​

Attack Methodology

Golem follows a structured 10-phase methodology modeled on real-world adversary operations. Deep audits run all 10 phases; Shallow audits stop after phase 6; Autonomous audits follow the methodology you brief.

​

Baseline scan (before the agent starts)

Before Golem begins its attack chain, a deterministic baseline scanner runs against the target and produces its own set of findings:

• Security headers — checks for HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and similar headers with specific remediation guidance per missing header
• Common path probe — checks well-known sensitive paths (.env, /.git/config, /wp-admin/, /actuator/env, /api/swagger, and others)
• Nuclei templates — runs in parallel with the agent, capped to the remaining time budget so it cannot overrun the audit window

Baseline findings are deterministic and fully structured. They are deduplicated against agent findings before the final audit is written — if the agent independently discovers the same issue, it appears once.

​

The 10 phases

​

Phase 1 — Passive Reconnaissance

Before touching the target, Golem gathers context from public sources. No traffic to the target’s infrastructure.

• WHOIS and DNS records
• Certificate Transparency logs (crt.sh)
• Wayback Machine for historical endpoints
• Search engine dorking
• GitHub / GitLab leaked secrets reconnaissance
• Technology fingerprinting from public sources

​

Phase 2 — Subdomain Enumeration

Golem queries seven passive OSINT sources to build a complete subdomain map, then validates which are alive. See Subdomain Enumeration for the full source list.

​

Phase 3 — Port & Service Scanning

Network-level discovery using nmap -T2 (low-noise) by default, masscan for wide ranges.

• TCP/UDP port discovery
• Service version detection
• TLS configuration analysis
• Banner grabbing

​

Phase 4 — Web Fingerprinting

For HTTP/S services, identify the stack:

• whatweb and httpx for application fingerprinting
• wafw00f for WAF detection
• CMS / framework / library version identification
• Endpoint discovery via crawling and content discovery (feroxbuster, ffuf)

​

Phase 5 — Vulnerability Scanning

Active probing for known vulnerability classes:

• nuclei with curated template sets
• dalfox and xsstrike for XSS surface
• wfuzz and ffuf for parameter discovery and injection points
• Custom probes for SSTI, XXE, SSRF, deserialization, CORS misconfiguration
• JWT analysis with jwt_tool

​

Phase 6 — Exploitation

Confirm vulnerabilities by exploiting them. The agent captures evidence as proof, but in Shallow mode stops at PoC level.

• sqlmap for SQL injection (Deep mode: --level 5 --risk 3)
• commix for command injection
• tplmap for template injection
• XXEinjector for XXE
• ssrfmap for SSRF
• Custom exploitation chains for chained findings

Shallow audits stop here. The remaining phases only run in Deep and Autonomous modes.

​

Phase 7 — Authentication Attacks

Test the auth surface:

• Credential stuffing against captured username lists
• hydra for service brute force (rate-limited)
• JWT manipulation, signature stripping, algorithm confusion
• OAuth flow analysis (PKCE downgrade, redirect_uri confusion, scope abuse)
• Session fixation, predictable session IDs
• Password reset flow analysis

​

Phase 8 — Post-Exploitation

After initial compromise, escalate and explore:

• linpeas and pspy for Linux privilege escalation
• Kernel exploit identification
• impacket suite for Windows / AD post-ex
• bloodhound for AD attack path analysis
• Credential harvesting from memory and disk
• Service account discovery

​

Phase 9 — Lateral Movement

Pivot from initial foothold to additional systems:

• crackmapexec for SMB / WinRM lateral movement
• evil-winrm for interactive shells
• Token impersonation and pass-the-hash
• Pivot through internal networks via SSH or ligolo-ng

​

Phase 10 — Persistence & Exfiltration Testing

Demonstrate full impact:

• Persistence mechanism testing (cron, systemd, scheduled tasks)
• DNS tunneling (dnscat2, iodine) for exfil path validation
• Data exfiltration over allowed protocols
• Cover-track / log-cleaning behavior assessment

​

Phase ordering and pivots

The methodology is not strictly linear. Golem continuously re-plans:

• A finding in phase 5 may prompt deeper scanning in phase 3
• A credential captured in phase 7 may unlock new targets requiring phase 2 enumeration
• A pivot in phase 9 may reveal new web surface, triggering phases 4–6 against internal hosts

The agent decides what to do next based on what it just discovered.

​

When the methodology stops

Golem stops a phase when:

• The phase’s objectives are exhausted (no new findings produced in the last iteration)
• The audit’s time budget is approaching expiry (agent transitions to report writing)
• The phase produced findings that warrant deeper exploration in a later phase

​

Modes recap

In Autonomous mode, the brief defines which phases run and in what order.

​

Next steps