# Ghost Exploit Synthesizer (`wonderful_beluga/ghost-exploit-synthesizer`) Actor - **URL**: https://apify.com/wonderful\_beluga/ghost-exploit-synthesizer.md - **Developed by:** [Zaher el siddik](https://apify.com/wonderful_beluga) (community) - **Categories:** Automation - **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Ghost-Target: Exploit Synthesizer **Actor 3 of 3 in the Ghost-Target Autonomous Red Team Pipeline.** Reads vulnerability findings from the shared KV Store, sends them to **GPT-4o** with a red-team system prompt, and receives back realistic multi-stage attack chains. Sends rich **Slack Block Kit** alerts with MITRE ATT&CK mapping, CISA KEV highlights, and a **one-click re-scan button** that re-triggers the full pipeline directly from Slack. Tracks historical drift to alert only on what changed since last scan. --- ### What It Does #### Phase 1 — Load & Filter Findings Reads `findings__{domain}` from the shared KV Store — the enriched Nuclei output written by Actor 2. Filters to findings at or above `minChainSeverity` to focus the LLM on the most exploitable surface. #### Phase 2 — GPT-4o Attack Chain Synthesis Sends the top findings to GPT-4o with a specialized red-team system prompt: > *"You are an elite red team lead and offensive security expert. Analyze raw vulnerability findings and synthesize them into realistic, multi-stage attack chains. Think like an APT actor."* The model returns up to 3 attack chains per run, each containing: - Entry point (exact asset + vulnerability) - Step-by-step attack path (max 5 steps, specific asset names) - Likelihood assessment - Business impact summary - MITRE ATT&CK tactic mapping - Remediation priority #### Phase 3 — MITRE ATT&CK Enrichment Each chain's tactic list is further enriched by cross-referencing the finding tags against a built-in ATT&CK mapping: | Finding Tag | ATT&CK Tactics | |---|---| | `exposure` / `secrets` | T1552 - Unsecured Credentials, T1530 - Cloud Storage | | `misconfig` | T1190 - Exploit Public-Facing App, T1133 - External Remote Services | | `default-login` | T1078 - Valid Accounts, T1110 - Brute Force | | `takeover` | T1584 - Compromise Infrastructure | | `leaked-credential` | T1078 - Valid Accounts, T1552.001 - Credentials in Files | #### Phase 4 — Slack Block Kit Alerting Sends a rich formatted alert to Slack for each chain at or above the severity threshold. The Block Kit payload includes: - Chain ID, severity badge (🔴🟠🟡), entry point, target - Step-by-step attack path in a code block - Business impact statement - CISA KEV findings callout (⚠️) - MITRE ATT&CK tactic list - Remediation priority **One-Click Re-Scan button** — links directly to the Apify Console with pre-filled input to re-run Actor 1 against the same domain. No copy-pasting, no context switching. **View Full Report button** — links to the current actor run's output in the Apify Console. #### Phase 5 — Drift Alert If new CISA KEV findings appeared since the last scan that weren't there before, a separate **DRIFT ALERT** is sent to Slack — even if no new attack chains were synthesized. Includes a red "Re-Scan Now" button. #### Phase 6 — Persist Report Saves the full synthesis report to `report__{domain}` in the shared KV Store for use in future drift comparisons. --- ### Input | Field | Type | Required | Default | Description | |---|---|---|---|---| | `targetDomain` | string | ✅ | — | Root domain. Must match Actors 1 and 2 | | `openaiApiKey` | string | ✅ | — | OpenAI API key (sk-...) | | `globalKvsName` | string | — | `ghost-target-brain` | Shared KVS name. Must match Actors 1 and 2 | | `apifyApiToken` | string | — | — | Apify API token. **Required when triggered by Actor 2** — automatically forwarded | | `openaiModel` | string | — | `gpt-4o` | GPT model to use (`gpt-4o`, `gpt-4-turbo`, `gpt-4`, `gpt-3.5-turbo`) | | `slackWebhookUrl` | string | — | — | Slack incoming webhook URL for Block Kit alerts | | `shadowDiscoveryActorId` | string | — | — | Actor 1's ID — used to generate the one-click re-scan URL in Slack | | `minChainSeverity` | string | — | `high` | Only alert on chains at or above this severity (`low` / `medium` / `high` / `critical`) | | `historicalDiffEnabled` | boolean | — | `true` | Compare with previous scan to detect newly opened attack surface | --- ### Output #### Dataset One row per synthesized attack chain: ```json { "chainId": "CHAIN-A1B2C", "severity": "critical", "entryPoint": "Exposed .env file at https://dev.example.com/.env containing DB_PASSWORD and AWS_SECRET_ACCESS_KEY", "targetAsset": "Production PostgreSQL database and AWS S3 buckets", "steps": [ "Fetch dev.example.com/.env via HTTP GET (nuclei: exposure/config/exposed-env-file)", "Extract DB_HOST=db.example.com, DB_PASSWORD=s3cr3t, AWS_SECRET_ACCESS_KEY=AKIA... from file", "Connect to db.example.com:5432 using extracted credentials (open port confirmed by Shodan)", "Dump users table containing 450k PII records", "Use AWS_SECRET_ACCESS_KEY to list and exfiltrate S3 bucket: example-customer-backups" ], "likelihood": "high", "impactSummary": "Full production database compromise and cloud storage exfiltration exposing 450k customer records — GDPR and PCI-DSS breach event.", "mitreTactics": [ "T1552.001 - Credentials in Files", "T1190 - Exploit Public-Facing Application", "T1530 - Data from Cloud Storage" ], "remediationPriority": "CRITICAL: Remove .env from web root immediately. Rotate DB credentials and AWS keys. Restrict port 5432 to VPN only.", "notifiedAt": "2026-05-15T10:01:23.000Z", "domain": "example.com", "synthesizedAt": "2026-05-15T10:01:20.000Z" } ```` #### Key-Value Store (`ghost-target-brain`) Writes `report__{domain}`: ```json { "domain": "example.com", "synthesizedAt": "2026-05-15T10:01:20.000Z", "chains": [...], "topFindingsSnapshot": [...], "stats": { "totalFindings": 12, "highCritical": 7, "kevMatches": 1, "chainsGenerated": 3, "alertsSent": 2 } } ``` #### Actor Output (`OUTPUT`) ```json { "totalFindings": 12, "highCritical": 7, "kevMatches": 1, "chainsGenerated": 3, "alertsSent": 2 } ``` *** ### Slack Alert Preview ``` 🔴 Ghost-Target Alert: Attack Chain on example.com ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Chain ID: CHAIN-A1B2C Severity: 🔴 CRITICAL Entry Point: Exposed .env on dev.example.com Target: Production database + S3 buckets Likelihood: HIGH CISA KEV: ⚠️ 1 Attack Steps: 1. Fetch dev.example.com/.env via HTTP GET 2. Extract DB_PASSWORD, AWS_SECRET_ACCESS_KEY 3. Connect to db.example.com:5432 (open port) 4. Dump users table — 450k PII records 5. Exfiltrate S3 bucket: example-customer-backups Business Impact: GDPR breach event. 450k customer records exposed. MITRE ATT&CK: T1552.001, T1190, T1530 Remediation: Remove .env immediately. Rotate credentials. ⚠️ CISA KEV Matches: • CVE-2021-44228 — Apache Log4j RCE on api.example.com (added 2021-12-10) [ 🔁 One-Click Re-Scan ] [ 📊 View Full Report ] ``` *** ### Usage Examples #### Standalone (after Actors 1 and 2 have run) ```json { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "apifyApiToken": "apify_api_xxxxxxxxxxxxxxxxxxxxxxxx", "openaiApiKey": "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "slackWebhookUrl": "https://hooks.slack.com/services/T.../B.../xxxx", "shadowDiscoveryActorId": "YOUR_USERNAME/ghost-shadow-discovery", "minChainSeverity": "high" } ``` #### Force synthesis on all findings (including medium/low) ```json { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "apifyApiToken": "apify_api_xxxxxxxxxxxxxxxxxxxxxxxx", "openaiApiKey": "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "minChainSeverity": "low", "historicalDiffEnabled": false } ``` *** ### Setting Up Slack Notifications 1. Go to [api.slack.com/apps](https://api.slack.com/apps) → **Create New App** → **From scratch** 2. Navigate to **Incoming Webhooks** → Enable → **Add New Webhook to Workspace** 3. Choose your alert channel (e.g. `#security-alerts`) 4. Copy the webhook URL (`https://hooks.slack.com/services/...