cross-plugin-pipeline

Cross-Plugin Pipeline

Bridge between tyrell's passive data acquisition and elliot's active exploitation. tyrell discovers exposed databases, acquires breach data, and extracts intelligence. When targets require active exploitation or acquired credentials need validation against live services, the pipeline packages tyrell's intelligence into an elliot-compatible engagement and routes it for active testing. Post-exploitation, elliot's discoveries flow back to tyrell to expand the intelligence picture.

Pipeline Flow

TYRELL                                              ELLIOT
─────                                              ──────
leak-sources.jsonl ─┐
acquisitions.jsonl  ├─ ENRICH ─ CORRELATE ─ BUILD ─── handoffs/<id>/
dumps/<id>/*.jsonl ─┘     │         │          │         ├─ HANDOFF.md
                          │         │          │         ├─ scope.md
                          │         │          │         ├─ target-intel.jsonl
                          │         │          │         └─ attachments/
                          │         │          │              ├─ wordlist.txt
                          │         │          │              └─ sample-records.jsonl
                          │         │          │
                          │         │          └─ handoff-builder.js create
                          │         └─ Match credentials to services
                          └─ Extract domains, IPs, keys from dumps
                                                        │
                    RETURN FLOW                          │
                    ───────────                          ▼
acquisition-tracker.js add ◄──── elliot post-exploitation data
  --source-plugin elliot          (internal creds, pivots, new targets)

Phase 1: Intelligence Enrichment

Before building a handoff, extract maximum value from acquired data. Raw dumps contain far more than credentials — they reveal infrastructure, internal services, cloud keys, and organizational structure.

What to Extract from Dumps

Scan each acquired dump for the following intelligence categories. Use the extraction commands below or analyze manually.

| Category | What to Look For | Example | |----------|-----------------|---------| | Credentials | email:password pairs, email:hash pairs, API keys, tokens | admin@corp.com:P@ssw0rd1 | | Domains | Subdomains, internal hostnames, staging environments | staging.internal.corp.com | | IP Ranges | Internal IPs, server addresses, CIDR blocks in configs | 10.0.0.0/8, 192.168.1.50 | | Cloud Keys | AWS access keys, GCP service accounts, Azure tokens | AKIA..., AIza... | | Connection Strings | Database URIs, LDAP binds, SMTP configs | mongodb://user:pass@internal:27017/prod | | Email Patterns | Naming conventions, distribution lists, admin accounts | first.last@corp.com | | Service Endpoints | API URLs, webhook receivers, admin panels | https://api.corp.com/v2/admin |

Extraction Commands

Search normalized JSONL dumps for high-value patterns:

# AWS access keys
grep -hoP 'AKIA[A-Z0-9]{16}' dumps/<id>/*.jsonl | sort -u

# Connection strings
grep -hoP '(mongodb|mysql|postgres|redis)://[^\s"]+' dumps/<id>/*.jsonl | sort -u

# Internal IPs (RFC1918)
grep -hoP '(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+)' dumps/<id>/*.jsonl | sort -u

# Subdomains from email addresses
grep -hoP '@[\w.-]+\.\w+' dumps/<id>/*.jsonl | sed 's/@//' | sort -u

# API keys and tokens (generic patterns)
grep -hoiP '(api[_-]?key|token|secret|authorization)["\s:=]+["\s]*[A-Za-z0-9_\-]{20,}' dumps/<id>/*.jsonl

Phase 2: Finding Correlation

Match tyrell's intelligence against elliot's attack surface. This is where passive data turns into actionable attack vectors.

Credential-to-Service Mapping

For each credential set discovered in dumps, identify which live services they target:

| Credential Type | Target Services | Attack Vector | |----------------|----------------|---------------| | email:plaintext | Webmail, VPN, SSO, SaaS apps | Credential stuffing / direct login | | email:md5 | Same services after cracking | Hashcat mode 0, then stuffing | | email:bcrypt | Low priority — cracking is slow | Skip unless high-value target | | username:password (no @) | SSH, RDP, database logins, admin panels | Direct authentication | | AWS access key + secret | AWS console, CLI, SDK | aws sts get-caller-identity to validate | | Database connection string | Internal databases | Direct connection if network path exists |

Correlation Decision Tree

For each credential set in dumps:
│
├─ Are the target services reachable from our position?
│   ├─ YES → Include in handoff as P1 attack vector
│   └─ NO → Check if VPN/jump host credentials exist in dumps
│       ├─ YES → Include VPN creds as P0 (prerequisite) + service creds as P1
│       └─ NO → Include as P2 (requires network pivot after initial access)
│
├─ Is the password plaintext or a weak hash (MD5/SHA1)?
│   ├─ PLAINTEXT → Ready to use, mark confidence: high
│   ├─ MD5/SHA1 → Crack first (hashcat), then include if successful
│   └─ BCRYPT/SCRAM → Deprioritize unless <100 hashes
│
└─ How many unique passwords in the set?
    ├─ High reuse (>30% same password) → Credential stuffing viable
    └─ Low reuse → Targeted per-account attempts only

Phase 3: Build Handoff Package

Generate the engagement package using handoff-builder.js. The builder reads from the source tracker, acquisition tracker, and hunt profile to assemble a structured directory that elliot can consume immediately.

Generate

node ${CLAUDE_PLUGIN_ROOT}/scripts/handoff-builder.js create <source-id> \
  [--tech-stack <mongo|elastic|redis|mysql|postgres|mixed>] \
  [--defenses <none|waf|ids|auth|unknown>]

The builder:

1. Reads the source entry from leak-sources.jsonl by ID
2. Extracts target host, port, service type, and access method
3. Generates HANDOFF.md (engagement brief), scope.md (target scope), and target-intel.jsonl (machine-readable intel)
4. Auto-registers the handoff in handoffs.jsonl via handoff-tracker.js
5. Updates the source status to handed-off

Output directory: handoffs/<source-id>/

Manual Enrichment After Build

The auto-generated package is a starting point. Before passing to elliot, enrich it manually:

1. Add credential wordlists — Extract unique passwords from dumps and save as attachments/wordlist.txt
2. Add sample records — Include 10-50 representative dump records as attachments/sample-records.jsonl for context
3. Update HANDOFF.md — Add recommended attack vectors based on Phase 2 correlation
4. Update scope.md — Add discovered domains, IPs, and cloud assets from Phase 1 enrichment
5. Append to target-intel.jsonl — Add extracted infrastructure intel in elliot's format

target-intel.jsonl Record Schema

Each line is a JSON object compatible with elliot's target-intel.js add command:

{
  "target": "corp.com",
  "category": "credential|service|network|tech-stack|defense|endpoint|note",
  "key": "descriptive-key",
  "value": "the actual value",
  "source": "tyrell"
}

Elliot's valid categories: tech-stack, defense, credential, network, note, service, endpoint

To bulk-import the handoff intel into elliot:

# From the elliot engagement directory
while IFS= read -r line; do
  target=$(echo "$line" | python3 -c "import sys,json; print(json.load(sys.stdin)['target'])")
  cat=$(echo "$line" | python3 -c "import sys,json; print(json.load(sys.stdin)['category'])")
  key=$(echo "$line" | python3 -c "import sys,json; print(json.load(sys.stdin)['key'])")
  val=$(echo "$line" | python3 -c "import sys,json; print(json.load(sys.stdin)['value'])")
  node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "$target" "$cat" "$key" "$val" --source tyrell
done < handoffs/<source-id>/target-intel.jsonl

Phase