DOCSEARCHbyAlgolia
Submit Docs

Red Kite Documentation

website·Indexed 32 days ago

https://wiki.stalker.red-kite.io/docs/intro/

An Attack Surface Management (ASM) tool focused on extensibility. Red Kite streamlines and automates the discovery of network environments using Jobs, Findings, and Resources. The platform supports Python and Nuclei Job types, provides a Software Development Kit (SDK) for custom job implementation, and features an API for data access.

Tokens
12K
Snippets
63
Records
93
Agent score
61%

What's inside Red Kite

  1. Overview of Red Kite ASM

    Red Kite is an extensible Attack Surface Management (ASM) tool designed to automate reconnaissance operations. It is powered by Kubernetes for horizontal scaling and provides a web interface for data sharing and an API for third-party automation. Common use cases include real-time attack surface discovery and management, regression testing, and custom testing at scale.

  3. Overview of Red Kite Resources

    Resources are the core entities of an exposed network in Red Kite, used to store and display data discovered by jobs. Every resource is unique within its project; deleting a project removes all associated resources. All resources track three key timestamps: createdAt (creation date), updatedAt (last update), and lastSeen (date of last discovery). Resources are created or enriched via 'findings' generated by the API or user interface.

  4. Overview of Red Kite Subscriptions

    Subscriptions in Red Kite automate workflows by starting jobs based on either a cron expression (cron subscriptions) or a finding (event subscriptions).

    Key behaviors:

    • Scope: A subscription can be assigned to a specific project (affecting only that project) or left project-less to affect all projects.
    • Lifecycle: Subscriptions assigned to a project are automatically deleted if that project is deleted.
    • Constraints: Subscriptions will not trigger on blocked resources.
    • Built-in Subscriptions: Red Kite provides built-in subscriptions that can be modified or deleted by users.
    • Format: Subscriptions are configured using YAML in the front-end.

  5. Overview of Red Kite Findings

    Findings are pieces of information attached to a project and a specific resource (e.g., domain, host, or port). They are created using the Red Kite SDK by producing an object containing the necessary information and serializing it as JSON. Every finding object must include a type field. Findings can either create new resources or add data to existing ones.

  7. Visualize attack surfaces using Topology graph view

    The Topology view (also known as graph view) represents resources as a graph to provide a global portrait of an attack surface. Users can generate a graph by selecting a project and searching for/selecting a specific resource. Selecting a resource within the graph provides a preview of its data. By default, graphs are generated with a depth of 5, though this depth can be customized. The view supports both graph and tree formats, with additional UI controls available to remove colors or curve the connecting lines.

  8. Manage and scope secrets in Red Kite

    Secrets are encrypted variables used to connect jobs to third-party services. They are decrypted immediately before being passed to a job to minimize exposure.

    When creating a secret, you must provide a name and a value (and optionally a description). Secrets can be scoped as follows:

    • Global Secrets: Available to any project.
    • Project Secrets: Assigned to a specific project. If a project secret and a global secret share the same name, the project secret takes precedence and overwrites the global one.

  9. Understand Red Kite Kubernetes network isolation

    The Red Kite application is deployed in a Kubernetes cluster using a one-instance-per-cluster model. It employs a 'default deny all' network policy for the stalker, stalker-jobs, and default namespaces. Consequently, any pod within these namespaces requires a custom network policy to enable connectivity. To further isolate workloads, Red Kite jobs (Kubernetes Jobs) are executed in a dedicated namespace called stalker-jobs.

  10. Organize resources using Projects in Red Kite

    Projects in Red Kite are used to organize and centralize resources. Each resource is unique to its specific project. Note that deleting a project will permanently delete all associated resources and related information. Project names must be unique, although they can be renamed. Optionally, a logo can be added to a project for display purposes.

  11. Understand Red Kite Jobs and Finding references

    A job is a mechanism used by Red Kite to discover new information. Jobs run in contained environments and generate findings. You can drive automated discovery by referencing a Finding's output variable as a job parameter using the syntax ${variableName}. Variable name references are case-insensitive.

  12. Configure Red Kite installation preferences

    Installation preferences are managed in the setup.sh file. You can customize the network access and the maximum storage size for MongoDB.
    RK_HOSTNAME=red-kite.lan
RK_PORT=8443
MONGO_MAX_SIZE="32Gi"