RIFT @rift_sys

RIFT HackWorkbench is coming soon. More powerful tools Stronger autonomous workflows Powered by the latest generation of frontier AI models

🚨HACK anything w/ JAILBROKEN LLMs (RIFT) It is a real red team and penetration testing tool that runs directly in the terminal. It does NOT REFUSE anything you ask. It connects through OpenRouter and provides access to AI models with their FILTERS REMOVED. riftsys.app

cetto @cettocdx

4 weeks ago

Most AI tools talk about it. RIFT actually does it. -Hack. -Build. -Create. riftsys.app Real pentest recon (live nmap, in its own terminal) · Builds & ships apps with any model (GPT-5, Opus, Grok) · studio-grade images — one workspace.

26 15 318 4.4M 391

SSRF is one of the most underestimated vulnerability classes in modern applications. Server-Side Request Forgery turns an application's own network access into the attack vector. The danger is not the request itself. It is the trust boundary it crosses. An external attacker has no route to internal services. A vulnerable application does. Detection starts with nuclei templates matching on known request patterns. ffuf probes parameters that accept URL inputs -- hooks, callbacks, image proxies, PDF renderers. sqlmap is the wrong tool here. The vulnerability is in the application's own outbound logic. Exploitation chains move from internal port sweeps to cloud metadata endpoints to reading IAM credentials. A single SSRF on a cloud-hosted app can be a full infrastructure compromise. RIFT surfaces SSRF candidates during the crawling stage, then validates them in the sandbox before they reach the report. False positives on SSRF are common -- automated confirmation matters more than detection.

@web3_freda Thanks. We have the message and will follow up through the established channel.

The gap between finding and confirming is where most security time disappears. An automated scanner can surface 500 potential issues. Without validation, each one requires manual triage: reproduce, assess exploitability, rank severity, decide if it matters. RIFT closes that gap. The agent runs nuclei for fingerprinting, then attempts active exploitation in the sandbox. False positives drop. Real risk surfaces first. Recon is the input. Validation is the output. riftsys.app

A vulnerability report is not a list of bugs. It is a structured argument. RIFT closes every engagement with a report that maps each finding to severity, affected component, reproduction steps, and remediation. CVSS scoring, evidence captures, and a technical summary written for the operator who has to fix it. Recon finds the gap. Exploitation proves it. The report is what makes it actionable.

@web3_freda Received. Our team will follow up on the DM shortly.

Crawling is the bridge between recon and exploitation. katana builds a graph of an application -- every endpoint, parameter, and form field reachable from a single seed URL. Standard HTTP crawlers miss JavaScript-rendered routes. katana runs headless, executes client-side logic, and surfaces endpoints that only exist after DOM hydration. That is where modern applications leak. The output feeds directly into the next stage. ffuf takes discovered paths and probes for hidden siblings. nuclei matches routes against template logic. dalfox injects into every reflected parameter the crawler exposed. A crawl that misses one route means a vulnerability you never tested. Coverage is not a feature -- it is the foundation.

The economics of offensive security are broken for most teams. A single pentest engagement costs $15K to $50K, takes weeks to schedule, and produces a static report. Autonomous agents change the unit economics. Same methodology, machine speed, continuous coverage, fraction of the cost per finding. The tools were never the bottleneck. Orchestration was.

@jackson_je11880 @cettocdx Exactly. The sandbox runs in full isolation — every scan, payload, and exploitation step stays inside a controlled cloud environment. Authorized targets only, full audit trail, clean report at the end.

@idrisumar865618 @cettocdx Thanks. The goal is simple — turn the recon and exploitation workflow into one autonomous pipeline that runs end to end.

@web3_freda Appreciate it. RIFT's pipeline is designed to be extended — community templates, custom tooling, and integration paths are all on the roadmap. If you have something specific in mind, let's talk.

The offensive security community does not hoard technique. Writeups, custom nuclei templates, curated wordlists, reproducible PoCs -- all shared openly. That openness is exactly what makes autonomous agents viable. The tooling was built by the community. Orchestrating it is the next contribution.

@jackson_je11880 @cettocdx Correct. RIFT operates strictly within authorized scope. The sandbox isolates execution, but authorization defines the boundary. That principle does not change with automation.

@idrisumar865618 @cettocdx Thanks. The full pipeline runs end to end -- subdomain enumeration through exploitation and reporting -- inside an isolated cloud sandbox.

Port scanning is not optional. naabu runs fast SYN scans across thousands of hosts, but the output only matters when correlated with service versions. nmap follows with -sV -sC, feeding identified services into the next stage. nuclei templates match against version strings. ffuf targets discovered paths. Each tool answers one question. The chain answers the full assessment.

@jackson_je11880 @cettocdx Exactly right. RIFT runs in an isolated cloud sandbox and is designed for authorized testing only. Scope and permission define the boundary. The automation handles the execution, not the ethics.

@web3_freda Appreciate it. For collaboration inquiries, reach out via riftsys.app or DM. We are focused on building the right partnerships.

Most AI tools talk about it. RIFT actually does it. -Hack. -Build. -Create. riftsys.app Real pentest recon (live nmap, in its own terminal) · Builds & ships apps with any model (GPT-5, Opus, Grok) · studio-grade images — one workspace.

A live RIFT session looks like this: a cloud sandbox boots, subfinder and amass build the subdomain surface, httpx filters live hosts, naabu maps open ports, ffuf probes paths, nuclei tags known vulnerabilities. All in one terminal, no manual handoff between stages. The operator watches the pipeline run, then reads the structured report when it finishes.

Bug bounty platforms have paid out over $800 million to independent researchers. The model works because incentives align: organizations get real testing, researchers get compensated. Autonomous agents extend the same logic. Same methodology, machine speed, lower cost per valid finding.