Bundled Module Reference

Use Testing → Bundled modules → Help for the check you are preparing. These entries describe Raven's current inputs and result types; an engagement does not need every check. For a demonstrated SMB/web/capture sequence, see the internal lab walkthrough.

Before running a module

Save the scope and exclusions, then inspect the module's target source. Cards can use scope, discovered services, a typed target, or a selected domain controller. Use selected targets fills matching inputs; it does not replace every card's discovery source. Workflows have their own initial-target and discovery-source choices.

Choose the execution path that reaches those targets. A tool route below means the module's configured local, Docker, jumpbox or supported proxy route. Checks requiring execution on the jumpbox use that host when configured; with no jumpbox, inspect the local fallback before running. A native check runs through Raven's own server-side check. Connecting an agent does not move every module to it: use an offered agent mode, or prepare your command explicitly in Tools or Agents.

Expand tool health to compare the available execution-machine statuses. A missing local tool does not establish that it is missing from a connected agent. Inspect the selected agent's detected tools separately. Docker supplies the shipped toolchain; a bare installation uses its installed or pinned tools. Target credentials, service keys, interfaces and network reachability still belong to the selected check. Strict testing windows refuse direct SSH commands whose remote process exit cannot be verified.

After running, inspect Runs, the original output, and the expected data view. A green exit can still accompany an empty target list, timeout, missing key or failed authentication. Keep that limitation with the run. Discovery records are not automatically verified vulnerabilities. Review a finding's affected service, evidence and source before retesting or including it in a report. Use a matching Use my tool alternative per run; it does not replace existing workflows or guarantee equivalent coverage.

Discovery

Host Discovery

Targets: Allowed scope hosts/networks; URL entries contribute their hostname. Needs: Nmap and a route to the target network; probes may need raw-network privileges. Execution: Tool route, with jumpbox execution when configured. Results: Live-host observations from Nmap's host-discovery scan; inspect Hosts and the run log. This bundled card is liveness discovery, not httpx web fingerprinting. No result: A host may ignore the chosen probes; no response does not establish that it has no listening services.

Port Scanner

Targets: Scope by default, or discovered hosts when that option is selected. Needs: Nmap; privileges appropriate to the scan flags. Execution: Tool route, with jumpbox execution when configured. Results: Hosts, open ports, and service information where requested. Quick uses a smaller port set; balanced adds service discovery; thorough also requests OS detection. Custom arguments still use Raven's target/output handling. No result: Inspect host timeout, filtered ports and empty targets separately. Nmap service detail and a Masscan port-discovery alternative answer different questions.

Fingerprinting

Targets: Hosts already recorded in the engagement. Needs: Discover hosts first; reachable services for the supported fingerprint probes. Execution: Raven's native fingerprint check. Results: Fingerprint observations associated with hosts; inspect the recorded product/banner evidence. No result: Unknown or conflicting fingerprints do not establish product absence. Review the actual probed URL/port before using a product-specific follow-up.

SSL Certificates

Targets: Discovered TLS services and their ports. Scan all hosts falls back to port 443 when no TLS service was discovered. Needs: SSLyze and a reachable TLS endpoint. Execution: Tool route with jumpbox execution when configured. Results: Certificate/TLS observations and the original JSON output; inspect host/service details and supported imported findings. No result: Missing TLS inventory, a failed handshake and a certificate without the expected name are different outcomes. Certificate collection is separate from the SSL/TLS vulnerability checks below.

WAF Detection

Targets: Discovered web-service URLs; Scan all hosts widens the fallback. Needs: wafw00f and reachable web services. Execution: Tool route; supported proxy mode depends on the configured route. Results: Detection observations in the run output. No result: No web services or an unrecognized response does not prove a WAF is absent. Inspect what the signature actually identified; this is not a bypass or exploitation test.

Git Exposure

Targets: Web URLs constructed from recorded hosts by this native check. Needs: Discover the hosts and review the actual scheme/port used. Execution: Raven's native web check. Results: Recorded Git exposures and their URLs when the detection rule matches. No result: A denied/missing .git path differs from a connection failure or an untested service port. Retain the response that supports an exposure before drafting a finding.

