Prometheus v3.0.0

"Prometheus — Unified CTF & Cybersecurity Operations Console"

Prometheus is a unified terminal-based CTF and cybersecurity operations console. It helps teams organize authorized targets, orchestrate specialist security tools, normalize results, manage evidence, and collaborate during Capture The Flag competitions and security labs.

---

Architecture & Features

• 21 Plugin-Like Specialist Tool Adapters: Modular adapter architecture for nmap, ffuf, gobuster, feroxbuster, whatweb, nikto, dig, dnsrecon, smbclient, enum4linux-ng, netexec, showmount, snmpwalk, searchsploit, john, hashcat, exiftool, binwalk, tshark, checksec, strings. All execution strictly uses shell=False with argument validation, explicit confirmation prompts, and Rich markup escaping. Missing tools do not break built-in functionality.
• Typed Adapter Option Schemas: Every adapter declares its typed option schema (Type, Prompt, Default, Allowed Values, Validator, Sensitivity, Required) preventing empty options or raw flag injection.
• Normalized Result Schema: Versioned NormalizedResult (schema v1) stored atomically in target workspace (executions.json), with Observation records enforcing strict fact vs. inference vs. recommendation distinctions.
• Executable Service Action Plans: Action plans and step results persist atomically in action_plans.json with step status tracking (pending, running, completed, failed, cancelled, skipped, blocked_missing_dep) and execution history.
• Workspace History-Aware Recommendation Engine: Incorporates completed tools, failed tools, missing dependencies, and user recommendation dismissals stored in recommendations_state.json.
• Failure-Isolated Quick Scan Pipeline: Refactored Quick Scan into 9 failure-isolated stages (core/pipeline.py) with dedicated exception boundaries, stage metrics, duration logs, and persistent run records (quick_scan_history.json).
• Specialized CTF Workspaces:
  • Web Workspace: Same-origin crawler with depth/page limits, JS endpoint pattern scanner, response fingerprinting, ffuf/gobuster importer, vhost manager, and manual checklists.
  • Offline Hash Workspace: Hash format identifier, John/Hashcat mode mapper, RockYou integration, potfile parser, credential sync.
  • Privilege Escalation Analyzer: LinPEAS & WinPEAS text log parsers and methodology checklists.
  • Forensics Workspace: Magic bytes identification, ExifTool metadata, bounded strings, Binwalk importer, Tshark PCAP analyzer, path-traversal protected archive inspector.
  • Crypto Helpers: Caesar/ROT, XOR scoring, Vigenère, PKCS#7 validator, RSA parameter inspector.
  • Rev & Pwn Workspace: ELF/PE metadata, checksec, Ghidra notes, GDB script template generator, cyclic pattern & offset calculator, pwntools skeleton generator.
  • Active Directory Workspace: Domain metadata, DCs, DNS, SMB shares, users, groups, hosts, Kerberos/SPN observations.
  • Team Collaboration: Portable ZIP export/import bundles (prometheus_team_bundle_v1) with manifest, SHA256 checksums, path traversal protection, default secret redaction, and backward-compatible KUTShell bundle import migration.
• Secret Redaction & Security: Credentials, tokens, session cookies, JWTs, scan commands, and notes are redacted by default in outputs and reports, with explicit reveal prompts and 0o600 file permissions.
• Automated Markdown Report Generation: Compile findings into timestamped Markdown reports (report_YYYYMMDD_HHMMSS.md) and latest-report.md.
• Prometheus Wordlist Manager: Opt-in wordlist downloader and status manager for SecLists and RockYou. Wordlists remain outside Git repository.

---

Installation & Setup

git clone https://github.com/Prometheus-CTF/Prometheus.git
cd Prometheus
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

After installation, run Prometheus using the console command or Python entry point:

prometheus --version
prometheus --help
prometheus check-deps

Or via python:

python3 prometheus.py

---

Usage

Interactive Operations Console

Run prometheus or python3 prometheus.py to enter the Rich-powered terminal console. Pass --debug for verbose tracebacks:

prometheus --debug

Quick Scan Pipeline

Select option [Q] from the main menu to run the 9-stage failure-isolated Quick CTF Scan pipeline:

Target Validation ➔ DNS Reachability ➔ Port Scan ➔ Service Detection ➔ Web Discovery ➔ Multi-Web Service Enumeration ➔ Vulnerability Triage ➔ Recommendations ➔ Redacted Report

Non-Interactive Subcommands

• List Workspaces: prometheus list-workspaces
• Check Dependencies: prometheus check-deps
• Generate Report: prometheus generate-report --workspace web01
• Decode String: prometheus decode --mode base64 --data "UHJvbWV0aGV1cw=="
• Statically Inspect File: prometheus inspect-file --path README.md

---

Workspace & Team Bundle Migration from KUTShell

Prometheus seamlessly migrates existing KUTShell target workspaces and team bundles without data loss:

1. Existing Workspaces: Workspaces in workspace/ are opened directly. Target schemas are updated with toolkit_brand: "Prometheus" while preserving target details, ports, findings, credentials, flags, notes, and action plans.
2. Legacy Team Bundles: Importing legacy kutshell_team_bundle_v1 ZIP files automatically validates checksums, protects against path traversal, migrates target metadata to Prometheus format, and alerts the user of successful migration.
3. New Exports: All exported team bundles use prometheus_team_bundle_v1 format.

---

Running Tests & Verification

source .venv/bin/activate
pytest -v
ruff check .
python3 -m compileall -q core modules adapters tests prometheus.py

---

Legal & Authorized Use

Prometheus is designed for authorized CTF competitions, cybersecurity labs, and security research only. Only scan systems you own or have explicit permission to test.