hermes-pentest-lab · production reference · full inventory
The complete build — every subagent, service, and control.
The detailed companion to the system overview. Native Kali host; Docker only for lab targets and Neo4j. Seven subagents feed a SQLite v4 findings store, an independent verification pass assigns verdicts, and the report builder emits verdict-gated PDF/DOCX/MD — all inside a scope-enforced, LUKS-encrypted zone.
Host OS reflects the repo README (Kali required — tools run natively for raw sockets / SMB / capture). Docker profiles reflect the actual compose (lab, sandbox, neo4j). If your build differs, these two labels are the ones to adjust.
01
Orchestration
The operator drives Hermes through skills; Hermes delegates to subagents and sees only structured JSON summaries — never raw tool output.
Each runs in isolated context and returns structured output. Tiers gate what may touch the target.
Scopeguard · first
validate every target vs scope.json
write audit trail
→ {allowed, reason}
OSINTpassive
theHarvester · holehe · sherlock
crt.sh · shodan
→ {subdomains, emails, tech}
Reconactive
nmap · masscan · amass
T3 · max 500 pps
→ {hosts, ports, services}
Webactive
ffuf · nuclei · sqlmap
gobuster · wpscan
→ {vulns, endpoints}
Network / ADactive · approval
nxc · bloodhound · certipy
impacket · kerbrute · responder
→ {shares, users, paths}
Verifyquality · phase 5.5
verify-findings.py · benign
independent reproduction → verdict
→ {verdict, observable}
Reportoutput · read-only
CVSS 3.1 · finding docs
Jinja2 → WeasyPrint
→ report.pdf / .docx / .md
03
Verification method registry
How the Verify agent reproduces each finding class — always with a method independent of the discovery tool, always benign. Destructive classes abstain; a probe error is never a verdict.
Unmapped class · or independence not possibleno false claim made
—
→ UNVERIFIED
Any probe errortimeout · DNS · reset — never a verdict
error recorded
→ UNVERIFIED (not REFUTED)
04
Runtime & targets
Tools run natively on the Kali host. Docker is used only for practice targets and the graph database; the old per-tool Kali images are deprecated in favour of native execution.
profile: lab
OWASP Juice Shop :3000
DVWA :8080
profile: neo4j
Neo4j 5 CE :7474 :7687
BloodHound database
profile: sandbox
sandbox-linux
isolated · no internet
deprecated
kali-web · kali-net · osint-tools
replaced by native host tools
05
Findings DB — SQLite v4
Per-engagement store. The v4 migration added the verification columns to findings; everything else is unchanged and additive.
hostshost · ip · source · discovered_by · first_seen
serviceshost_id · port · service · version · banner