`) 5. Paste it into the `slackWebhookUrl` input *** ### Model Selection | Model | Speed | Cost | Best For | |---|---|---|---| | `gpt-4o` | Fast | Medium | Default — best balance | | `gpt-4-turbo` | Medium | Medium | High-context scans | | `gpt-4` | Slow | High | Maximum reasoning quality | | `gpt-3.5-turbo` | Very fast | Low | Budget runs, testing | For real-world red team reporting, `gpt-4o` or `gpt-4-turbo` recommended. *** ### Legal Notice This tool is for **authorized penetration testing and security research only**. The AI-synthesized attack chains are for defensive awareness — to help security teams understand and prioritize remediation. Never use this output to conduct unauthorized attacks. # Actor input Schema ## `targetDomain` (type: `string`): Root domain context (used to pull vulnerability data from global KVS). ## `globalKvsName` (type: `string`): Shared Key-Value Store name. Must match Actors 1 and 2. ## `openaiApiKey` (type: `string`): OpenAI API key for GPT-4 attack path synthesis. ## `openaiModel` (type: `string`): GPT model to use for synthesis. ## `slackWebhookUrl` (type: `string`): Slack incoming webhook for Block Kit attack chain alerts. ## `apifyApiToken` (type: `string`): Your Apify token used to generate one-click re-scan URLs in Slack notifications. ## `shadowDiscoveryActorId` (type: `string`): Actor 1 ID used to generate re-scan buttons in Slack. ## `minChainSeverity` (type: `string`): Only alert on chains at or above this severity level. ## `historicalDiffEnabled` (type: `boolean`): Compare current scan with previous KVS state. Flag new assets and newly-opened ports. ## Actor input object example ```json { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "openaiModel": "gpt-4o", "minChainSeverity": "high", "historicalDiffEnabled": true } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "openaiModel": "gpt-4o", "minChainSeverity": "high" }; // Run the Actor and wait for it to finish const run = await client.actor("wonderful_beluga/ghost-exploit-synthesizer").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "openaiModel": "gpt-4o", "minChainSeverity": "high", } # Run the Actor and wait for it to finish run = client.actor("wonderful_beluga/ghost-exploit-synthesizer").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "openaiModel": "gpt-4o", "minChainSeverity": "high" }' | apify call wonderful_beluga/ghost-exploit-synthesizer --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=wonderful_beluga/ghost-exploit-synthesizer", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Ghost Exploit Synthesizer", "version": "1.0", "x-build-id": "TGCC9n7GCH6OCrJeR" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/wonderful_beluga~ghost-exploit-synthesizer/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-wonderful_beluga-ghost-exploit-synthesizer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/wonderful_beluga~ghost-exploit-synthesizer/runs": { "post": { "operationId": "runs-sync-wonderful_beluga-ghost-exploit-synthesizer", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/wonderful_beluga~ghost-exploit-synthesizer/run-sync": { "post": { "operationId": "run-sync-wonderful_beluga-ghost-exploit-synthesizer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "targetDomain", "openaiApiKey" ], "properties": { "targetDomain": { "title": "Target Domain", "type": "string", "description": "Root domain context (used to pull vulnerability data from global KVS)." }, "globalKvsName": { "title": "Global KVS Name", "type": "string", "description": "Shared Key-Value Store name. Must match Actors 1 and 2.", "default": "ghost-target-brain" }, "openaiApiKey": { "title": "OpenAI API Key", "type": "string", "description": "OpenAI API key for GPT-4 attack path synthesis." }, "openaiModel": { "title": "OpenAI Model", "enum": [ "gpt-4o", "gpt-4-turbo", "gpt-4", "gpt-3.5-turbo" ], "type": "string", "description": "GPT model to use for synthesis.", "default": "gpt-4o" }, "slackWebhookUrl": { "title": "Slack Webhook URL", "type": "string", "description": "Slack incoming webhook for Block Kit attack chain alerts." }, "apifyApiToken": { "title": "Apify API Token", "type": "string", "description": "Your Apify token used to generate one-click re-scan URLs in Slack notifications." }, "shadowDiscoveryActorId": { "title": "Shadow Discovery Actor ID", "type": "string", "description": "Actor 1 ID used to generate re-scan buttons in Slack." }, "minChainSeverity": { "title": "Minimum Chain Severity to Notify", "enum": [ "low", "medium", "high", "critical" ], "type": "string", "description": "Only alert on chains at or above this severity level.", "default": "high" }, "historicalDiffEnabled": { "title": "Enable Historical Drift Detection", "type": "boolean", "description": "Compare current scan with previous KVS state. Flag new assets and newly-opened ports.", "default": true } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```