   _____ _          _ ____  ___            
  / ____| |        | | |  \/  |            
  \ `--.| | ___   _| | | .  . | __ _ _ __  
   `--. \ |/ / | | | | | |\/| |/ _` | '_ \ 
  /\__/ /   <| |_| | | | |  | | (_| | |_) |
  \____/|_|\_\\__,_|_|_\_|  |_/\__,_| .__/ 
                                     | |    
                                     |_|

SkullMap v2.0.3

Multi-Cloud Attack Chain Intelligence Tool

"See the full attack chain before the attacker does — across every cloud."

SkullMap Live Dashboard

🚀 Installation

pip install skullmap

Or from source:

git clone https://github.com/Talha-Imran-cloud/skullmap
cd skullmap
pip install -r requirements.txt

🖥️ Live Web Dashboard

# Run a real scan and open the results as a live HTML dashboard in your browser
skullmap dashboard --project my-gcp-project

# Auto-refresh dashboard every 5 minutes (keeps re-scanning)
skullmap dashboard --project my-gcp-project --live --interval 300

Dashboard shows:

📊 Risk score, critical/high findings, attack chain count
🔗 Active attack chains with full paths
🔍 Recent findings table with severity
💰 Live breach cost estimate
🔐 Zero Trust score
🕐 Auto-updating timestamp — no server setup, opens straight from reports/

🔥 What is SkullMap?

SkullMap is the world's first Multi-Cloud Attack Chain Intelligence Tool with 50+ unique features that:

🔗 Discovers attack chains — not just individual misconfigurations
🧠 AI-powered narratives — tells the full attacker story in human language
💀 Multi-cloud coverage — GCP, AWS, Azure, Oracle Cloud, Kubernetes
⚡ Real-time monitoring — live watch mode with instant alerts
🎯 Bug bounty ready — CVSS scores and HackerOne/Bugcrowd format reports
🔐 Zero Trust assessment — NIST SP 800-207 based scoring
💥 Blast Radius Calculator — domino effect of any breach
💰 Breach Cost Estimator — financial impact in dollars
🪞 Digital Twin — simulate attacks on virtual copy, real infra untouched
⚔️ Red vs Blue Simulator — live battle simulation on your infra

No other tool combines all 50 features in one place.

☁️ Supported Clouds

Cloud	Status	Features
☁️ Google Cloud (GCP)	✅ Full Support	Storage, IAM, Functions, Compute
🟡 AWS	✅ Full Support	S3, IAM, Lambda, Security Groups, CloudTrail
🔵 Azure	✅ Full Support	Storage, RBAC, Functions, Key Vault, NSG
🟠 Oracle Cloud	✅ Full Support	Object Storage, IAM, Network, Compute
⚙️ Kubernetes	✅ Full Support	Dashboard, RBAC, Pods, Secrets, Network
🔴 Cross-Cloud	✅ Full Support	GCP + AWS + Azure combined chains

💀 All 50 Features + Commands

🔗 Core Engine — 5 Features

#	Feature	Command	Description
1	Chain Discovery	`scan --project` (auto)	Links misconfigs into multi-step attack paths
2	Visual Kill Chain Graph	`scan --project` (auto)	S3 → Lambda → RDS → EC2 visual map
3	Risk Scoring	`scan --project` (auto)	0-100 risk score per chain
4	Chain DNA Fingerprint	`--dna`	SHA fingerprint + real-world breach matching
5	Smart Fix / Max Disruption	`--optimize`	One fix that breaks maximum chains

skullmap scan --project my-gcp-project
skullmap scan --project my-gcp-project --dna
skullmap scan --project my-gcp-project --optimize

