Metadata-Version: 2.4
Name: attackmate
Version: 1.0.2
Summary: AttackMate is an attack orchestration tool that executes full attack-chains based on playbooks.
Author-email: Wolfgang Hotwagner <wolfgang.hotwagner@ait.ac.at>
License: GPL-3.0
Keywords: Pentest,Attack,Orchestration,Hacking,Simulating,Attackchain
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: pydantic~=2.5
Requires-Dist: colorlog
Requires-Dist: pymetasploit3
Requires-Dist: pyaml
Requires-Dist: paramiko
Requires-Dist: sliver-py
Requires-Dist: tabulate
Requires-Dist: python-magic
Requires-Dist: httpx
Requires-Dist: httpx[http2]
Requires-Dist: vncdotool
Requires-Dist: pytest-mock
Requires-Dist: fastapi
Requires-Dist: playwright
Requires-Dist: argon2-cffi
Requires-Dist: uvicorn
Requires-Dist: python-dotenv>=1.1.0
Requires-Dist: passlib
Requires-Dist: python-multipart>=0.0.32
Requires-Dist: attackmate-client>=0.1.2
Dynamic: license-file

AttackMate <img alt="Logo" src="/images/AttackMate_logo_no_logo.png" align="right" height="90">
==========

AttackMate is a tool to automate cyber attack scenarios that supports scripting of attack techniques across all phases of the Cyber Kill Chain. AttackMate's design principles aim to integrate with penetration testing and attack emulation frameworks such as Metasploit and Sliver Framework and enables simple execution of commands via shell or ssh. For example, AttackMate enables to execute Metasploit modules or generate payloads and run commands in Metasploit sessions. Moreover, it is able to generate Sliver implants, automatize Sliver to send C2 commands, and configure and compile LD_PRELOAD-rootkits. AttackMate also offers a simple interface to automate shell or ssh interaction, run commands in background mode, transfer files via sftp, and start http clients or servers. All attack steps may be scheduled, chained, and repeatedly executed using a simple configuration file that supports variable declarations and conditional workflows.


![AttackMate Schema](docs/source/images/attackmate-schema.png "AttackMate Schema")


## Requirements

* python >= 3.12
* libmagic

## Installation

Manually:

```
$ git clone https://github.com/ait-aecid/attackmate.git
$ cd attackmate
$ pip3 install .
```

Using pip:
```
$ pip3 install attackmate
```

Using uv:
```
$ git clone https://github.com/ait-aecid/attackmate.git
$ cd attackmate
$ uv sync
```

## Execute

With pip:
```
$ attackmate playbook.yml
```

With uv:
```
$ uv run attackmate playbook.yml
```

![AttackMate Demo](docs/source/images/Demo.gif "AttackMate Demo")

## Documentation

Please take a look at our documentation on how to install and use attackmate:

* [Installation](https://ait-testbed.github.io/attackmate/main/installation/index.html)
* [Documentation](https://ait-testbed.github.io/attackmate/main/index.html)
* [Command Reference](https://ait-testbed.github.io/attackmate/main/playbook/commands/index.html)
* [Example Playbooks](https://ait-testbed.github.io/attackmate/main/playbook/examples.html)

## Publications
* [AttackMate: Realistic Emulation and Automation of Cyber Attack Scenarios Across the Kill Chain](https://arxiv.org/pdf/2601.14108) on Arxiv

## Contribution

We're happily taking patches and other contributions. Please see the following links on how to get started:

- [Contribution Guide](https://ait-testbed.github.io/attackmate/main/developing/contribution.html)


## Disclaimer

AttackMate is purely for educational and academic purposes. The software is provided "as is"
and the authors are not responsible for any damage or mishaps that may occur during its use.

Do not attempt to use AttackMate to violate the law. Misuse of the provided software and
information may result in criminal charges.

## Security

AttackMate should only be executed against systems you own or have explicit permission to test.
For this reason, all software bugs are treated with equal priority, regardless of whether they have security implications.

*Please note that AttackMate could easily be executed in a dangerous way. For example, by
parsing the RESULT_STDOUT of a malicious server. The server response could lead to
a command injection. Keep that in mind and always treat external input with caution!

## License

[GPL-3.0](LICENSE)

## Financial Support

Funded by the European Union under GA no. 101121403 (NEWSROOM) and GA no. 101103385 (AInception). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them. Further supported by the Horizon Europe project MIRANDA (101168144). Co-funded by the Austrian security research programme KIRAS of the Federal Ministry of Finance (BMF) in course of the projects ASOC (FO999905301) and Testcat (FO999911248).
