# Ghost Logic Engine (`wonderful_beluga/ghost-logic-engine`) Actor - **URL**: https://apify.com/wonderful\_beluga/ghost-logic-engine.md - **Developed by:** [Zaher el siddik](https://apify.com/wonderful_beluga) (community) - **Categories:** Automation - **Stats:** 2 total users, 1 monthly users, 0.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Ghost-Target: Logic Engine **Actor 2 of 3 in the Ghost-Target Autonomous Red Team Pipeline.** Reads the Ghost Inventory built by Actor 1 from the shared KV Store, then runs [Nuclei](https://github.com/projectdiscovery/nuclei) against every discovered asset. Every CVE finding is cross-referenced against the live **CISA Known Exploited Vulnerabilities (KEV)** catalog. Leaked credentials from GitHub are tested against live endpoints. Historical drift is tracked to surface newly opened attack surface since the last scan. --- ### What It Does #### Phase 1 — Load Ghost Inventory Reads `surface__{domain}` from the shared KV Store (`ghost-target-brain`) — the brain state written by Actor 1 — and extracts the full list of discovered subdomains and GitHub leak references. #### Phase 2 — CISA KEV Catalog Fetch Pulls the live [CISA Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) JSON feed at runtime. At time of writing this contains 1,500+ CVEs that are confirmed to be **actively exploited in the wild**. Every CVE finding from Nuclei is cross-referenced against this list. #### Phase 3 — Nuclei Scanning Runs Nuclei against all discovered targets (`http://` and `https://` variants). Templates are **pre-baked into the Docker image at build time** to avoid slow runtime downloads. Default template tags: | Tag | What It Detects | |---|---| | `exposure` | `.env`, `.git/config`, backup files, config leaks | | `secrets` | API keys, tokens, connection strings in responses | | `misconfig` | CORS misconfigs, open redirects, insecure headers | | `default-login` | Vendor default credentials (`admin:admin`, etc.) | | `cve` | Known CVEs with public PoC (cross-referenced with KEV) | | `takeover` | Subdomain takeover fingerprints (dangling DNS) | #### Phase 4 — Credential Correlation Takes GitHub leak references from Actor 1's brain, extracts candidate API keys/tokens, and tests them against live asset endpoints. A `HTTP 200` response with the leaked credential is flagged as a **critical** finding — `LEAKED_CREDENTIAL_VALID`. #### Phase 5 — Historical Drift Detection Diffs current findings against the previous scan stored in KVS. Flags: - **New findings** — attack surface that opened since last scan - **Resolved findings** — issues that appear to be fixed This enables **continuous monitoring** — run the pipeline on a schedule and only get alerted on what changed. --- ### Input | Field | Type | Required | Default | Description | |---|---|---|---|---| | `targetDomain` | string | ✅ | — | Root domain to scan. Must match what was used in Actor 1 | | `globalKvsName` | string | — | `ghost-target-brain` | Shared Key-Value Store name. Must match Actor 1 | | `apifyApiToken` | string | — | — | Apify API token. **Required when triggered by Actor 1 via webhook** — automatically forwarded | | `nucleiTemplates` | array | — | `["exposure","secrets","misconfig","default-login","cve","takeover"]` | Nuclei template tags to run | | `severityFilter` | string | — | `medium` | Minimum severity to report (`info` / `low` / `medium` / `high` / `critical`) | | `concurrency` | integer | — | `25` | Number of concurrent Nuclei template checks | | `rateLimit` | integer | — | `50` | Max HTTP requests per second | | `exploitSynthesizerActorId` | string | — | — | Actor ID of Actor 3 to auto-trigger when findings exceed threshold | | `criticalFindingsThreshold` | integer | — | `1` | Min critical/high findings required to trigger Actor 3 | --- ### Output #### Dataset One row per finding: ```json { "asset": "dev.example.com", "templateId": "exposure/config/exposed-env-file", "name": "Exposed .env File", "severity": "high", "cvss": 