RedChain-Kit — Ajay Anandan

What It Does

RedChain-Kit automates the entire reconnaissance phase of a bug bounty or red team engagement into a single CLI command. Instead of manually chaining tools, copying output between scripts, and formatting findings by hand, you give it a domain and it returns a structured vulnerability report.

The pipeline follows the real-world attack kill-chain in order — each stage feeds the next, and no step runs unless the previous one produces meaningful output. This avoids the noise problem of running broad scanners against targets that aren't alive.

The Pipeline

01

Subdomain Enumeration

subfinder + amass — passive and active enumeration. Discovers all subdomains associated with the target domain. Results deduplicated and sorted.

↓

02

Live Host Probing

httpx — probes each subdomain for HTTP/HTTPS response. Filters to only live hosts. Captures status codes, titles, tech stack fingerprints, and response sizes. Dead hosts are dropped before the next stage.

↓

03

Endpoint Crawling

katana — crawls all live hosts for URLs, forms, API endpoints, JS-linked paths, and parameters. Builds a complete attack surface map of what's actually reachable.

↓

04

Vulnerability Scanning

nuclei — runs 7,000+ community templates against discovered endpoints. CVE checks, misconfigurations, exposed panels, default credentials, header issues, and more.

↓

05

Exploit Classification

Custom regex-based classifier parses all findings and flags high-value vectors: SQLi indicators, IDOR patterns, open redirects, path traversal, exposed admin panels, and unauthenticated endpoints — for manual follow-up.

↓

06

Report Generation

Dual-format output: structured PDF with CVSS severity tiers via FPDF2, and HackerOne-ready Markdown. Both include executive summary, finding details, affected URLs, and remediation guidance.

Flask Dashboard

Beyond the CLI, RedChain-Kit includes a Flask web dashboard backed by SQLite that tracks scan history across runs. You can compare attack surface changes between scans on the same target — useful for tracking remediation progress during an engagement or monitoring for new exposure over time.

# Single command to run the full pipeline
python redchain.py --target example.com --output ./reports

# Launch the dashboard
python dashboard.py
# → http://localhost:5000

Technical Implementation

Each tool in the pipeline is wrapped in a Python subprocess handler that captures stdout, handles timeouts, and normalizes output into a consistent internal format before passing it downstream. This means individual tools can be swapped or upgraded without breaking the pipeline.

The exploit classifier runs regex patterns against nuclei output, katana-discovered URLs, and httpx response data simultaneously. Findings are scored by a custom CVSS approximation using severity labels from nuclei combined with contextual signals — an unauthenticated admin panel scores higher than an informational finding on the same host.

Pipeline architecture:
  SubfinderWrapper → normalize() → List[Subdomain]
  HttpxWrapper    → probe()     → List[LiveHost]
  KatanaWrapper   → crawl()     → List[Endpoint]
  NucleiWrapper   → scan()      → List[Finding]
  Classifier      → classify()  → List[HighValueTarget]
  ReportGen       → render()    → PDF + Markdown

Engineering Challenges

The biggest issue during development was ISP-level NAT64/IPv6 routing causing subfinder, httpx, and katana to resolve to IPv6 addresses that didn't respond on HTTP. Fixed by forcing IPv4 resolution with the -4 flag on httpx, adding the target domain directly to the probe list as a fallback, and hardcoding DNS resolvers to 8.8.8.8 and 1.1.1.1 to bypass ISP DNS issues.

Process management was another challenge — nuclei scans can run for extended periods and produce large stdout streams. Implemented streaming output capture with a real-time progress indicator rather than blocking on subprocess.run() completion.