🧠 AI Features — 6 Features

#	Feature	Command	Description
6	AI Attack Narrative	`--ai`	Full attacker story in human language
7	Attacker Persona Mode	`--ai --persona apt`	Script kiddie, APT, ransomware perspectives
8	Predictive AI	`--predict`	Minority Report — next attack steps
9	Attacker Brain Simulator	`--brain`	AI simulates attacker's actual thinking
10	AI Security Chat	`chat`	Interactive AI security consultant
11	NLP Natural Language Scan	`--nlp`	Ask security questions in plain English

skullmap scan --project my-gcp-project --ai
skullmap scan --project my-gcp-project --ai --persona apt
skullmap scan --project my-gcp-project --ai --persona ransomware
skullmap scan --project my-gcp-project --ai --persona script_kiddie
skullmap scan --project my-gcp-project --predict
skullmap scan --project my-gcp-project --brain
skullmap chat --project my-gcp-project
skullmap scan --project my-gcp-project --nlp

💥 Unique Features — 10 Features

#	Feature	Command	Description
12	Blast Radius Calculator	`--blast-radius`	Domino effect — what else breaks after breach
13	Breach Cost Estimator	`--breach-cost`	GDPR fines, downtime, legal costs in $
14	Security Posture Timeline	`--timeline`	ASCII graph of security score over time
15	Digital Twin Simulator	`--twin`	Clone infra, simulate attacks safely
16	Red vs Blue Simulator	`--simulate`	Live battle — see where defenses fail
17	Dark Web Monitor	`dark-web`	Check emails, domain, IPs on dark web
18	Gamification / XP System	`--gamify`	Level up security — XP, achievements, ranks
19	Geo Attack Tracker	`--geo`	Real-time attacker IP location mapping
20	Evidence Generator	`--evidence`	Court-ready HTML/PDF/JSON reports
21	GitHub PR Auto Review	`pr-review`	Auto security scan — blocks dangerous PRs

skullmap scan --project my-gcp-project --blast-radius
skullmap scan --project my-gcp-project --breach-cost
skullmap scan --project my-gcp-project --timeline
skullmap scan --project my-gcp-project --twin
skullmap scan --project my-gcp-project --simulate
skullmap dark-web --domain mycompany.com --emails admin@mycompany.com
skullmap scan --project my-gcp-project --gamify
skullmap scan --project my-gcp-project --geo
skullmap scan --project my-gcp-project --evidence
skullmap pr-review --repo owner/repo --pr 42

💰 Business Intelligence — 5 Features

#	Feature	Command	Description
22	Attacker Economics Engine	`--economics`	Financial ROI per attack chain
23	Executive Dashboard	`--executive`	One-page CISO/CEO report
24	Industry Benchmark	`--benchmark --industry`	Compare vs industry average
25	Bug Bounty Mode	`--bounty --target`	CVSS + HackerOne/Bugcrowd format
26	Compliance Blast Radius	`--blast-radius`	SOC2, ISO27001, GDPR, PCI DSS status

skullmap scan --project my-gcp-project --economics
skullmap scan --project my-gcp-project --executive
skullmap scan --project my-gcp-project --benchmark --industry fintech
skullmap scan --project my-gcp-project --benchmark --industry healthcare
skullmap scan --project my-gcp-project --benchmark --industry saas
skullmap scan --project my-gcp-project --bounty --target "company-name"
skullmap scan --project my-gcp-project --blast-radius

🔐 Advanced Security — 5 Features

#	Feature	Command	Description
27	Zero Trust Score	`--zero-trust`	NIST SP 800-207 — 6 pillars assessment
28	Dark Web Linker	`--darkweb --emails`	Leaked creds merged into attack chains
29	Supply Chain Scanner	`--supply-chain`	Secrets, packages, IaC, GitHub Actions
30	Attack Probability Heatmap	`--heatmap`	Which resource gets attacked first (%)
31	Attack Replay Timeline	`--replay`	Cinematic timeline — minute by minute

skullmap scan --project my-gcp-project --zero-trust
skullmap scan --project my-gcp-project --darkweb --emails admin@company.com
skullmap scan --project my-gcp-project --supply-chain
skullmap supply --path ./my-project
skullmap scan --project my-gcp-project --heatmap
skullmap scan --project my-gcp-project --replay

