RAVEN

(formerly REAVER)

Reconnaissance & Attack on Vulnerable Elasticsearch Nodes

RAVEN is a modular offensive security testing framework for Elasticsearch (port 9200) and Kibana (port 5601). It provides reconnaissance, exploitation, and data exfiltration capabilities against vulnerable Elastic Stack deployments. Modeled on ODAT (Oracle Database Attacking Tool), RAVEN uses a plugin-based architecture where each attack vector is an independent module. This is a personal open-source project for authorized security testing only.

Disclaimer

RAVEN is designed for authorized penetration testing and security research only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal and unethical. The author assumes no liability for misuse. Use of destructive modules requires explicit arming flags and scope files to prevent accidental damage. All write operations are logged for cleanup and evidence preservation.

Features

Reconnaissance

• fingerprint - Identify Elasticsearch version, cluster name, and build information
• recon - Enumerate cluster health, node roles, plugins, and configuration
• indices - List all indices with sizes, document counts, and health status
• search - Query indices and extract sensitive data patterns (credentials, API keys, secrets)

Access Acquisition

• anonymous - Detect and enumerate anonymous access to Elasticsearch
• bruteforce - Credential brute-force against HTTP basic authentication

Exploitation

• scripting - Execute code via MVEL, Groovy, or Painless scripting engines (version-gated RCE)
• snapshot - Abuse snapshot API for arbitrary file read and data exfiltration
• privesc - Privilege escalation reconnaissance and exploitation
• apikey - Create API keys for persistence and privilege escalation

Data Exfiltration

• exfil - Bulk exfiltration of indices to local JSON/CSV files
• snapshot - Snapshot indices to rogue repositories for offline analysis

Kibana Pivot

• kb-recon - Enumerate Kibana version, plugins, and configured data sources
• kb-loot - Extract Kibana saved objects, dashboards, and embedded credentials
• kb-cve - Exploit known Kibana CVEs with version-gated checks

Destructive Testing

• destroy - Delete indices, snapshots, or cluster data (requires arming)
• dos - Denial-of-service via resource exhaustion (requires arming)
• persist - Establish persistence via API keys, backdoor users, or index poisoning (requires arming)
• clean - Reverse all RAVEN changes by processing activity logs

Reporting

• all - Run comprehensive reconnaissance and generate reports automatically

Installation

From Source (Recommended for Security Tools)

git clone https://github.com/karlvbiron/raven
cd raven
python3 -m venv .venv
source .venv/bin/activate
pip install -e .

Verify installation:

raven-es --help

For development and testing:

pip install pytest pytest-timeout
pytest tests/unit/ -q

Quick Start

The following demonstrates read-only reconnaissance against a target. Destructive modules require additional safety flags (see --help for each module).

# Fingerprint the target
raven-es -t localhost:9200 fingerprint

# Enumerate cluster configuration
raven-es -t localhost:9200 recon

# List indices and document counts
raven-es -t localhost:9200 indices

# Search for secrets in indices
raven-es -t localhost:9200 search --index logs --grep-secrets

# Generate a comprehensive report
raven-es -t localhost:9200 all --output-dir ./loot

Expected output:

• fingerprint - Version number, cluster name, build hash
• recon - Cluster health (green/yellow/red), node count, plugin list
• indices - Table of indices with sizes and document counts
• search - Extracted secrets with pattern matches (AWS keys, JWTs, passwords)
• all - Markdown and HTML reports in the output directory

Lab Environment

RAVEN includes a Docker-based lab environment in lab/targets/ for testing and development. Each target is self-contained with its own docker-compose.yml. The MAIN target includes planted secrets, misconfigurations, and vulnerable versions for demonstrating all modules. Start a target with docker compose up from its directory. See docs/lab-guide.md for the complete lab map and module-to-target mappings.

Module Reference

Module	Category	Description
fingerprint	recon	Identify Elasticsearch version and cluster information
recon	recon	Enumerate cluster health, nodes, plugins
indices	recon	List indices with sizes and document counts
search	recon	Query indices and extract secrets
anonymous	access	Test for anonymous access
bruteforce	access	Brute-force HTTP basic authentication
scripting	exploit	Execute code via scripting engines (MVEL/Groovy/Painless)
snapshot	exfil	Snapshot abuse for file read and data exfiltration
exfil	exfil	Bulk exfiltration to JSON/CSV
privesc	exploit	Privilege escalation reconnaissance
apikey	exploit	API key creation for persistence
kb-recon	pivot	Enumerate Kibana version and configuration
kb-loot	pivot	Extract Kibana saved objects and credentials
kb-cve	pivot	Exploit Kibana CVEs
destroy	destructive	Delete indices or cluster data (requires arming)
dos	destructive	Resource exhaustion attacks (requires arming)
persist	destructive	Establish persistence mechanisms (requires arming)
clean	cleanup	Reverse all RAVEN changes via activity logs
all	orchestration	Run full reconnaissance and reporting workflow

Related Projects

MAD-CAT

https://github.com/karlvbiron/MAD-CAT

Meow Attack Data Corruption Automation Tool for NoSQL databases. RAVEN + MAD-CAT form a complete find-and-destroy pipeline for engagement scenarios requiring data corruption verification.

MATRIX

https://github.com/karlvbiron/MATRIX

Modbus Attack Tool for Remote Industrial eXploitation. ICS/SCADA offensive testing framework for Modbus TCP/RTU protocol exploitation.

License

BSD-3-Clause

Copyright (c) 2025, karlvbiron

See LICENSE for full text.