7.5, "cveId": null, "allCves": [], "isKev": false, "kevDetails": null, "matchedAt": "https://dev.example.com/.env", "extractedData": ["DB_PASSWORD=s3cr3t", "AWS_SECRET_ACCESS_KEY=xxxxx"], "tags": ["exposure", "config", "files"], "description": "An exposed .env file was found which may contain sensitive credentials.", "remediation": "Remove .env from the web root and rotate any exposed credentials immediately.", "isNew": true, "timestamp": "2026-05-15T09:52:03.000Z" } ```` #### KEV-matched finding example: ```json { "asset": "vpn.example.com", "templateId": "cve/2021/CVE-2021-44228", "name": "Apache Log4j RCE", "severity": "critical", "cvss": 10.0, "cveId": "CVE-2021-44228", "isKev": true, "kevDetails": { "name": "Apache Log4j2 Remote Code Execution Vulnerability", "product": "Log4j2", "vendor": "Apache", "dateAdded": "2021-12-10", "dueDate": "2021-12-24" }, "isNew": true } ``` #### Key-Value Store (`ghost-target-brain`) Writes `findings__{domain}` — the full enriched findings array consumed by Actor 3. Also updates `surface__{domain}` with a `lastVulnScan` summary: ```json { "lastVulnScan": { "timestamp": "2026-05-15T09:57:46.000Z", "totalFindings": 12, "critical": 2, "high": 5, "kevFindings": 1, "newFindings": 4, "resolvedFindings": 1, "credentialHits": 0 } } ``` *** ### Automatic Pipeline Chaining When `exploitSynthesizerActorId` is set and `criticalHighCount >= criticalFindingsThreshold`, this actor automatically triggers **Actor 3 (Exploit Synthesizer)** with the findings context. To always trigger Actor 3 regardless of severity, set `criticalFindingsThreshold: 0`. *** ### Prerequisites Two Go binaries bundled in the Docker image at build time: - **[nuclei v3.3.9](https://github.com/projectdiscovery/nuclei)** — vulnerability scanner - **[httpx v1.6.10](https://github.com/projectdiscovery/httpx)** — HTTP probing Nuclei templates are **pre-downloaded during Docker build** (`nuclei -update-templates`) so actor startup is fast and there's no dependency on GitHub at runtime. *** ### Usage Examples #### Standalone (after Actor 1 has run) ```json { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "apifyApiToken": "apify_api_xxxxxxxxxxxxxxxxxxxxxxxx", "severityFilter": "medium", "nucleiTemplates": ["exposure", "secrets", "misconfig", "default-login", "cve", "takeover"] } ``` #### With Actor 3 auto-trigger ```json { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "apifyApiToken": "apify_api_xxxxxxxxxxxxxxxxxxxxxxxx", "exploitSynthesizerActorId": "YOUR_USERNAME/ghost-exploit-synthesizer", "criticalFindingsThreshold": 1, "severityFilter": "medium" } ``` #### Targeted CVE-only scan ```json { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "apifyApiToken": "apify_api_xxxxxxxxxxxxxxxxxxxxxxxx", "nucleiTemplates": ["cve"], "severityFilter": "high", "concurrency": 50, "rateLimit": 100 } ``` *** ### CISA KEV Cross-Reference When a Nuclei finding contains a CVE ID, this actor checks it against the CISA KEV catalog live at runtime. A KEV match means the vulnerability is: 1. **Confirmed exploitable** — not just theoretical 2. **Actively being exploited** by threat actors right now 3. **Federally mandated to patch** for US government systems (18-day remediation deadline) KEV findings should be treated as P0 — patch immediately. *** ### Legal Notice This tool is for **authorized penetration testing and security research only**. Nuclei sends HTTP requests to target systems. Only run against systems you own or have explicit written authorization to test. # Actor input Schema ## `targetDomain` (type: `string`): Root domain context (used to pull assets from global KVS). ## `globalKvsName` (type: `string`): Shared Key-Value Store name. Must match Actor 1. ## `nucleiTemplates` (type: `array`): Template tags to run. Defaults to high-value exposure templates. ## `severityFilter` (type: `string`): Only report findings at or above this severity. ## `concurrency` (type: `integer`): Number of concurrent Nuclei template checks. ## `rateLimit` (type: `integer`): Max HTTP requests per second to stay