Cascavel
🐍 Cascavel — Elite Offensive Security Framework | 85+ plugins | OWASP 2025 | Automated pentesting, reconnaissance & vulnerability assessment | By RET Tecnologia
Install / Use
/learn @glferreira-devsecops/CascavelREADME
🎬 Demo
<p align="center"> <img src="docs/cascavel_scan.png" width="700" /> </p> <p align="center"> <sub><strong>Cinematic boot sequence</strong> · Auto-detects 30+ tools · Preloader with security intel tips</sub> </p> <p align="center"> <img src="docs/cascavel_results.png" width="700" /> </p> <p align="center"> <sub><strong>Split-screen live dashboard</strong> · Real-time severity tracking · Rotating security intelligence</sub> </p>💡 What Makes Cascavel Different
Most pentest workflows involve 20+ separate tools, each with its own syntax, output format, and report style. You manually merge results, format reports, and lose hours to context-switching.
Cascavel replaces the entire workflow:
┌─────────────────────────────────────────────────────────┐
│ $ python3 cascavel.py -t target.com --pdf │
│ │
│ ┌──────────┐ ┌────────┐ ┌──────────┐ ┌──────────┐ │
│ │ DISCOVER │→ │ PROBE │→ │ ATTACK │→ │ ANALYZE │ │
│ └──────────┘ └────────┘ └──────────┘ └──────────┘ │
│ Subdomains Ports XSS,SQLi JWT,CORS │
│ DNS,WHOIS Banners SSRF,RCE CSP,CSRF │
│ Cloud enum Headers SSTI,XXE OAuth,IDOR │
│ │
│ ┌──────────┐ ┌──────────────────────────────────────┐ │
│ │ DETECT │→ │ REPORT (PDF/MD/JSON) │ │
│ └──────────┘ └──────────────────────────────────────┘ │
│ Docker,K8s CVSS v4.0 · OWASP · PTES · LGPD │
│ Redis,S3 Legal disclaimers · SHA-256 integrity │
│ CI/CD Compliance mapping · Risk matrix │
└─────────────────────────────────────────────────────────┘
| Capability | Cascavel | Other Tools |
|:---|:---|:---|
| Unified pipeline | 84 plugins + 30 tools in one command | Fragmented scripts |
| Live dashboard | Split-screen with real-time stats + intel | No live feedback |
| PDF reports | 12 legal disclaimers, CVSS v4.0, PTES | Manual formatting |
| Terminal UX | Cinematic preloader, fade animations | Plain stdout |
| Security hardening | ANSI sanitizer, plugin sandboxing | Trust all output |
| Zero-config | install.sh handles everything | Manual dependency hell |
⚡ Install
Prerequisites
| Requirement | Minimum | Why |
|:---|:---|:---|
| Python | 3.12+ | LTS until 2028 · importlib.metadata, typed generics |
| requests | 2.32.4 | GHSA-9hjg — .netrc credential leak + TLS verify bypass |
| pyOpenSSL | 25.0.0 | GHSA-5pwr — buffer overflow + unhandled callback bypass |
| dnspython | 2.7.0 | GHSA-3rq5 — TuDoor DNS resolution disruption |
| PyJWT | 2.12.0 | CVE-2022-29217 — algorithm confusion attack |
| ReportLab | 3.6.13 | CVE-2023-33733 — RCE via rl_safe_eval |
[!NOTE] The installer automatically enforces these minimum versions and runs
pip-auditpost-install. Manual installs should verify withpip list | grep -iE 'requests|pyopenssl|dnspython|pyjwt|reportlab'.
🚀 Quick Install
curl -fsSL https://raw.githubusercontent.com/glferreira-devsecops/Cascavel/main/install.sh | bash
One command. That's it. Works on macOS, Linux (Debian/Ubuntu/Kali/Parrot/Fedora/Arch/Alpine/SUSE), WSL2, and Docker. The installer auto-detects your OS, installs git + python3 if missing, clones the repo, creates a venv, installs all 84 plugins + 30 tools, and registers the cascavel global command. Zero manual steps.
<details> <summary><strong>📋 Alternative methods (git clone, Docker, manual)</strong></summary>[!TIP] No
curl? Usewget -qO- https://raw.githubusercontent.com/glferreira-devsecops/Cascavel/main/install.sh | bash
# Git clone
git clone https://github.com/glferreira-devsecops/Cascavel.git && cd Cascavel && bash install.sh
# Download tarball (no git needed)
curl -fsSL https://github.com/glferreira-devsecops/Cascavel/archive/main.tar.gz | tar xz && cd Cascavel-main && bash install.sh
# Docker (isolated)
docker run -it --rm python:3.12-slim bash -c "apt update && apt install -y git && git clone https://github.com/glferreira-devsecops/Cascavel.git /app && cd /app && bash install.sh"
# Manual
git clone https://github.com/glferreira-devsecops/Cascavel.git && cd Cascavel
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt && python3 cascavel.py -t target.com
The installer v2.3.0 includes 15 security hardenings: trap cleanup, mktemp -d TOCTOU isolation, anti-symlink lock, SHA-256 requirements.txt integrity, CVE version enforcement (6 packages), umask 077, PATH prefix sanitization (rejects . and relative paths), container detection (Docker/Podman/LXC), WSL2 kernel detection, Python ssl module verification, stale venv recovery, chmod 700/600 on sensitive paths, GOPATH/GOBIN export validation, locale UTF-8 enforcement, and absolute paths for critical binaries.
🏗️ Architecture
cascavel.py (2800+ lines) report_generator.py (1400+ lines)
├── ANSI Escape Sanitizer ├── _NumberedCanvas (two-pass "Page X of Y")
│ └── Blocks CSI/OSC/DCS injection ├── Diagonal "CONFIDENCIAL" watermark
├── Preloader Engine ├── QR Code → rettecnologia.org
│ └── 5-stage cinematic boot ├── Widows/orphans paragraph control
├── Plugin Orchestrator ├── Table splitOn + repeatRows=1
│ └── Dynamic load, SIGALRM timeout ├── Risk Matrix (5×5 heat map)
├── Split-Screen Dashboard ├── 9 compliance frameworks
│ └── Rich Live (scan + intel panel) ├── 20-term security glossary
├── External Tools Pipeline ├── Prioritized remediation summary
│ └── 30+ tools, shlex.quote() └── SHA-256 document integrity
├── Report Engine (PDF/MD/JSON)
└── Signal Handler (async-signal-s
Related Skills
healthcheck
337.7kHost security hardening and risk-tolerance configuration for OpenClaw deployments
node-connect
337.7kDiagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps
prose
337.7kOpenProse VM skill pack. Activate on any `prose` command, .prose files, or OpenProse mentions; orchestrates multi-agent workflows.
claude-opus-4-5-migration
83.3kMigrate prompts and code from Claude Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5
