Cascavel is a zero-friction Continuous Threat Exposure Management (CTEM) engine. It orchestrates complex attack chains, enriches findings with Threat Intel (EPSS/CISA KEV), generates AI-driven remediation, and exports native telemetry (OCSF) in a single command.
🌐 cascavel.pages.dev · 🇺🇸 English · 🇧🇷 Português (Brasil)
Standard vulnerability management causes critical alert fatigue. Security Operations Centers (SOC) analysts waste hours triaging non-exploitable findings from dozens of non-integrated tools that output incompatible proprietary formats.
Cascavel v3.0 shifts organizations from reactive vulnerability management to a proactive, risk-based Continuous Threat Exposure Management (CTEM) program. By bridging the gap between business strategy and technical execution, Cascavel ensures that security teams only focus on exposures that pose a credible, reachable risk to the business.
Cascavel natively automates Gartner’s five-stage CTEM framework into a single executable pipeline:
Unlike traditional tools that rely on hardcoded parameters, Cascavel's Dynamic Spidering Engine automatically crawls the target infrastructure (APIs, SaaS integrations, Cloud workloads), mapping forms, headers, and query strings dynamically to construct an accurate attack surface.
Generic CVSS scores are obsolete. Cascavel enriches every discovered exposure with real-world threat intelligence:
- FIRST.org EPSS (Exploit Prediction Scoring System): Calculates the actual probability of exploitation in the wild within 30 days.
- CISA KEV (Known Exploited Vulnerabilities): Cross-references exposures against active APT/Ransomware campaigns.
The Adversarial Exposure Validation (AEV) engine drops False Positives to near-zero. Cascavel establishes Global Baselines for network latency and WAF behaviors before scanning. Using Multi-Stage Validation (like Content-Type boundary checking), it only reports vulnerabilities that are mathematically and contextually exploitable.
Instead of dumping JSON files, Cascavel generates AI-driven remediation payloads. Using the --ai-fix flag, it synthesizes contextual Bash scripts, Python mitigations, or Kubernetes manifests to patch the exact exposure discovered.
Cascavel exports native OCSF (Open Cybersecurity Schema Framework) v1.1.0 telemetry, ensuring immediate compatibility with modern SIEMs (Splunk, Elastic, AWS Security Lake) without custom parsers.
Cinematic AEV Boot Sequence · Real-time Threat Preloader · Stealth Simulation
Interactive CTEM Dashboard · EPSS Tracking · CISA KEV Cross-Correlation
Cascavel v3.0 uses an Omni-Distribution Pipeline. It is built, signed, and published across multiple ecosystems simultaneously with SLSA Level 3 Provenance and Cosign cryptographic signatures.
The installer is engineered under a strict 2026 Threat Model, guaranteeing total dependency isolation and preventing supply chain RCE.
Does not require git. Compatible with macOS, Linux, Windows, WSL2, and Docker.
# Linux/macOS
curl -sL https://github.com/glferreira-devsecops/Cascavel/releases/latest/download/cascavel-linux -o cascavel
chmod +x cascavel && ./cascavel --helpdocker pull ghcr.io/glferreira-devsecops/cascavel:latest
docker run --rm -it ghcr.io/glferreira-devsecops/cascavel -t target.comnpx cascavel-ctem -t target.compip install cascavel-ctem
cascavel -t target.com| Defense Mechanism | Security Outcome |
|---|---|
| Hermetic Environment | Isolates via virtualenv (mktemp -d) preventing OS-level conflicts. |
| Zero Supply Chain | Enforces integrity via hardcoded SHA-256 hashes in requirements.txt. |
| TOCTOU Prevention | Uses anti-symlink locks and strict umask 077 permissions. |
| Clean Exit Hooks | POSIX trap handlers ensure secure deletion of /tmp artifacts on exit. |
| $PATH Isolation | Prevents Binary Hijacking by stripping relative . entries from PATH. |
The terminal API is designed to be highly tactical and straightforward.