📡 Monitoring & Alerts — 6 Features

#	Feature	Command	Description
32	Live Watch Mode	`watch`	Continuous scan every X minutes
33	Live Threat Intelligence	`monitor`	Live threat feed + IP reputation
34	Slack War Room	`--slack`	Real-time Slack notifications
35	Teams Alerts	`--teams`	Microsoft Teams blast
36	Telegram Alerts	`--telegram`	Instant mobile Telegram notifications
37	WhatsApp Alerts	`--whatsapp`	Twilio WhatsApp alerts

skullmap watch --project my-gcp-project --interval 300
skullmap monitor --project my-gcp-project --interval 60
skullmap scan --project my-gcp-project --slack
skullmap scan --project my-gcp-project --teams
skullmap scan --project my-gcp-project --telegram
skullmap scan --project my-gcp-project --whatsapp
skullmap scan --project my-gcp-project --slack --teams --telegram --whatsapp

☁️ Cloud Coverage — 6 Features

#	Feature	Command	Description
38	GCP Scanner	`scan --project`	Storage, IAM, Functions, Compute
39	AWS Scanner	`aws-scan --region`	S3, IAM, Lambda, Security Groups, CloudTrail
40	Azure Scanner	`azure-scan --subscription`	Storage, RBAC, Functions, Key Vault, NSG
41	Oracle Cloud Scanner	`oracle-scan --tenancy`	Object Storage, IAM, Network, Compute
42	Kubernetes Scanner	`scan --project --k8s`	Dashboard, RBAC, Pods, Secrets, Network
43	Cross-Cloud Scanner	`cross-scan`	GCP + AWS + Azure combined chains

skullmap scan --project my-gcp-project-id
skullmap aws-scan --region us-east-1
skullmap aws-scan --region eu-west-1 --profile my-profile
skullmap azure-scan --subscription my-subscription-id
skullmap oracle-scan --tenancy my-tenancy-id --region us-ashburn-1
skullmap scan --project my-gcp-project --k8s
skullmap cross-scan \
  --project my-gcp-project \
  --subscription my-azure-sub \
  --region us-east-1

🛠️ Tools — 5 Features

#	Feature	Command	Description
44	Auto-Retest Engine	`retest`	Before/after fix comparison — audit proof
45	Security Training Mode	`train`	AI lessons + quiz on 8 security topics
46	Chain Evolution Tracker	`watch` (auto)	How chains grow over time
47	Attack Simulation Timer	auto in results	Beginner → APT exploit time estimates
48	Attacker Economics ROI	`--economics`	$ ROI per minute for attacker

skullmap retest --project my-gcp-project --cloud gcp
skullmap retest --project my-aws --cloud aws
skullmap train
skullmap watch --project my-gcp-project --interval 300
skullmap scan --project my-gcp-project --economics

📖 Complete Command Reference

skullmap --help

Commands:
  scan          💀 Scan GCP project for attack chains
  aws-scan      🟡 Scan AWS account for attack chains
  azure-scan    🔵 Scan Azure subscription for attack chains
  oracle-scan   🟠 Scan Oracle Cloud for attack chains
  cross-scan    🔴 Cross-cloud scan — GCP + AWS + Azure
  auth-test     🔓 Unauthenticated access tester — all clouds
  dashboard     🖥️  Live web dashboard from a real scan
  watch         👁  Watch GCP project continuously
  monitor       📡 Live threat intelligence monitoring
  chat          🤖 AI security chat
  ask           💬 Natural language scanner
  train         🎓 Security training mode
  retest        🔄 Auto-retest after applying fixes
  supply        🌐 Supply chain security scan
  pr-review     🔍 GitHub PR security review
  dark-web      🌑 Dark web asset monitor
  twin          🪞 Digital twin simulator
  simulate      ⚔️  Red vs Blue team simulator
  timeline      📈 Security posture timeline
  profile       🎮 Gamification profile and XP
  evidence      📋 Court-ready evidence report
  geo           🗺️  Geo-location attack tracker
  blast         💥 Blast radius calculator info
  breach-cost   💰 Breach cost estimator info
  version       📌 Show version

