Most security teams are drowning in work. There are applications to test, compliance deadlines to hit, and a never-ending stream of vulnerabilities to chase. Traditional penetration testing takes weeks, costs a small fortune, and happens once or twice a year if you are lucky.

Darkmoon changes the game entirely.

It is an open-source AI platform that runs autonomous penetration tests while you are away from your desk. It finds out vulnerabilities, confirms them and generates detailed reports with supporting documentation. Human input is not needed at all.

Here’s how it works and how to start using it right away.

Important Disclaimer

This article is intended for educational and defensive purposes only. The techniques described here are shared to help security professionals understand emerging threats so they can better protect their systems.

Do not use these techniques against systems you do not own or do not have explicit written permission to test. Unauthorized testing is illegal in most jurisdictions.

The author assumes no liability for any damages, legal consequences, or other outcomes resulting from the use or misuse of this information. Authorization is a must before conducting any security tests. Stay legal. Stay ethical. Stay responsible.

What Exactly Is Darkmoon?

Darkmoon is a security testing tool using artificial intelligence that works on its own. The tool is open source and can be downloaded, analyzed, modified, and used it without paying for expensive licenses.

It does not replace human pentesters. Think of it as a force multiplier. It handles the boring, repetitive work so your team can focus on the interesting stuff.

Why people love it:

• Privacy-first design: Your sensitive data never hits external AI models
• Multi-agent system: A team of specialized AI agents working together
• 50+ tools built in: Everything from port scanners to exploit frameworks
• Open and transparent: You can audit the code yourself
• Evidence-based findings: Every vulnerability comes with proof

Why Privacy Matters in AI Pentesting

Most AI security tools ship your infrastructure data off to external providers. Your IPs, internal hostnames, even credentials can end up in third-party logs.

For banks, hospitals, or defence contractors, that is a non-starter.

Darkmoon fixes this with a privacy gateway. It swaps your real data for fake placeholders before anything reaches the AI model. Your real information never leaves your machine.

How it works:

1. The AI only sees placeholders like "HOST_001" or "IP_001"
2. Your real data stays locked in a local vault
3. When a tool runs, the real value is temporarily restored
4. After execution, it is masked again immediately

The AI does its job perfectly. It just never learns anything real about your infrastructure.

How Darkmoon Works Under the Hood

Darkmoon uses a multi-agent system. Think of it as a team of specialists working together.

Three layers are present in this architecture:

• Master Agent: This acts as the controller in the system. The Master Agent analyzes the target machine and figures out what is running in it.
• Specialist Agents: These do the actual work. One handles web apps. Another does Active Directory. A third focuses on Kubernetes. Each agent has a specific job.
• The Execution Gateway: This controls how tools are run. It ensures nothing runs outside the allowed set of security tools.

What the specialist agents cover:

• Web applications and APIs
• CMS platforms like WordPress and Drupal
• Active Directory environments
• Kubernetes clusters
• GraphQL endpoints
• Cloud infrastructure

The system keeps reasoning and execution completely separate. The AI never runs commands directly on your machine. Everything happens inside isolated containers.

Getting Started: Installation Guide

Installation of Darkmoon is quite simple. Requirements: You will require Docker, Docker Compose, and the API key of your AI provider.

Step 1: Get the Code

git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon

Step 2: Select your AI Provider

Darkmoon can work with several different AI providers:

• Anthropic Claude
• OpenAI GPT
• OpenRouter
• Locally hosted models with Ollama

Set up your AI API key as follows:

export ANTHROPIC_API_KEY="your-key-here"
# or
export OPENAI_API_KEY="your-key-here"

Step 3: Start Darkmoon

docker-compose up -d

Step 4: Verify That It Has Started

docker-compose logs

This shows the Darkmoon engine starting up along with all the agents.

Running your first security assessment

After setting up Darkmoon, you can begin with your tests.