API Discovery

Targets: Web URLs constructed from recorded hosts by the native API check. Needs: Host inventory and reachable supported API-document paths; review the scheme/port. Execution: Raven's native web check. Results: Discovered API endpoints recorded as web exposures. No result: An absent supported document does not rule out other APIs. An API's existence does not establish an authorization or data-exposure vulnerability.

FTP Enumeration

Targets: Discovered FTP services; the module uses their hosts and ports. Needs: Nmap and an applicable FTP service. Execution: Tool route, with jumpbox execution when configured. Results: Nmap FTP-script observations, including anonymous access and supported server checks; retain the original script output and review imported findings. No result: No discovered FTP service is different from denied anonymous access or a failed script. Inspect the chosen scripts, since enumeration can include active checks.

Screenshots

Targets: Applicable scope/discovered web URLs, or FFUF paths when Use FFUF results is selected. Needs: GoWitness, its browser dependencies, and reachable full URLs. Execution: Tool route. Results: Screenshot artifacts; inspect the image, source URL and port in Screenshots and the run. No result: No applicable URL, browser startup failure and a page-load error are different outcomes. Capturing an image does not by itself establish a finding or prove that a later workflow received an asset record.

OSINT

These checks can send domain/IP/search terms to public data sources. Their service keys and quotas are configured under Settings → Tools & services. AI prompt anonymization is a separate operation; it does not turn a public lookup into an offline request.

Sublist3r

Targets: The entered domain, or scope domains in the card's scope mode. Needs: Sublist3r and access to its search sources. Execution: Raven-host OSINT tool path. Results: Subdomain output files; inspect candidates before adding them to scope or running another check. No result: Missing executable, blocked sources and an empty search are separate; a candidate name does not prove a live service.

Certificate Transparency

Targets: The entered domain, or scope domains. Needs: Access to crt.sh. Execution: Native OSINT lookup from Raven. Results: Certificate-name subdomain observations saved with their source. No result: Empty public records and service/API errors differ. Wildcards and historical certificate names need review before becoming authorized scan targets.

Email Harvesting

Targets: Entered domain or scope domains. Needs: theHarvester and access to its configured sources. Execution: Raven-host OSINT path. Results: Email observations and retained source output. No result: Missing tooling or a source timeout can yield no emails without completing coverage. A discovered email address is not a verified credential.

Breach Data

Targets: Entered domain or scope domains. Needs: Configured DeHashed access and available quota. Execution: Native provider lookup from Raven. Results: Breach/email observations with their provider source; inspect the relevant data and credential views. No result: Missing keys, denied/quota responses and no matching records differ. Historical exposed material does not establish that a credential remains valid.

Wayback Machine

Targets: Domains extracted from engagement scope. Needs: Access to the archive API. Execution: Native OSINT lookup from Raven. Results: Saved historical URL lists and selected interesting URLs in the run's OSINT output. No result: No usable scope domain and a failed archive response differ from an empty archive. A historical path is not proof it exists now.

GitHub Dorking

Targets: Scope domains used in the configured search terms. Needs: Access to GitHub search and any configured API credentials/quota. Execution: Native OSINT lookup from Raven. Results: Saved repository/search observations. No result: Search restrictions, rate limiting and no matches differ. Inspect an apparent leaked secret before recording a finding; a snippet is not evidence of current access to the assessed system.

Shodan Host

Targets: The entered IP, or explicit scope IPs in scope mode. Needs: A configured Shodan API key and quota. Execution: Native provider lookup from Raven. Results: Saved host-enrichment output. No result: Missing key, not-found and provider failure differ. Shodan's observations are third-party history, not a port scan Raven just performed.

Shodan Search

Targets: The entered search query and result limit. Needs: Shodan key, quota and a valid query. Execution: Native provider lookup from Raven. Results: Saved matching search records. No result: Invalid query, quota failure and no matches differ. A search match does not automatically add an address to the engagement's authorized scope.

Scanning

Nuclei Scanner

Targets: Discovered web-service URLs when available; scope is the fallback. Include all hosts broadens that preparation. Needs: Nuclei, applicable templates and access required by those templates. Execution: Its configured Nuclei local/jumpbox/proxy/agent mode; inspect the execution indicator. Results: JSONL observations and supported candidate findings with template identity/severity. No result: A missing template, failed request, excluded severity or empty target set is not a clean vulnerability assessment. Review template behavior and any configured out-of-band interaction before running.