Full `scan` Options

skullmap scan --project PROJECT_ID [OPTIONS]

# ── Cloud Options ──────────────────────────────
  -p, --project TEXT          GCP Project ID [required]
  -w, --watch                 Enable watch mode
  -i, --interval INT          Watch interval seconds (default: 300)
  --k8s                       Include Kubernetes scan

# ── AI Options ────────────────────────────────
  --ai                        AI attack narrative
  --persona [script_kiddie|apt|ransomware]
  --predict                   Predict next attack steps
  --brain                     Attacker brain simulator
  --chat                      AI security chat
  --nlp                       Natural language scan

# ── Security Analysis ─────────────────────────
  --dna                       Chain DNA fingerprint
  --optimize                  Max chain disruption fix
  --replay                    Attack replay timeline
  --heatmap                   Attack probability heatmap
  --zero-trust                Zero trust assessment
  --supply-chain              Supply chain scan
  --darkweb                   Dark web credential check
  -e, --emails TEXT           Emails to check on dark web

# ── Unique Features ───────────────────────────
  --blast-radius              Blast radius calculator
  --breach-cost               Breach cost estimator
  --timeline                  Security posture timeline
  --twin                      Digital twin simulation
  --simulate                  Red vs Blue simulation
  --gamify                    Gamification / XP system
  --geo                       Geo attack tracker
  --evidence                  Evidence generator

# ── Business Intelligence ─────────────────────
  --economics                 Attacker economics engine
  --executive                 Executive dashboard
  --benchmark                 Industry benchmark
  --industry TEXT             Industry (fintech/healthcare/saas/ecommerce/government/general)
  --bounty                    Bug bounty mode
  -t, --target TEXT           Bounty target name
  --threat-intel              Live threat intelligence

# ── Alerts ────────────────────────────────────
  --slack                     Slack alerts
  --teams                     Teams alerts
  --telegram                  Telegram alerts
  --whatsapp                  WhatsApp alerts

# ── Other ─────────────────────────────────────
  --retest                    Auto retest after fix
  -o, --output TEXT           Output directory (default: reports)

🔓 Unauthenticated Access Tester — 2 Features

The only tool that tests your cloud from an attacker's perspective — NO credentials needed.

#	Feature	Command	Description
49	Multi-Cloud Auth Tester	`auth-test`	Public buckets, unauth APIs, Firebase, metadata, S3, Cognito, Azure Blob, OCI
50	Live Web Dashboard	`dashboard`	Real scan results in browser — Risk score, chains, breach cost live

# GCP — public buckets, Cloud Functions, Firebase, metadata server
skullmap auth-test --project my-gcp-project

# AWS — public S3, EC2 metadata, Lambda URLs, Cognito misconfig
skullmap auth-test --region us-east-1

# Azure — public Blob storage, App Services, Key Vault
skullmap auth-test --subscription my-azure-subscription-id

# Oracle — public Object Storage, API Gateway, Identity API
skullmap auth-test --tenancy my-oracle-tenancy-id

# ALL clouds at once — full unauthenticated sweep
skullmap auth-test --project my-gcp --region us-east-1 \
  --subscription my-azure-sub --tenancy my-oracle-tenancy --all-clouds

# Live Web Dashboard — real scan → browser
skullmap dashboard --project my-gcp-project

# Live Dashboard with auto-refresh every 5 minutes
skullmap dashboard --project my-gcp-project --live --interval 300

What Auth Tester checks:

🪣 Public cloud storage buckets (GCS, S3, Azure Blob, OCI)
⚡ Unauthenticated Cloud Functions / Lambda / Azure Functions
🔥 Firebase Realtime Database open access
🖥️ Cloud metadata servers (SSRF risk)
🔑 Exposed service account key files
🆔 Cognito self-registration misconfig
🔐 Key Vault / Secrets exposure
📁 Exposed .env / credentials files in public storage