Basic scan

docker-compose exec darkmoon python main.py --target example.com

Darkmoon will perform:

• Port and service discovery
• Technology stack detection
• Attack surface mapping
• Specialized agent deployment based on results

Bug Bounty Mode

For bug bounty hunters or researchers:

docker-compose exec darkmoon python main.py --target example.com
 --mode bugbounty --severity high --format h1

It is designed to address high severity vulnerabilities and report them in HackerOne format.

CI/CD Integration

For companies who want to integrate security in CI/CD process:

docker-compose exec darkmoon python main.py --target
 staging.example.com --mode ci --report json

It will find vulnerabilities before reaching production environment.

What Darkmoon Can Test

Darkmoon is not limited to web applications. It covers a broad range of targets.

Supported targets:

• Web apps and APIs
• Active Directory
• Kubernetes clusters
• Cloud platforms
• Content management systems
• Corporate networks
• CI/CD pipeline
• Databases
• IoT devices

In-built security tools:

Darkmoon includes more than 50 built-in security tools:

Quick Reference: Darkmoon Commands

Scenario 1: Overnight vulnerability assessment of Web App

The Situation

Your web app is due to launch in a week from now. The security team is already swamped, and there is not enough time for manual testing.

The Solution

Darkmoon is set up to execute at night time:

docker-compose exec darkmoon python main.py 
--target staging.company.com --mode full

What Will Happen Next?

• Darkmoon will scan open ports and services.
• Identifies the technology stack (WordPress on PHP).
• CMS agent runs WPScan
• Web agent runs Nuclei and sqlmap
• All data is combined into one report

The Result

In the morning, you have an exhaustive report of vulnerabilities for your application.

Scenario 2: Active Directory Assessment

The Situation

You are planning a red team exercise. You need to understand your Active Directory attack surface.

The Solution

You run Darkmoon against your domain:

docker-compose exec darkmoon python main.py --target ad.company.com
 --mode ad

What Happens

• Darkmoon enumerates the domain
• The AD agent activates
• It runs BloodHound to map attack paths
• It runs Impacket tools to test privilege escalation

The Result

Darkmoon produces a complete AD attack path map and identifies several high-risk privilege escalation chains.

Darkmoon vs Traditional Pentesting

Limitations to Keep in Mind

Darkmoon is powerful, but it has limits.

• It does not replace human pentesters. It runs existing tools and coordinates them. It does not find brand-new vulnerabilities. Human creativity still matters.
• It can miss context. AI can misinterpret weird systems that a human would instantly understand.
• It can hallucinate. The AI might focus on the wrong attack path.
• It needs oversight. You should always verify findings before acting on them.

The Bottom Line

Darkmoon is a practical, powerful, free tool for autonomous security testing. It runs assessments while you sleep, finds vulnerabilities across multiple environments, and produces evidence-backed reports. It protects your data through a built-in privacy gateway.

The tool is open-source and transparent. It is designed with security experts in mind who will continuously conduct tests without the exorbitant cost of conducting manual engagements all the time.

Your next moves:

• Clone the repository
• Generate your AI API key
• Test Darkmoon on a staging environment
• Check the findings
• Patch the vulnerabilities
• Integrate Darkmoon into your CI/CD flow

There is no need to get breached first before you can test your defenses. Leave the work to Darkmoon to find your vulnerabilities.

FAQ Section

What is Darkmoon?

Darkmoon is an open-source AI-powered penetration testing platform that runs autonomous security assessments without human intervention.

Is Darkmoon really free?

Yes. It is released under the GPL-3.0 open-source license.

Is the data from Darkmoon sent to the external AI model?

No. Darkmoon uses a privacy gateway where real values are replaced by place holders and then sent to the AI model.

What does Darkmoon support testing for?

Web apps, APIs, Active Directory, Kubernetes, cloud, CMS, and internal networks.

Do I need pentesting experience to use Darkmoon?

No, Darkmoon automates the entire process. But you should verify the findings before taking action.

How long does an assessment take?

It varies depending on the target. Darkmoon can complete most assessments overnight.