SSL/TLS Scanner

Targets: Discovered TLS host/port pairs; Scan all hosts can use the port-443 fallback. Needs: SSLyze and reachable TLS services. Execution: Tool route, with jumpbox execution when configured. Results: Protocol and supported vulnerability-check output; retain JSON evidence and inspect parsed findings. No result: Handshake errors and checks that did not run are not negative findings. Keep the particular protocol/check evidence with the report.

Email Security

Targets: Entered email domain, or domains derived from recorded hostnames. Needs: DNS access and reachability for the selected email-service checks. Execution: Raven's native scanner. Results: SPF/DMARC/DKIM and supported SMTP observations/findings. No result: No domain, missing records and failed queries differ. Review the domain and actual checks performed rather than infer mail security from the job's exit status.

WHOIS Lookup

Targets: Recorded engagement hosts/domains. Needs: Access to the relevant registration lookup service. Execution: Native lookup from Raven. Results: Registration/enrichment observations. No result: Empty host inventory, unsupported registration data and lookup errors differ. Ownership metadata is context, not a vulnerability or proof of current target control.

Typosquatting Detection

Targets: The entered base domain and generated permutations. Needs: dnstwist and the resolver/source access used by the check. Execution: Native scanner with its tool dependencies. Results: Lookalike-domain observations; inspect what resolved and which supporting data was returned. No result: Unresolved candidates and lookup failure differ. Similar spelling does not establish malicious use.

DNS Zone Transfer

Targets: The entered domain, or domains derived from host/subdomain inventory. Needs: Domain names and access to the queried authoritative DNS servers. Execution: Raven's native scanner. Results: Successful transfer evidence and applicable findings. No result: A refused transfer and a server that could not be queried differ; an IP-only scope may supply no domain to test. Preserve the returned zone records and exact server when recording exposure.

Directory Brute Force

Targets: Entered complete web URL, or discovered web services through the available target options. Needs: FFUF and the selected/default wordlist on its execution path. Execution: Tool route. Results: Responding web paths; inspect native URLs, status and port in Hosts → Discovered paths. For a Tools alternative, Paths is a reviewed import choice. No result: An empty wordlist, wildcard/filter behavior and failed requests differ from no matches. A responding path is a discovery, not a verified vulnerability.

Exploitation

Default Credentials Testing

Targets: Discovered ports with an identified service; populate hosts and services first. Needs: Credential candidates in Raven's library and a supported authentication check. The existing scanner checks SSH, FTP and HTTP authentication; its HTTP check first probes for an unauthenticated challenge. Execution: Raven's native scanner on the Raven host. Results: Accepted credentials are recorded as findings when database storage succeeds. Inspect the actual service, output and finding before reporting the result. No result: No library candidates, an unsupported service, rejected credentials and connection errors differ. Review the output; an empty result does not establish that all default credentials were tested. A port number or public login page alone does not identify a product or prove authentication.

Internal

These cards are available for internal and mixed engagements. Discover the domain controller or enter the intended one explicitly; a hostname label alone does not prove its role. Select a usable configured/recovered credential where offered. Captured NTLM challenge-responses are not plaintext passwords or reusable NT hashes. Keep listener placement and captured source IP separate.

DC Discovery

Targets: Entered domain, optional DNS server and subnet; known Kerberos/LDAP hosts can inform DNS selection. Needs: Appropriate DNS tooling and a route to the domain's resolver. Execution: Target-network tool route. Results: Controller discoveries associated with hosts. No result: Wrong DNS, no SRV answer and a failed query differ. Confirm the discovered role before choosing it for authenticated directory checks.

SMB Signing Check

Targets: Explicit multiline hosts, otherwise discovered SMB hosts. Needs: NetExec and reachable SMB services. Execution: Target-network tool route. Results: Signing state in the banner/output; inspect supported parsed findings and their source. No result: No discovered SMB service or a failed probe does not establish signing policy. Signing not required is a potential relay precondition; it does not prove a capture, relay or domain compromise.

