## https://sploitus.com/exploit?id=2D7BF230-8946-5C1E-948C-44E786931DAF
# RAVEN
**Reconnaissance & Attack on Vulnerable Elasticsearch Nodes**
RAVEN is a modular offensive security testing framework for Elasticsearch (port 9200) and Kibana (port 5601). It provides reconnaissance, exploitation, and data exfiltration capabilities against vulnerable Elastic Stack deployments. Modeled on ODAT (Oracle Database Attacking Tool), RAVEN uses a plugin-based architecture where each attack vector is an independent module. This is a personal open-source project for authorized security testing only.
## Disclaimer
**RAVEN is designed for authorized penetration testing and security research only.** Unauthorized use against systems you do not own or have explicit written permission to test is illegal and unethical. The author assumes no liability for misuse. Use of destructive modules requires explicit arming flags and scope files to prevent accidental damage. All write operations are logged for cleanup and evidence preservation.
## Features
*RAVEN's 19 modules, 8 tracked CVEs, and 9 lab environments at a glance.*
### Reconnaissance
- **fingerprint** - Identify Elasticsearch version, cluster name, and build information
- **recon** - Enumerate cluster health, node roles, plugins, and configuration
- **indices** - List all indices with sizes, document counts, and health status
- **search** - Query indices and extract sensitive data patterns (credentials, API keys, secrets)
### Access Acquisition
- **anonymous** - Detect and enumerate anonymous access to Elasticsearch
- **bruteforce** - Credential brute-force against HTTP basic authentication
### Exploitation
- **scripting** - Execute code via MVEL, Groovy, or Painless scripting engines (version-gated RCE)
- **snapshot** - Abuse snapshot API for arbitrary file read and data exfiltration
- **privesc** - Privilege escalation reconnaissance and analysis
- **apikey** - Create and manage API keys for persistence and credential-independent access
### Data Exfiltration
- **exfil** - Bulk exfiltration of indices to local NDJSON files
- **snapshot** - Snapshot indices to rogue repositories for offline analysis
### Kibana Pivot
- **kb-recon** - Enumerate Kibana version, plugins, and configured data sources
- **kb-loot** - Extract Kibana saved objects, dashboards, and embedded credentials
- **kb-cve** - Exploit known Kibana CVEs with version-gated checks
### Destructive Testing
- **destroy** - Delete indices, snapshots, or cluster data (requires arming)
- **dos** - Denial-of-service via resource exhaustion (requires arming)
- **persist** - Establish persistence via API keys, backdoor users, or index poisoning (requires arming)
- **clean** - Reverse all RAVEN changes by processing activity logs
### Reporting
- **all** - Run comprehensive reconnaissance and generate reports automatically
## Installation
### From PyPI
```bash
pip install raven-es
raven-es --help
```
### From Source (Recommended for Development)
```bash
git clone https://github.com/karlvbiron/raven
cd raven
python3 -m venv .venv
source .venv/bin/activate
pip install -e .
```
Verify installation:
```bash
raven-es --help
```
For development and testing:
```bash
pip install pytest pytest-timeout
pytest tests/unit/ -q
```
## Quick Start
The following demonstrates read-only reconnaissance against a target. Destructive modules require additional safety flags (see `--help` for each module).
```bash
# Fingerprint the target
raven-es -t localhost:9200 fingerprint
# Enumerate cluster configuration
raven-es -t localhost:9200 recon
# List indices and document counts
raven-es -t localhost:9200 indices
# Search for secrets in indices
raven-es -t localhost:9200 search --index logs --grep-secrets
# Generate a comprehensive report
raven-es -t localhost:9200 all --output-dir ./loot
```
Expected output:
- **fingerprint** - Version number, cluster name, build hash
- **recon** - Cluster health (green/yellow/red), node count, plugin list
- **indices** - Table of indices with sizes and document counts
- **search** - Extracted secrets with pattern matches (AWS keys, JWTs, passwords)
- **all** - Markdown and HTML reports in the output directory
## Lab Environment
RAVEN includes a Docker-based lab environment in `lab/targets/` for testing and development. Each target is self-contained with its own `docker-compose.yml`. The MAIN target includes planted secrets, misconfigurations, and vulnerable versions for demonstrating all modules. Start any target with the corresponding `make` command (e.g., `make lab-main-up`). See `docs/lab-guide.md` for the complete lab map and module-to-target mappings.
## Module Reference
| Module | Category | Description |
|--------------|---------------|---------------------------------------------------------------|
| fingerprint | recon | Identify Elasticsearch version and cluster information |
| recon | recon | Enumerate cluster health, nodes, plugins |
| indices | recon | List indices with sizes and document counts |
| search | recon | Query indices and extract secrets |
| anonymous | access | Test for anonymous access |
| bruteforce | access | Brute-force HTTP basic authentication |
| scripting | exploit | Execute code via scripting engines (MVEL/Groovy/Painless) |
| snapshot | exfil | Snapshot abuse for file read and data exfiltration |
| exfil | exfil | Bulk exfiltration of indices to NDJSON files |
| privesc | exploit | Privilege escalation reconnaissance |
| apikey | persistence | Create and manage API keys for credential-independent access |
| kb-recon | pivot | Enumerate Kibana version and configuration |
| kb-loot | pivot | Extract Kibana saved objects and credentials |
| kb-cve | pivot | Exploit Kibana CVEs |
| destroy | destructive | Delete indices or cluster data (requires arming) |
| dos | destructive | Resource exhaustion attacks (requires arming) |
| persist | persistence | Establish persistence via rogue users, API keys, and Watchers |
| clean | cleanup | Reverse all RAVEN changes via activity logs |
| all | orchestration | Run full reconnaissance and reporting workflow |
## License
BSD-3-Clause
Copyright (c) 2025, Karl Biron
See `LICENSE` for full text.