How mafifrizi/ares works
ARES is an operator-directed red-team engagement and continuous security-validation platform. The principal workflow is to authenticate and configure an engagement, discover and fingerprint targets, plan authorized attack steps, execute modules within scope, then validate and present findings. The graph also preserves the documented attack-path, collaboration, replay, reporting, and integration capabilities. Source excerpts are partial, so uncertain internal wiring is omitted; some capability branches are supported by the README and repository tree rather than sampled implementation.
Main entry points: core/engine.py Campaign Engine · server.py API Server · modules Attack Modules · goal/engine.py Goal Planner
Components 22
Operator Control
- Dashboard UI
frontend/src/App.tsx - API Server
ares/api/server.py - Identity & Sessions
ares/core/sso.py - Team Collaboration
ares/collab/manager.py
Discovery & Planning
- Target Fingerprinting
ares/fingerprint/engine.py - Service Intelligence
ares/service_intel/engine.py - Goal Planner
ares/goal/engine.py - Adaptive Strategy
ares/strategy/engine.py
Engagement Execution
- Attack Modules
ares/modules - Campaign Engine
ares/core/engine.py - Scope & Egress Guards
ares/core/scope_firewall.py - Distributed Workers
ares/worker/controller.py
Analysis & Evidence
- Artifact Correlation
ares/artifact_intel/engine.py - Attack Graph
ares/graph/attack_graph.py - Findings API
ares/api/findings.py - Report Generation
ares/modules/reporting/report_gen.py - Campaign Replay
ares/replay/engine.py
Platform Services
- Campaign Database
ares/db/database.py - MCP Interface
ares/mcp/server.py
Other components
- Operator
- Authorized Targets
- Optional LLM
Connections 29
- Operator → Dashboard UI: operates
- Dashboard UI → API Server: calls
- API Server → Identity & Sessions: authenticates
- API Server → Campaign Database: reads and writes
- API Server → Campaign Engine: dispatches engagement
- API Server → Findings API: serves findings
- API Server → Team Collaboration: coordinates operators
- Campaign Engine → Target Fingerprinting: fingerprints targets
- Target Fingerprinting → Authorized Targets: probes
- Campaign Engine → Service Intelligence: maps services
- Service Intelligence → Authorized Targets: scans ports
- Campaign Engine → Goal Planner: requests goal plan
- Adaptive Strategy → Goal Planner: requests execution plan
- Adaptive Strategy → Campaign Engine: dispatches modules
- Goal Planner → Attack Modules: selects steps
- Campaign Engine → Attack Modules: executes
- Campaign Engine → Scope & Egress Guards: enforces scope
- Attack Modules → Authorized Targets: performs authorized tests
- Campaign Engine → Distributed Workers: submits tasks
- Attack Modules → Artifact Correlation: produces artifacts
- Artifact Correlation → Attack Modules: queues follow-ups
- Artifact Correlation → Attack Graph: informs paths
- Campaign Engine → Findings API: validates findings
- Findings API → Report Generation: supplies evidence
- Campaign Engine → Campaign Database: persists campaign
- Campaign Database → Campaign Replay: provides history
- Dashboard UI → Attack Graph: visualizes paths
- MCP Interface → API Server: exposes tools
- Goal Planner → Optional LLM: may consult