💡 Power User Examples

# Full GCP scan — all features
skullmap scan --project my-gcp-project \
  --ai --predict --brain --economics --dna \
  --executive --zero-trust --heatmap --replay \
  --blast-radius --breach-cost --evidence \
  --slack --telegram

# Bug bounty mode
skullmap scan --project my-gcp-project \
  --bounty --target "company-name" --dna --evidence

# APT simulation
skullmap scan --project my-gcp-project \
  --ai --persona apt --brain --replay --twin

# Full AWS scan
skullmap aws-scan --region us-east-1 \
  --ai --economics --zero-trust --heatmap \
  --benchmark --industry fintech

# Cross-cloud everything
skullmap cross-scan \
  --project my-gcp \
  --subscription my-azure-sub \
  --region us-east-1 \
  --ai --economics --executive \
  --blast-radius --zero-trust \
  --slack --telegram

# Live web dashboard
skullmap dashboard

# Digital twin + Red vs Blue
skullmap scan --project my-gcp-project --twin --simulate

# Dark web + supply chain
skullmap scan --project my-gcp-project \
  --darkweb --emails admin@company.com \
  --supply-chain --evidence

# Security training
skullmap train

# AI chat
skullmap chat --project my-gcp-project

# Live threat monitoring
skullmap monitor --project my-gcp-project --interval 60

# Industry benchmark
skullmap scan --project my-gcp-project \
  --benchmark --industry fintech

⚙️ Configuration (.env)

# GCP
GCP_PROJECT_ID=your-project-id
GOOGLE_APPLICATION_CREDENTIALS=path/to/gcp-key.json

# AWS
AWS_ACCESS_KEY_ID=your-key-id
AWS_SECRET_ACCESS_KEY=your-secret-key
AWS_REGION=us-east-1

# Azure
AZURE_SUBSCRIPTION_ID=your-subscription-id
AZURE_TENANT_ID=your-tenant-id
AZURE_CLIENT_ID=your-client-id
AZURE_CLIENT_SECRET=your-client-secret

# Oracle
ORACLE_TENANCY_ID=your-tenancy-id
ORACLE_USER_ID=your-user-id
ORACLE_FINGERPRINT=your-fingerprint
ORACLE_KEY_FILE=path/to/oracle-key.pem
ORACLE_REGION=us-ashburn-1

# AI
GEMINI_API_KEY=your-gemini-key

# Alerts
SLACK_WEBHOOK_URL=https://hooks.slack.com/...
TEAMS_WEBHOOK_URL=https://outlook.office.com/...
TELEGRAM_BOT_TOKEN=your-bot-token
TELEGRAM_CHAT_ID=your-chat-id
TWILIO_ACCOUNT_SID=your-account-sid
TWILIO_AUTH_TOKEN=your-auth-token
TWILIO_WHATSAPP_FROM=+14155238886
TWILIO_WHATSAPP_TO=+923001234567

# GitHub
GITHUB_TOKEN=your-github-token

# Dark Web
HIBP_API_KEY=your-hibp-key

# New Features
TIMELINE_FILE=reports/.skull_timeline.json
PROFILE_FILE=reports/.skull_profile.json
EVIDENCE_DIR=reports/evidence
GEO_API_KEY=

