ## polyglot — Linguistics & LINGINT Specialist - **Domain:** linguistics - **Hitap:** Tercüman-ı Divan - **Variants:** arabic, general, russian, salva, swahili +- **Depth:** 2,308 words, 6 sections +- **Escalates to:** frodo, ghost, herald, scholar ## sage — Philosophy, Psychology & Power Theory Specialist - **Domain:** humanities - **Hitap:** Arif - **Variants:** general, salva +- **Depth:** 2,132 words, 6 sections +- **Escalates to:** tribune, scholar, chronos, ghost ## scholar — Academic Researcher - **Domain:** academia - **Hitap:** Münevver - **Variants:** general, salva +- **Depth:** 1,588 words, 6 sections +- **Escalates to:** frodo, tribune, sage, chronos ## scribe — FOIA Archivist & Declassified Document Analyst - **Domain:** history - **Hitap:** Verakçı - **Variants:** cia-foia, cold-war-ops, general, salva +- **Depth:** 2,847 words, 6 sections +- **Escalates to:** chronos, wraith, frodo, echo ## sentinel — Cyber Threat Intelligence Analyst - **Domain:** cybersecurity - **Hitap:** İzci -- **Variants:** apt-profiling, darknet, general, mitre-attack, salva +- **Variants:** apt-profiling, c2-hunting, darknet, general, mitre-attack, salva +- **Depth:** 1,558 words, 6 sections +- **Escalates to:** specter, bastion, frodo, neo, echo ## specter — Malware Analyst / Reverse Engineer - **Domain:** cybersecurity - **Hitap:** Cerrah - **Variants:** firmware, general +- **Depth:** 1,446 words, 6 sections +- **Escalates to:** bastion, sentinel, neo, cipher ## tribune — Political Science & Regime Analysis Specialist - **Domain:** politics - **Hitap:** Müderris - **Variants:** general, salva +- **Depth:** 3,356 words, 6 sections +- **Escalates to:** frodo, chronos, arbiter, sage, scholar ## vortex — Network Operations & Traffic Analysis Specialist - **Domain:** cybersecurity - **Hitap:** Telsizci - **Variants:** cloud-ad, general +- **Depth:** 1,439 words, 6 sections +- **Escalates to:** neo, phantom, bastion, cipher, sentinel ## warden — Defense Analyst & Weapons Systems Specialist - **Domain:** military - **Hitap:** Topçubaşı - **Variants:** drone-warfare, electronic-warfare, general, naval-warfare, salva +- **Depth:** 1,823 words, 6 sections +- **Escalates to:** marshal, centurion, corsair, medic ## wraith — HUMINT & Counter-Intelligence Specialist - **Domain:** intelligence - **Hitap:** Mahrem - **Variants:** case-studies, general, salva, source-validation +- **Depth:** 2,265 words, 6 sections +- **Escalates to:** oracle, ghost, echo, frodo, sentinel + +--- + +## Activation Trigger Index + +_Keyword → persona routing for multi-agent systems_ + +- **0day** → neo +- **academic** → scholar +- **active directory** → vortex +- **aes** → cipher +- **agent** → forge +- **agent handling** → wraith +- **ai** → forge +- **air defense** → warden +- **akıncı** → corsair +- **ancient** → chronos +- **ansible** → architect +- **anthrax** → medic +- **api** → forge +- **api security** → phantom +- **apt** → sentinel +- **arabic** → polyglot +- **archives** → scribe +- **army** → marshal +- **attribution** → sentinel +- **authoritarianism** → tribune +- **automation** → architect +- **battle** → centurion +- **bayraktar** → warden +- **beneficial ownership** → ledger +- **bgp** → vortex +- **binary analysis** → specter +- **biological threat** → medic +- **bioweapon** → medic +- **blue team** → bastion +- **breach** → bastion +- **briefing** → frodo +- **broadcast** → herald +- **buffer overflow** → neo +- **bug bounty** → phantom +- **build** → forge +- **cable** → scribe +- **campaign** → centurion, sentinel +- **cbrn** → medic, warden +- **certificate** → cipher +- **chemical weapon** → medic +- **chess** → gambit +- **chess position** → gambit +- **ci** → wraith +- **ci/cd** → architect +- **cia** → scribe +- **cipher** → cipher +- **citation** → scholar +- **civilization** → chronos +- **classified document** → scribe +- **code** → forge +- **cognitive warfare** → ghost +- **coin** → corsair +- **cold war** → centurion, chronos +- **cold war documents** → scribe +- **combined arms** → marshal +- **comint** → echo +- **commando** → corsair +- **comparative politics** → tribune +- **component** → forge +- **counter-intelligence** → wraith +- **counter-narrative** → ghost +- **counter-terrorism** → corsair +- **country analysis** → frodo +- **crypto** → cipher +- **cryptography** → cipher +- **css** → forge +- **cti** → sentinel +- **dark psychology** → sage +- **dark web** → sentinel +- **database** → forge +- **declassified** → scribe +- **decolonization** → chronos +- **decompile** → specter +- **decontamination** → medic +- **defector** → wraith +- **defense** → marshal +- **defense industry** → warden +- **democracy** → tribune +- **deploy** → architect +- **design system** → forge +- **design.md** → forge +- **detection** → bastion +- **development** → forge +- **devops** → architect +- **dfir** → bastion +- **dialect** → polyglot +- **digital footprint** → oracle +- **disassembly** → specter +- **disinformation** → ghost +- **dns** → vortex +- **docker** → architect +- **domain lookup** → oracle +- **double agent** → wraith +- **drone** → warden +- **economic warfare** → ledger +- **elections** → tribune +- **electronic warfare** → echo, warden +- **elf** → specter +- **elint** → echo +- **encryption** → cipher +- **endgame** → gambit +- **energy economics** → ledger +- **entity research** → oracle +- **epidemic** → medic +- **espionage** → wraith +- **ethics** → sage +- **evidence** → bastion +- **exam** → scholar +- **existentialism** → sage +- **exploit** → neo +- **fatf** → ledger +- **fbi** → scribe +- **field manual** → marshal +- **field medicine** → medic +- **financial intelligence** → ledger +- **finint** → ledger +- **firmware** → specter +- **foia** → scribe +- **force structure** → marshal +- **forecast** → frodo +- **forensics** → bastion +- **foucault** → sage +- **french** → polyglot +- **frontend** → forge +- **gallipoli** → centurion +- **gambit** → gambit +- **game dev** → forge +- **game theory** → sage +- **geneva convention** → arbiter +- **geolocation** → echo, oracle +- **geopolitics** → frodo +- **governance** → tribune +- **grandmaster** → gambit +- **guerrilla** → corsair +- **hack** → neo +- **hague** → arbiter +- **hash** → cipher +- **historiography** → chronos +- **history** → chronos +- **homework** → scholar +- **humanitarian law** → arbiter +- **humint** → wraith +- **ibn khaldun** → sage +- **icc** → arbiter +- **ideology** → tribune +- **idor** → phantom +- **illicit finance** → ledger +- **implement** → forge +- **incident response** → bastion +- **influence operation** → ghost +- **information warfare** → ghost +- **infrastructure** → architect +- **initial access** → neo +- **insurgency** → corsair +- **intelligence** → frodo +- **intelligence history** → scribe +- **intercept** → echo +- **international law** → arbiter +- **interpreter** → polyglot +- **investigate** → oracle +- **ioc** → sentinel +- **iran** → frodo +- **javascript** → forge +- **jewish history** → chronos +- **journalism** → herald +- **jstor** → scholar +- **key exchange** → cipher +- **kubernetes** → architect +- **language** → polyglot +- **lateral movement** → vortex +- **leadership** → sage +- **legal analysis** → arbiter +- **lessons learned** → centurion +- **lingint** → polyglot +- **linguistic** → polyglot +- **linux** → architect +- **literature review** → scholar +- **llm** → forge +- **machiavelli** → sage +- **malware** → specter +- **manipulation** → ghost, sage +- **mate** → gambit +- **mdmp** → marshal +- **media** → herald +- **media monitoring** → herald +- **medical** → medic +- **medieval** → chronos +- **memetic** → ghost +- **memory forensics** → bastion +- **metadata analysis** → echo +- **methodology** → scholar +- **military analysis** → frodo +- **military doctrine** → marshal +- **military history** → centurion +- **military technology** → warden +- **missile** → warden +- **mitre att&ck** → sentinel +- **ml** → forge +- **mole** → wraith +- **money laundering** → ledger +- **monitoring** → architect +- **narrative** → ghost, herald +- **nato** → frodo, marshal +- **nerve agent** → medic +- **network** → vortex +- **news analysis** → herald +- **nginx** → architect +- **nsa** → echo, scribe +- **oauth** → phantom +- **opening** → gambit +- **operational file** → scribe +- **operations** → marshal +- **osint** → oracle +- **ottoman** → chronos +- **ottoman military** → centurion +- **owasp** → phantom +- **pandemic** → medic +- **paper** → scholar +- **pawn structure** → gambit +- **pcap** → vortex +- **pdb** → frodo +- **pe file** → specter +- **pentest** → neo +- **persian** → polyglot +- **person search** → oracle +- **persuasion** → sage +- **philosophy** → sage +- **pivoting** → vortex +- **pki** → cipher +- **political party** → tribune +- **political risk** → tribune +- **political science** → tribune +- **power** → sage +- **press** → herald +- **press freedom** → herald +- **privilege escalation** → neo +- **programming** → forge +- **propaganda** → ghost +- **propaganda detection** → herald +- **proxy war** → corsair +- **psychology** → sage +- **psyop** → ghost +- **public health** → medic +- **python** → forge +- **radiation** → medic +- **radio** → echo +- **recruitment** → wraith +- **red team** → neo +- **redaction** → scribe +- **regime** → tribune +- **republic** → chronos +- **research** → scholar +- **reverse engineering** → specter +- **revolution** → tribune +- **routing** → vortex +- **rsa** → cipher +- **rss** → herald +- **russia** → frodo +- **russian** → polyglot +- **russian history** → chronos +- **rust** → forge +- **s-400** → warden +- **sacrifice** → gambit +- **sanctions** → arbiter, ledger +- **server** → architect +- **shadcn** → forge +- **shell company** → ledger +- **shellcode** → neo +- **sicilian** → gambit +- **siem** → bastion +- **sigint** → echo +- **signals intelligence** → echo +- **soc** → bastion +- **social media intel** → oracle +- **sof** → corsair +- **software** → forge +- **source handling** → wraith +- **special forces** → corsair +- **special operations** → corsair +- **spectrum** → echo +- **spy** → wraith +- **sql injection** → phantom +- **ssl** → cipher +- **ssrf** → phantom +- **state building** → tribune +- **stay-behind** → corsair +- **stoicism** → sage +- **strategic** → frodo +- **strategic communication** → herald +- **strategy** → marshal +- **strategy game** → gambit +- **strategy history** → centurion +- **study** → scholar +- **swahili** → polyglot +- **swift** → ledger +- **systemd** → architect +- **tactics** → gambit +- **tailwind** → forge +- **tallinn manual** → arbiter +- **tank** → warden +- **tcp** → vortex +- **thesis** → scholar +- **threat actor** → sentinel +- **threat hunting** → bastion, sentinel +- **threat intelligence** → sentinel +- **tls** → cipher +- **trade** → ledger +- **tradecraft** → wraith +- **traffic analysis** → echo, vortex +- **translation** → polyglot +- **treaty** → arbiter +- **ttp** → sentinel +- **turkish** → polyglot +- **ui** → forge +- **unclos** → arbiter +- **unconventional warfare** → corsair +- **university** → scholar +- **unpacking** → specter +- **urdu** → polyglot +- **ux** → forge +- **vlan** → vortex +- **war analysis** → centurion +- **war crimes** → arbiter +- **war planning** → marshal +- **warship** → warden +- **weapons** → warden +- **web app** → phantom +- **web security** → phantom +- **wireshark** → vortex +- **wwi** → centurion +- **wwii** → centurion +- **xss** → phantom +- **yara** → specter + +--- + +## Build Statistics + +- Total prompt content: 59,712 words +- Total sections: 174 +- Escalation connections: 123 +- Unique triggers: 333 diff --git a/personas/_shared/ad-attack-tools/tools.md b/personas/_shared/ad-attack-tools/tools.md new file mode 100644 index 0000000..7b01920 --- /dev/null +++ b/personas/_shared/ad-attack-tools/tools.md @@ -0,0 +1,10 @@ +# Pentest Active Directory Tools + +| Tool | URL | +|---|---| +| BloodHound | https://github.com/BloodHoundAD/BloodHound | +| SharpHound | https://github.com/BloodHoundAD/SharpHound | +| Impacket | https://github.com/fortra/impacket | +| mimikatz | https://github.com/gentilkiwi/mimikatz | +| NetExec | https://github.com/Pennyw0rth/NetExec | +| Certipy | https://github.com/ly4k/Certipy | diff --git a/personas/_shared/kali-tools/01-network-scanning.md b/personas/_shared/kali-tools/01-network-scanning.md new file mode 100644 index 0000000..071cba1 --- /dev/null +++ b/personas/_shared/kali-tools/01-network-scanning.md @@ -0,0 +1,241 @@ +# Network Scanning Tools + +## nmap +``` +Nmap 7.98 ( https://nmap.org ) +Usage: nmap [Scan Type(s)] [Options] {target specification} +TARGET SPECIFICATION: + Can pass hostnames, IP addresses, networks, etc. + Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 + -iL : Input from list of hosts/networks + -iR : Choose random targets + --exclude : Exclude hosts/networks + --excludefile : Exclude list from file +HOST DISCOVERY: + -sL: List Scan - simply list targets to scan + -sn: Ping Scan - disable port scan + -Pn: Treat all hosts as online -- skip host discovery + -PS/PA/PU/PY[portlist]: TCP SYN, TCP ACK, UDP or SCTP discovery to given ports + -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes + -PO[protocol list]: IP Protocol Ping + -n/-R: Never do DNS resolution/Always resolve [default: sometimes] + --dns-servers : Specify custom DNS servers + --system-dns: Use OS's DNS resolver + --traceroute: Trace hop path to each host +SCAN TECHNIQUES: + -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans + -sU: UDP Scan + -sN/sF/sX: TCP Null, FIN, and Xmas scans + --scanflags : Customize TCP scan flags + -sI : Idle scan + -sY/sZ: SCTP INIT/COOKIE-ECHO scans + -sO: IP protocol scan + -b : FTP bounce scan +PORT SPECIFICATION AND SCAN ORDER: + -p : Only scan specified ports + Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9 + --exclude-ports : Exclude the specified ports from scanning + -F: Fast mode - Scan fewer ports than the default scan + -r: Scan ports sequentially - don't randomize + --top-ports : Scan most common ports + --port-ratio : Scan ports more common than +SERVICE/VERSION DETECTION: + -sV: Probe open ports to determine service/version info + --version-intensity : Set from 0 (light) to 9 (try all probes) + --version-light: Limit to most likely probes (intensity 2) + --version-all: Try every single probe (intensity 9) + --version-trace: Show detailed version scan activity (for debugging) +SCRIPT SCAN: + -sC: equivalent to --script=default + --script=: is a comma separated list of + directories, script-files or script-categories + --script-args=: provide arguments to scripts + --script-args-file=filename: provide NSE script args in a file + --script-trace: Show all data sent and received + --script-updatedb: Update the script database. + --script-help=: Show help about scripts. + is a comma-separated list of script-files or + script-categories. +OS DETECTION: + -O: Enable OS detection + --osscan-limit: Limit OS detection to promising targets + --osscan-guess: Guess OS more aggressively +TIMING AND PERFORMANCE: + Options which take