cstrike

Autonomous Offensive Security Platform
_{9-container Docker stack | 35+ integrated tools | AI-driven 9-phase attack pipeline | VPN IP rotation}

Quick Start | Downloads | Architecture | Web UI | TUI | API | Distribution | Docs

CStrike v2 is an autonomous offensive security platform built on a containerized Docker stack with a real-time web dashboard and AI-driven scan orchestration across 35+ integrated tools. Features a 9-phase attack pipeline (recon through exploitation), multi-provider AI reasoning (OpenAI, Anthropic, Ollama, Grok) with MCP tool server, nftables VPN kill switch across 5 providers (WireGuard, OpenVPN, Tailscale, NordVPN, Mullvad), automatic VPN IP rotation during scans via WireGuard config pool swapping, Metasploit RPC automation, and remote browser access via KasmVNC. Built for red team operations on isolated infrastructure with engagement lifecycle management, OPSEC gating, and emergency wipe capability.

Built for authorized red team engagements. Requires explicit scope authorization before use.

Quick Start

Fastest path: Download a pre-built VM image — boot and go in 5 minutes. The instructions below are for Docker-only or source deployment.

# Clone
git clone https://github.com/culpur/cstrike.git
cd cstrike

# Configure
cp .env.example .env
# Edit .env — set POSTGRES_PASSWORD, REDIS_PASSWORD, KASM_PASSWORD

# Generate TLS certificates
bash docker/generate-certs.sh

# Start the stack
docker compose up -d

# Seed the database (first run only)
docker exec cstrike-api npx prisma db seed

Full install from bare metal? Run sudo bash install.sh on Debian 12. See Distribution.

Downloads

Pre-built VM images — boot and go, no building required.

amd64 (x86_64)

aarch64 (ARM64)

BitTorrent downloads | Checksums | All formats

Pre-built images include Debian 12 + 35+ security tools + Docker stack. First boot auto-expands disk, regenerates SSH keys, randomizes passwords, and starts all services.

Architecture

                          ┌─────────────────────────────────────┐
                          │   Traefik v3.3 Reverse Proxy         │
                          │   :80 (redirect) → :443 (HTTPS)      │
                          └─────────────┬───────────────────────┘
                     ┌──────────────────┼──────────────────┐
                     │                  │                  │
              /api/* + /socket.io/*     │           /* (catch-all)
                     │                  │                  │
          ┌──────────▼──────────┐       │      ┌───────────▼──────────┐
          │  Express 5 API       │       │      │  React 19 Frontend    │
          │  :3001               │       │      │  :3000                │
          │  TypeScript + Prisma │       │      │  Vite 7 + Tailwind 4  │
          └────┬───────────┬────┘       │      └──────────────────────┘
               │           │            │
        ┌──────▼──┐  ┌─────▼─────┐      │      ┌─────────────────────┐
        │ PG 16   │  │ Redis 7   │      │      │  KasmVNC :6901       │
        │ :5432   │  │ :6379     │      │      │  Remote Chrome       │
        └─────────┘  └───────────┘      │      │  (bridge network)    │
                                        │      └─────────────────────┘
          ┌─────────────────────────────┘
          │  Host bind mounts (read-only)
          │  /usr/bin, /usr/local/bin, /opt → 35+ security tools
          │  nmap, nuclei, ffuf, hydra, sqlmap, impacket, ...
          │
          │  ┌────────────┐  ┌────────────┐  ┌────────────┐
          │  │ ZAP :8080  │  │ MSF :55553 │  │VulnBox:8888│
          │  │ OWASP DAST │  │ Metasploit │  │ 30+ vulns  │
          │  └────────────┘  └────────────┘  └────────────┘

All containers use network_mode: host for direct access to host tools and VPN interfaces, except Kasm which uses bridge networking with port mapping.

Prerequisites

Hardware: 4 CPU cores, 8 GB RAM, 50 GB disk minimum.

Host tools: The API container executes security tools via bind-mounted host directories. Without tools installed on the host, scans will fail. Run scripts/vm/provision-host.sh for full installation, or see Bare Metal Install.

Docker Stack

Named volumes: pgdata, redisdata, apidata, vulnbox-db.

Workflow

CStrike executes a 9-phase pipeline per target. Each phase feeds results forward.

Web UI

The frontend is a React 19 / TypeScript / Tailwind CSS 4 application with a dark theme and 9 view modules.

WebSocket Events

Real-time updates via Socket.IO:

TUI Mode

The Textual-based terminal UI runs inside the API container:

docker exec -it cstrike-api python -m tui

Configuration

CStrike uses a two-tier configuration model:

Infrastructure (.env file)

Controls Docker container settings. Edit before docker compose up:

Operational (Web UI / REST API)

AI providers, scan modes, target scope, and tool allowlists are stored in the PostgreSQL ConfigEntry table and managed via the Configuration module or /api/v1/config endpoints:

API Reference

The Express 5 API server exposes 14 route groups under /api/v1/ with Zod request validation, rate limiting (100 req/min per IP), and Helmet security headers.

