Documentation / SwarmHack

Examples by Use Case

Examples by Use Case

Each example assumes a working install and a lab-targeted authz doc on disk. Replace tokens, customers, and authz paths with your own.

1. Web pentest against a local Docker vulnerable app

swarmhack spawn \
  --target http://127.0.0.1:9999 \
  --agents sqli,xss,cmdi,csrf \
  --authz-doc lab.authz.json \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

Runs four named agents against the in-tree tests/fixtures/targets/vuln-cmdi-app (PHP / Apache, port 9999). Writes reports/mission-{ts}-{id}.json plus the HTML / DOT attack path. The target is RFC1918 / loopback, so --allow-public is not required.

2. SSE assessment in the local validation lab

cd lab/sse-lab && docker compose up -d && cd ../..
swarmhack spawn \
  --target http://localhost:18080 \
  --report sse \
  --authz-doc lab.authz.json \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

Brings the SSE lab up (Keycloak, ZTNA front, origin, CASB drives, DLP, CoreDNS, Squid, mitmproxy, OpenSearch). Produces the OCSF JSON, the HTML attack path, and mission-….sse.md — the eight-section upsell-validated report.

3. AD assessment against a domain controller

swarmhack spawn \
  --target 10.10.10.5 \
  --agents ldap_enum,kerbrute,kerberos_attack,smb_enum,dcsync \
  --allow-ntlm-relay \
  --blast-radius exploit \
  --authz-doc customer-ad.json \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

--allow-ntlm-relay arms the ntlm_relay agent; remove it to keep the relay primitive disabled. Blast radius exploit (default) blocks destructive payloads; escalate to destructive only against a known-lab DC with explicit authorisation.

4. Customer SSE engagement, public target

swarmhack spawn \
  --target https://app.customer.com \
  --report sse \
  --allow-public \
  --authz-doc customer-pov.json \
  --token "$PRANCER_TOKEN" \
  --customer "$PRANCER_CUSTOMER"

--allow-public is required because the target is non-RFC1918; the authz-doc targets[] must list app.customer.com (label-strict). The resulting mission-….sse.md cites the verbatim authz-doc path and the tester field in §8 for legal countersignature.

5. Before / after delta on a renewal-cadence engagement

swarmhack scorecard \
  --before reports/mission-2026-04-25-pre.json \
  --after  reports/mission-2026-05-25-post.json \
  --report sse-delta \
  --output reports/customer-delta-2026-05-25.md \
  --features-toggled "Enabled Duo step-up on /admin and /finance; enabled DLP inline on /upload."

Pure file diff — no network, no agent spawning. Produces a closed-vs-open-vs-regressed table for the customer's renewal review. The --features-toggled string is rendered verbatim into the delta MD; do not paste PII or internal hostnames.