SMB Enumeration

Targets: Explicit hosts or discovered SMB hosts. Needs: NetExec; supply the authorized credential when the selected enumeration requires it. Execution: Target-network tool route. Results: The chosen share/user/ session observations in output and supported parsed data. No result: Denied authentication and an empty returned list differ. A READ/WRITE share listing records reported access; a read/write operation needs its own evidence.

LDAP Enumeration

Targets: Selected/entered DC, or an applicable discovered LDAP controller. Needs: NetExec, domain context and credentials required for the chosen enumeration. Execution: Target-network tool route. Results: The selected users, groups, computers or supported attribute observations. No result: Invalid enumeration type and bind/query failure differ from an empty directory result. Trust collection belongs to BloodHound's collection options, not an invented LDAP enumeration flag.

Password Spray

Targets: Selected/entered DC and the entered usernames, with one password and selected protocol. Needs: NetExec and the agreed account/lockout/attempt plan. Execution: Target-network tool route. Results: Actual authentication outcomes for the attempted accounts; retain successful/failed attempts and timestamps. No result: Missing users/DC, lockout or transport failure does not establish that the password is invalid for every intended account.

LDAP Signing Check

Targets: Selected/entered DC or discovered LDAP controller. Needs: A NetExec version that reports signing/channel-binding state; supplied credentials can enrich the check but this banner check can run without them. Execution: Target-network tool route. Results: Observed LDAP signing/channel-binding policy. No result: No controller, unrecognized output and failed connection must stay distinct. Policy is a relay precondition, not proof of successful relay or resource-based constrained delegation.

AS-REP Roasting

Targets: Selected/entered DC and domain; optional explicit user list. Needs: Impacket GetNPUsers and appropriate directory reachability/user selection. Execution: Target-network tool route; explicit user files must be available through that path. Results: Returned AS-REP material when the account permits the request; inspect captured credentials and original output. No result: No matching account and failed user discovery/request differ. Obtaining material for offline guessing does not mean its password was recovered.

Kerberoasting

Targets: Selected/entered DC and domain using the supplied credential. Needs: Impacket GetUserSPNs and usable domain authentication. Execution: Target-network tool route. Results: Requested service-ticket material and the retained hash output; inspect applicable captured-credential records. No result: No applicable SPN, denied authentication and request/output failure differ. This request is separate from an offline cracking result.

Auth Coercion

Targets: Selected/entered target, listener address and chosen method. Needs: Coercer, the appropriate target prerequisites and a reachable listener; provide credentials when the method requires them. Execution: Target-network tool route. Results: Method attempts and any independently observed listener callback/capture. No result: No callback is not a verified successful coercion. Keep coercion, captured authentication and successful relay as separate stages. This live-listener operation is not queued as a resumable checkpoint check.

BloodHound Collection

Targets: Selected/entered DC, domain and collection choice. Needs: bloodhound-python and usable supplied domain credentials. Execution: Target-network tool route. Results: Collection archive; use Auto-import when complete when offered, then inspect Active Directory entities and counts. Otherwise import the retained collection explicitly. No result: Failed collection/authentication and an empty compatible collection differ. A displayed graph is imported data; validate an apparent attack path before reporting it as proven access.

Utility

Custom Command

Targets: The command you enter. Needs: Its executable, dependencies, files and any credentials on the selected execution machine. Execution: The card's local or jumpbox choice; use Tools/Agents when you need those explicit execution choices. Results: Retained command output, followed by any import you select. Tools supplies deterministic reviewed parsers and saved wrappers. No result: Inspect stderr, exit status and output-file handling. Scope does not rewrite arbitrary shell commands, and prose does not create a reproducible check without a saved producing run.

Research, runs and evidence

Cheatsheets and LOLBins can prepare an editable draft. Replace example variables and choose targets, interface and execution machine before reviewing it. A reference does not install a tool or guarantee a result parser. Use agent history for direct agent jobs and Runs for managed jobs. Keep raw output even when no structured parser applies, add an accurate observation/finding, and link the saved run when preparing a retest. For disconnected reporting, use an encrypted engagement transfer; importing history launches no commands.