passive. ## `exploitSynthesizerActorId` (type: `string`): Actor ID of Actor 3 (ghost-exploit-synthesizer) to trigger when findings exceed threshold. ## `criticalFindingsThreshold` (type: `integer`): Trigger Actor 3 automatically when this many critical/high findings are found. ## Actor input object example ```json { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "nucleiTemplates": [ "exposure", "secrets", "misconfig", "default-login", "cve", "takeover" ], "severityFilter": "medium", "concurrency": 25, "rateLimit": 50, "criticalFindingsThreshold": 1 } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "nucleiTemplates": [ "exposure", "secrets", "misconfig", "default-login", "cve", "takeover" ], "severityFilter": "medium", "concurrency": 25, "rateLimit": 50, "criticalFindingsThreshold": 1 }; // Run the Actor and wait for it to finish const run = await client.actor("wonderful_beluga/ghost-logic-engine").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "nucleiTemplates": [ "exposure", "secrets", "misconfig", "default-login", "cve", "takeover", ], "severityFilter": "medium", "concurrency": 25, "rateLimit": 50, "criticalFindingsThreshold": 1, } # Run the Actor and wait for it to finish run = client.actor("wonderful_beluga/ghost-logic-engine").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "targetDomain": "example.com", "globalKvsName": "ghost-target-brain", "nucleiTemplates": [ "exposure", "secrets", "misconfig", "default-login", "cve", "takeover" ], "severityFilter": "medium", "concurrency": 25, "rateLimit": 50, "criticalFindingsThreshold": 1 }' | apify call wonderful_beluga/ghost-logic-engine --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=wonderful_beluga/ghost-logic-engine", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Ghost Logic Engine", "version": "1.0", "x-build-id": "y9hcp14IB1fdzSFX9" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/wonderful_beluga~ghost-logic-engine/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-wonderful_beluga-ghost-logic-engine", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/wonderful_beluga~ghost-logic-engine/runs": { "post": { "operationId": "runs-sync-wonderful_beluga-ghost-logic-engine", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/wonderful_beluga~ghost-logic-engine/run-sync": { "post": { "operationId": "run-sync-wonderful_beluga-ghost-logic-engine", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "targetDomain" ], "properties": { "targetDomain": { "title": "Target Domain", "type": "string", "description": "Root domain context (used to pull assets from global KVS)." }, "globalKvsName": { "title": "Global KVS Name", "type": "string", "description": "Shared Key-Value Store name. Must match Actor 1.", "default": "ghost-target-brain" }, "nucleiTemplates": { "title": "Nuclei Template Tags", "type": "array", "description": "Template tags to run. Defaults to high-value exposure templates.", "default": [ "exposure", "secrets", "misconfig", "default-login", "cve", "takeover" ] }, "severityFilter": { "title": "Minimum Severity", "enum": [ "info", "low", "medium", "high", "critical" ], "type": "string", "description": "Only report findings at or above this severity.", "default": "medium" }, "concurrency": { "title": "Nuclei Concurrency", "minimum": 1, "maximum": 100, "type": "integer", "description": "Number of concurrent Nuclei template checks.", "default": 25 }, "rateLimit": { "title": "Nuclei Rate Limit (req/sec)", "minimum": 1, "maximum": 500, "type": "integer", "description": "Max HTTP requests per second to stay passive.", "default": 50 }, "exploitSynthesizerActorId": { "title": "Exploit Synthesizer Actor ID", "type": "string", "description": "Actor ID of Actor 3 (ghost-exploit-synthesizer) to trigger when findings exceed threshold." }, "criticalFindingsThreshold": { "title": "Critical Findings Threshold", "type": "integer", "description": "Trigger Actor 3 automatically when this many critical/high findings are found.", "default": 1 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```