redpearl-scanner 1.0.0

An advanced unprevileged, passive-aggressive and advanced stealth network scalpel.

RedPearl

version: 1.0.0

The Passive-Aggressive Dual-Stack Network Scalpel

RedPearl is an advanced, asynchronous network discovery and telemetry tool. Designed to operate primarily as a passive listener, it maps complex dual-stack (IPv4/IPv6) networks by analyzing multicast and broadcast traffic (mDNS, NetBIOS, LLMNR, SSDP, WS-Discovery). When operational parameters permit, RedPearl transitions into an "active-aggressive" state, deploying mathematically paced micro-engagements, unprivileged sweeps, and egress audits to validate network boundaries and extract high-value asset telemetry without triggering standard Intrusion Detection Systems (IDS). I built it as a tool to excel at the specific areas where sledgehammers like Nmap falls short, not to replace them but as a tool specifically for filling the weaknesses.

Disclaimer: Of course this tool is for educational purposes and authorized security testing only. Don't use this in infrastructure you don't own or don't have explicit permission to test. And I(the author) is not to be held accountable for any damage caused by this tool.

---

Usage

Launch it by:

• If you're cloning

python RedPearl.py

• If via pip:

redpearl

Console Commands

Within the redpearl> prompt, you can execute the scan command with various arguments to modify the engine's behavior:

• Standard Passive Run:

scan --interface eth0

• Active Kickstart & Egress Mapping:

scan --send-flare --resolve-mac --egraud

• Enterprise AD Profiling (Reverse Swarm):

scan --reverse-swarm --resolver 192.168.1.1

Argument Flags

Argument	Description
--interface <IP/Name>	Binds multicasts to a specific local interface (e.g., 0.0.0.0 or eth0).
--xufetch	Break pure passivity to fetch active UPnP HTTP descriptions.
--resolve-mac	Force neighbor table generation via asynchronous discovery bursts.
--aess AESS	External engine profile definitions path.
--send-flare	Transmit a non-aggressive, multi-stack mDNS service enumeration query to
--send-wsd-flare	Transmit an active WS-Discovery Probe query to flush out stealthy Windows targets.
--debug	Output stream allocation errors to standard error stream.
--reverse-swarm	Launch unprivileged inverse DNS PTR query swarms against discovered assets.
--resolver RESOLVER	Target IP of local gateway or primary DNS server to query for dynamic DHCP records.
--egraud	Launch the async outbound firewall egress path security auditor.
--egraud-target EGRAUD_TARGET	External public destination IP used for egress mapping.
--egraud-ports EGRAUD_PORTS	Comma-separated custom TCP ports to validate (e.g., 22,53,443,9001).

---

Author: nulsie License: GNU GPL v3