redacted results

Evidence

The artifacts below are sanitized excerpts shaped from working project output. They are here to show what the platforms produce without publishing targets, credentials, client data, infrastructure, or raw evidence.

Poseidon-X

view project

Credential campaign QA

redacted campaign flow

The QA path validates delivery, landing behavior, audit state, and live operator updates.

sanitized-output
campaign: PX-QA-[REDACTED]
mode: email + credential landing
preflight:
  spam_score: pass
  dns_auth: pass
  file_host: not_required
events:
  email_sent: ok
  click_tracked: ok
  credential_submit: ok
  audit_row: ok
  sse_update: ok

Host registration state

redacted dashboard

Campaign infrastructure is modeled as registered operator-owned hosts, not vendor services.

sanitized-output
admin      https://admin.[REDACTED]      healthy
landing    https://login.[REDACTED]      listener online / drain connected
files      https://dl.[REDACTED]         caddy online
smtp       smtp.[REDACTED]:587           dkim aligned / relay ready
telemetry  third_party                   disabled

Luc1

view project

Benchmark run summary

redacted aggregate

Benchmark output is reduced to aggregate run data while preserving the shape of the test.

sanitized-output
suite: XBEN-redacted
target_profile: local lab
model_path: local Ollama via LiteLLM
runs_completed: 88
successful_chains: 71
median_duration: 11m 42s
median_tokens: 58,900
cloud_calls: 0
raw_flags_published: false

Operation memory excerpt

redacted trace

The useful proof is the handoff: recon facts become judged evidence, then scoped action.

sanitized-output
scout.finding[12]:
  service: https
  host: target-[REDACTED].lab
  evidence: login panel + exposed API schema
judge.decision:
  priority: high
  reason: auth boundary likely testable within ROE
act.result:
  tool: local sandbox
  status: validated
  preserved_to_memory: true

OPSINT

view project

Redacted mobile collection export

redacted case bundle

A scoped Android assessment export with personal fields removed and integrity preserved.

sanitized-output
case_id: OPS-MOB-[REDACTED]
device: Pixel 7 / Android 14 / stock / non-root
approved_modules:
  - device_info
  - get_notifications.metadata_only
  - get_clipboard
  - get_sms.metadata_only
  - take_screenshot.operator_confirmed
collected:
  sessions: 1
  notifications: 184
  clipboard_events: 19
  sms_metadata_rows: 73
  screenshots: 3
export_sha256: 9f4c1b7e8a2d0c5f...[REDACTED]

Operator audit trail

redacted log excerpt

Sensitive actions are operator-confirmed and written to the server-side audit trail.

sanitized-output
2026-06-18T14:22:11Z operator=[REDACTED] module=device_info status=ok
2026-06-18T14:24:03Z operator=[REDACTED] module=get_notifications scope=metadata status=ok
2026-06-18T14:31:44Z operator=[REDACTED] module=take_screenshot confirm=true status=ok
2026-06-18T14:44:02Z operator=[REDACTED] action=export_evidence bundle=case-[REDACTED].zip

RADAR-X

view project

Redacted scan row

sanitized CSV

Representative scanner output from a public test target with volatile identifiers shortened.

sanitized-output
ts,ip,port,service,version,cves,risk,asn,egress
2026-06-02T10:48:37Z,45.33.32.[x],22,ssh,OpenSSH_6.6,23,low,AS63949,vpn-radar/us-west
2026-06-02T10:48:37Z,45.33.32.[x],80,http,Apache/2.4.7,0,medium,AS63949,vpn-radar/us-west

Pipeline completion event

redacted MQTT

Discovery, scanner, and writer events are correlated by scan id before landing in Postgres.

sanitized-output
topic: radar-x/scan/[scan-id]/complete
message:
  discovery_node: dk-us-west-[REDACTED]
  scanner_node: ds-us-west-[REDACTED]
  services: 5
  cves: 23
  duration_seconds: 38
  postgres_batch: writer-[REDACTED]
  checksum: sha256:2a7b...[REDACTED]

Mammon

view project

Forensic scan summary

redacted executive output

A redacted summary shaped from the v3 pipeline output and QA numbers.

sanitized-output
scan_id: MAM-[REDACTED]
files_processed: 1,278
pipeline_stages: 12
local_models_loaded: 14
entities_extracted: 4,912
identity_clusters:
  face: 37
  voice: 12
  cross_script_name: 18
cloud_apis_used: 0

QA matrix

redacted test run

Evidence-type tests validate audio, vision, document, and entity processing before a scan is trusted.

sanitized-output
mammon test --profile v3
audio multilingual: 19/20 pass
image vision/OCR/faces: 12/12 pass
document PDF/OCR/entities: 7/7 pass
hybrid search: pass
identity graph: pass
export manifest: pending court-packaging

ARCHON

view project

Forensic report excerpt

generated report

The report excerpt uses sanitized case metadata from the report-generation path.

sanitized-output
REPORT ID: b8f6fdbb-[REDACTED]
CASE: CASE-2024-[REDACTED]
DEVICE: Samsung Galaxy S21 Ultra / Android 12 / encrypted
TOTAL ITEMS: 46
CATEGORIES:
  contacts: 2
  photos_media: 3
  wifi_networks: 38
  bluetooth_devices: 3
formats: pdf, html, markdown, json, csv

Integrity block

redacted hashes

Extraction and report hashes are generated so exports can be verified after handoff.

sanitized-output
extraction_sha256: 3656c197922701cf7d43...[REDACTED]
report_sha256:     8d2a5a550a0f3599a42...[REDACTED]
chain_of_custody:
  acquisition_ts: 2026-02-25T12:13:03Z
  examiner: [REDACTED]
  tool: ARCHON Forensics v0.1.0

rcap-ng

view project

Zeek alert excerpt

redacted JSON

Alerts point to the exact pcap and replay filter without publishing packet contents.

sanitized-output
{
  "event": "alert",
  "router": "router-[REDACTED]",
  "iface": "br0",
  "note": "RCAPNG::PlaintextHTTPLogin",
  "src": "10.0.0.[x]",
  "dst": "10.0.0.[y]",
  "pcap": "/captures/router-[REDACTED]/20260514-br0-[id].pcap",
  "replay": "tcpdump -nn -tttt -A -r [pcap] 'host 10.0.0.x and host 10.0.0.y and port 80'"
}

Collector status snapshot

redacted ops view

The collector exposes enough state for operators without requiring shell access to the box.

sanitized-output
active_sessions: 3
sessions_accepted_total: 118
bytes_written_total: 42.8GB
rotations_total: 31
zeek_pipe: enabled
metrics: /metrics
retention_days: 7

CVE-2023-33105

view project

Advisory record

public CVE

The public record ties the issue to Qualcomm WLAN host and firmware behavior.

sanitized-output
cve: CVE-2023-33105
vendor: Qualcomm
class: transient denial-of-service
area: WLAN host and firmware
cvss_v3_1: 7.5 HIGH
vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
publication: Qualcomm March 2024 bulletin / NVD

Research artifact

public research artifact

Early Python proof-of-concept kept available for lab validation and traceability.

sanitized-output
language: Python
dependencies: scapy, termcolor, wireless injection tooling
scope: authorized lab validation only
target_data: not included
operational_status: archived public research