# Scan Settings
WATCH_INTERVAL=300
OUTPUT_DIR=reports

📁 Project Structure

skullmap/
├── cli/
│   ├── scanner/
│   │   ├── gcp_scanner.py          # GCP scanner
│   │   ├── aws_scanner.py          # AWS scanner
│   │   ├── azure_scanner.py        # Azure scanner
│   │   ├── oracle_scanner.py       # Oracle scanner
│   │   ├── k8s_scanner.py          # Kubernetes scanner
│   │   └── live_watch.py           # Watch mode
│   ├── engine/
│   │   ├── chain_builder.py        # Attack chain discovery
│   │   ├── risk_scorer.py          # Risk scoring
│   │   ├── economics.py            # Attacker economics
│   │   ├── chain_dna.py            # DNA fingerprinting
│   │   ├── smart_fix.py            # Auto-remediation
│   │   ├── replay_timeline.py      # Attack replay
│   │   ├── supply_chain.py         # Supply chain
│   │   ├── executive_dashboard.py  # Executive report
│   │   ├── auto_retest.py          # Auto-retest
│   │   ├── bug_bounty.py           # Bug bounty
│   │   ├── zero_trust.py           # Zero trust
│   │   ├── attacker_brain.py       # Attacker brain
│   │   ├── threat_intel.py         # Threat intel
│   │   ├── heatmap.py              # Heatmap
│   │   ├── benchmarking.py         # Benchmarking
│   │   ├── ai_chat.py              # AI chat
│   │   ├── training_mode.py        # Training
│   │   ├── gamification.py         # XP system
│   │   ├── nlp_scan.py             # NLP scanner
│   │   ├── evidence_generator.py   # Evidence
│   │   ├── geo_tracker.py          # Geo tracker
│   │   ├── github_pr_review.py     # PR reviewer
│   │   ├── blast_radius.py         # Blast radius
│   │   ├── breach_cost.py          # Breach cost
│   │   ├── security_timeline.py    # Timeline
│   │   ├── digital_twin.py         # Digital twin
│   │   ├── darkweb_monitor.py      # Dark web
│   │   ├── redblue_sim.py          # Red vs Blue
│   │   └── web_dashboard.py        # Web dashboard
│   ├── ai/
│   │   ├── narrator.py             # AI narrative
│   │   ├── predictor.py            # Predictive AI
│   │   └── darkweb.py              # Dark web linker
│   ├── alerts/
│   │   ├── slack_alert.py          # Slack
│   │   ├── teams_alert.py          # Teams
│   │   ├── telegram_alert.py       # Telegram
│   │   └── whatsapp_alert.py       # WhatsApp
│   ├── config.py
│   └── main.py
├── web/                            # Web dashboard files
├── screenshots/
│   └── dashboard.png               # Dashboard screenshot
├── docs/
├── reports/
├── requirements.txt
├── setup.py
└── README.md

📄 License

MIT License — Free to use, modify, and distribute.

⭐ Support

⭐ Star this repo on GitHub
🐛 Report bugs via Issues
🔀 Submit PRs for improvements

💀 SkullMap — See the full attack chain before the attacker does

Made with 🖤 by Talha Imran SOC Analyst | Cloud Security | Pentesting

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

skullmap-2.0.7.tar.gz (123.5 kB view details)

Uploaded Aug 22, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

skullmap-2.0.7-py3-none-any.whl (141.3 kB view details)

Uploaded Aug 22, 2026 Python 3

File details

Details for the file skullmap-2.0.7.tar.gz.

File metadata

Download URL: skullmap-2.0.7.tar.gz
Upload date: Aug 22, 2026
Size: 123.5 kB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: twine/7.0.0 CPython/3.11.0

File hashes

Hashes for skullmap-2.0.7.tar.gz
Algorithm	Hash digest
SHA256	`fe5827f12981dc930b8f1acba3e4595d518c1d8702bdec6e7168405b51a593c2`
MD5	`3a37685236a4c68fc55f309d3808fe31`
BLAKE2b-256	`8617565809ad1e1211695bc8baae3ac0f8751efec030b1a2b2510e0a63279d5f`

See more details on using hashes here.

File details

Details for the file skullmap-2.0.7-py3-none-any.whl.

File metadata

Download URL: skullmap-2.0.7-py3-none-any.whl
Upload date: Aug 22, 2026
Size: 141.3 kB
Tags: Python 3
Uploaded using Trusted Publishing? No
Uploaded via: twine/7.0.0 CPython/3.11.0

File hashes

Hashes for skullmap-2.0.7-py3-none-any.whl
Algorithm	Hash digest
SHA256	`720836a8501796fba449668e02cd451620046289da48c1917801e6e1397dfc6d`
MD5	`e2fee21428b5a2f416a894b76c4699d4`
BLAKE2b-256	`eb947fbb9eca92dac18d1375312cfeb4afc2ceb69365a4243fd4d21a45101151`