# Full CTEM Scan (Integrates external binaries + plugins)
cascavel -t target.com
# Stealth Mode: SOC/WAF bypass simulation (Ignores noisy binaries)
cascavel -t target.com --plugins-only --stealth-eval
# Autonomous Workflow: CISA KEV + AI Remediation + OCSF Telemetry
cascavel -t target.com -o ocsf --ai-fix
# Executive Workflow: Generate Legal PDF Report (CVSS v4, ISO 27001)
cascavel -t target.com --pdf
# Surgical Plugin Filter: Run only specific plugins
cascavel -t target.com --plugins-only --plugin-filter sqli_scanner xss_scanner
# CI/CD Integration: Silent Headless Mode
cascavel -t target.com -q -o jsonAdd this as a blocking security gate in your .github/workflows/ctem.yml:
name: "Cascavel AEV Pipeline"
on: [push, pull_request]
jobs:
validate-exposure:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install
run: curl -sL https://github.com/glferreira-devsecops/Cascavel/releases/latest/download/cascavel-linux -o cascavel && chmod +x cascavel
- name: Execute CTEM (OCSF + AI Fixes)
run: ./cascavel -t staging.internal -q -o ocsf --ai-fix
- name: Upload Telemetry
uses: actions/upload-artifact@v4
with:
name: ocsf-logs
path: exports/*.jsonlOur architecture prioritizes the absolute elimination of false positives via AST parsing and deep semantic detection.
cascavel/ (modular package)
├── Stealth Engine ─────────── Requests Hooks, X-COST headers, WAF Rate-Limit Bypass
├── Threat Intel Analyzer ──── Dynamic EPSS (FIRST) and CISA KEV Mapping
├── AI Fix Module ──────────── Sandbox Generation of Mitigation Scripts (Bash/Python)
├── OCSF Telemetry ─────────── EventUID 2002 Export (Linux Foundation Standard)
├── ANSI/Regex Sanitizer ───── Anti-Terminal Injection (CSI/OSC), Anti-ReDoS mitigation
└── PDF Engine ─────────────── Auditable ReportLab PDFs (SHA-256 Checksums)
- Injection & Code Exec (7):
xss_scanner,sqli_scanner,ssti_scanner,rce_scanner,nosql_scanner... - Cloud & K8s Infra (8):
cloud_metadata(SSRF via 169.254.x),docker_exposure,s3_bucket_enum... - Authentication (6):
jwt_analyzer(Alg Bypass, Null Signature),oauth_scanner,idor_scanner... - Defense Bypass (7):
cors_checker,csp_bypass,waf_evasion,cache_poisoning... - API Logic Attacks (6):
graphql_probe,mass_assignment,api_versioning... - OSINT and Recon (11):
shodan_recon,dns_rebinding,subdomain_takeover...
For the complete matrix of vectors and pre-calculated CVSS severities, consult our Plugin Documentation.
An offensive engine must be immune to retaliation. Cascavel shields its host from traps laid by Blue Teams in HoneyPots, while enforcing rigorous CI/CD supply-chain security.
| Retaliation Vector | Core Defensive Mitigation |
|---|---|
| Terminal Injection (ANSI) | Strict Regex filters remove malicious Escape payloads (CSI/OSC/DCS), preventing terminal clipboard hijacking. |
| Command Injection (OS) | Mandates -- binary delimiters and blocks native variables in subprocess.run(shell=False). |
| Server-Side Request Forgery | Internal IP lock (169.254.x) prevents malicious instances from rebounding attacks. redirects=False strictly enforced. |
| Path Traversal Sandboxing | Utlizes pathlib.resolve().is_relative_to() ensuring total containment of OCSF logs and Reports. |
| Arbitrary Deserialization | Rejects pickle functions and globally enforces yaml.safe_load(). |
Cascavel's own CI/CD pipeline is a fortress:
- Unmasked SAST: 100% of the codebase is audited by Semgrep, Bandit, and TruffleHog without exclusion filters (
--exclude-rulegranular approach). - Zizmor Hardened: GitHub Actions workflows are mathematically verified against cache-poisoning, unpinned actions, and privilege escalation vectors.
- Cryptographic Signatures: All Omni-Distribution releases are signed via Sigstore/Cosign.
Rigid rules ensure Framework integrity:
- All code must pass the Mypy Type Hinting pipeline.
- PEP8 (Ruff) compliance is non-negotiable.
- No arbitrary external packages allowed, preventing dependency chain contamination.
- Read CONTRIBUTING.md and the Security Policy.
Cascavel is classified as "Dual-Use". The author repudiates its usage against unauthorized assets.
CASCAVEL METHOD
Engineered and maintained by DevFerreiraG
GitHub Profile