Scan Control

Targets & Results

AI & Exploitation

Services & System

Integrations

Health

Project Structure

cstrike/
├── api/                            # Express 5 + TypeScript API
│   ├── src/
│   │   ├── server.ts               # Entry point — Express + Socket.IO
│   │   ├── config/                 # env, database, redis
│   │   ├── routes/                 # 14 route modules
│   │   ├── services/               # AI, metrics, scans, tools, VPN, VPN rotation, MCP
│   │   ├── middleware/             # guardrails, rate limiter, validation
│   │   ├── schemas/                # Zod request validation
│   │   ├── utils/                  # credential scoring, safe paths
│   │   └── websocket/             # Socket.IO setup + typed emitter
│   └── prisma/
│       ├── schema.prisma           # 10 models, PostgreSQL 16
│       └── seed.ts                 # Database seeder
│
├── web/                            # React 19 + TypeScript + Tailwind 4
│   ├── src/
│   │   ├── modules/               # 9 view modules (dashboard, targets, ai, ...)
│   │   ├── components/            # Shared UI components
│   │   ├── services/              # API client + WebSocket
│   │   ├── stores/                # 7 Zustand state stores
│   │   └── types/                 # TypeScript interfaces
│   └── package.json
│
├── mcp_server/                     # Python MCP tool server (16 categories)
│   ├── tools/                     # recon, web_exploit, metasploit, credentials, ...
│   ├── guardrails.py              # Scope + tool + exploitation validation
│   └── config.py                  # JSON config loader
│
├── tui/                            # Textual terminal UI
│   ├── app.py                     # Main TUI app
│   ├── screens/                   # dashboard, startup
│   └── widgets/                   # ai_thoughts, log_viewer, loot_summary, ...
│
├── modules/                        # Python scan modules (recon, exploit, AI, loot)
├── docker/
│   ├── Dockerfile.api             # Multi-stage Node 22 + Python 3.12
│   ├── Dockerfile.frontend        # Multi-stage Node 22 + serve@14
│   ├── traefik/dynamic.yml        # Traefik routing + security headers
│   ├── certs/                     # TLS certificates (generated)
│   └── generate-certs.sh          # Self-signed cert generator
│
├── scripts/vm/                     # VM provisioning & distribution
│   ├── provision-host.sh          # 7-step host setup (Kali tools, Go, Docker)
│   ├── harden-host.sh             # Security hardening (SSH, PAM, auditd, fail2ban)
│   ├── setup-redteam.sh           # Redteam user + VPN routing
│   ├── create-vm.sh               # Proxmox API VM creation
│   ├── export-ova.sh              # VirtualBox OVA export
│   ├── package-vm.sh              # VM packaging & distribution builder
│   ├── cstrike-firstboot.sh       # First-boot auto-setup (partition, SSH, passwords)
│   ├── cstrike-v2.ovf             # OVF descriptor for OVA packaging
│   ├── cloud-init.yml             # Proxmox cloud-init
│   └── cloud-init-generic.yml     # Generic cloud-init (AWS/GCP/Azure/DO)
│
├── docker-compose.yml              # 9-container Docker stack
├── docker-compose.arm64.yml        # ARM64 overrides (chromium instead of Kasm)
├── install.sh                      # Master bare-metal installer
├── .env.example                    # Infrastructure secrets template
├── results/                        # Per-target scan output (JSON)
└── data/                           # Agent registry, runtime data

Security Tools

35+ tools accessible from the API container via host bind mounts:

VPN & OPSEC

CStrike supports 5 VPN providers with nftables kill switch enforcement:

Split routing: The redteam user's traffic is marked with iptables fwmark and routed through a dedicated VPN tunnel. Management traffic (SSH, web UI) stays on the primary interface.

VPN IP Rotation: During scans, CStrike can automatically rotate VPN exit IPs between tool executions to obfuscate scanning origin. Pre-generates WireGuard config pools from NordVPN (via nordgen) or Mullvad (native relay API), then swaps wg-quick configs (~5-10s per rotation). Three strategies: per-tool (every tool), periodic (every N tools, default 3), and phase-based (on phase change). Configured via the web UI Configuration tab or /api/v1/vpn/rotation/ endpoints.

OPSEC gating: All scans enforce target scope validation and tool allowlist checks at both the API middleware layer and the MCP server guardrails.

Distribution

CStrike v2 ships in 7 formats. See docs/DISTRIBUTION.md for details and downloads.

Documentation

Legal

This software is intended exclusively for authorized penetration testing and red team operations. You must have explicit written authorization before scanning or testing any target. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act (CFAA) and equivalent laws in other jurisdictions.

The authors assume no liability for misuse.

License

MIT License (c) 2025-2026 Culpur Defense Inc.

Built by Culpur Defense Inc.
GitHub