Dredge — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

🛡️ Sensitive Data Handling

This tool collects, processes, or stores data that may include sensitive, personally identifiable, or client-proprietary information — even when sourced from public repositories or non-client-controlled systems. Handle all collected data in accordance with your engagement’s data handling agreement, applicable privacy regulations (GDPR, CCPA, HIPAA), and your organization’s data classification policy. Store findings in encrypted, access-controlled locations and destroy data per the agreed retention schedule.

Dredge is a Windows endpoint security auditor that operates as an analysis engine. It consumes a JSON collection file produced by a separate collector agent deployed on the target Windows endpoint. The collector gathers system state data (registry keys, running processes, installed software, user accounts, group policies, event logs, certificates, network configuration, etc.) and exports it as a structured JSON document. Dredge then analyses this collection offline without requiring direct access to the target system.

The analysis pipeline routes the collection data through 18 specialised analysers, each targeting a distinct security domain: System configuration, OS Hardening, Network settings, User accounts, Active Directory, Running processes, Browser security, Remote management (RDP/WinRM/PSRemoting), Server software, Windows Event Logs, Installed software, Certificates, Compliance baselines (CIS/STIG), Credential exposure, Privilege escalation vectors, Persistence mechanisms, AD Certificate Services (ADCS), Disk/storage encryption, and Hardware inventory.

After the analyser pass, Dredge runs a threat intelligence enrichment step that cross-references findings against static threat indicator lists and optionally queries external threat intelligence APIs. Findings are emitted in the universal pr0t31n schema. When run under Crucible (CRUCIBLE_MANAGED=1), Dredge emits structured protocol tokens for real-time progress and finding delivery. An optional intel_writer module produces supplemental intelligence files, and a cmd_assembler module can generate remediation command scripts.

Phase Pipeline

Phase 1 — Configuration Loading
Phase 2 — Analyzer Execution
Phase 3 — Correlation
Phase 4 — Report Generation

Security

CLI tool. WinRM credentials used for remote collection. Processes data locally. Threat intelligence API keys (VirusTotal, AbuseIPDB) stored in settings.

Features

Analysers

System Analyser

Evaluates OS version, patch level, boot configuration, and system-wide security settings.

Hardening Analyser

Checks Windows hardening controls: UAC configuration, DEP, ASLR, Secure Boot, BitLocker, firewall state, and audit policies.

Network Analyser

Reviews network interfaces, DNS configuration, routing tables, open ports, and firewall rules for security issues.

User Analyser

Inspects local user accounts, group memberships, password policies, inactive accounts, and service accounts.

Active Directory Analyser

Evaluates AD domain membership, trust relationships, group policy objects, and domain-level security settings.

Process Analyser

Analyses running processes for suspicious characteristics: unsigned binaries, unusual parent-child relationships, and known-bad process names.

Browser Analyser

Checks browser security settings, installed extensions, certificate stores, and proxy configurations across installed browsers.

Remote Management Analyser

Audits RDP, WinRM, PSRemoting, and SSH server configurations for insecure settings and excessive access.

Server Software Analyser

Identifies installed server software (IIS, SQL Server, Exchange, etc.) and checks for known-vulnerable versions and insecure configurations.

Event Log Analyser

Examines Windows Event Log configuration and content for security-relevant events, audit gaps, and evidence of compromise.

Certificate Analyser

Reviews installed certificates for expired, self-signed, weak-key, and revoked certificates across all certificate stores.

Compliance Analyser

Evaluates the endpoint against CIS Benchmarks and DISA STIG baselines, reporting non-compliant settings.

Credential Exposure Analyser

Detects stored credentials in registry, files, scheduled tasks, and services that could be extracted by an attacker.

Privilege Escalation Analyser

Identifies privilege escalation vectors: unquoted service paths, writable service binaries, AlwaysInstallElevated, DLL hijacking opportunities.

Persistence Analyser

Checks registry Run keys, scheduled tasks, startup folders, WMI subscriptions, and services for unauthorised persistence mechanisms.

ADCS Analyser

Audits Active Directory Certificate Services for ESC1-ESC8 vulnerabilities, misconfigured templates, and excessive enrolment permissions.

Disk Storage Analyser

Evaluates disk encryption status (BitLocker/FileVault), unencrypted removable media policies, and sensitive file exposure on disk.

Hardware Inventory Analyser

Catalogues hardware components, firmware versions, TPM status, and Secure Boot configuration.

Analysis

19 Analyzer Modules

system, hardening, network, users, active_directory, processes, browsers, remote_mgmt, server_software, event_logs, software, certificates, compliance, credential_exposure, privilege_escalation, persistence, adcs, disk_storage, hardware

Architecture

Two-Phase Architecture

Collection phase (PowerShell on Windows target) separated from Analysis phase (Python, runs offline anywhere) — collect once, analyse repeatedly

Collection

WinRM Remote Collection

Collects endpoint data remotely via WinRM (NTLM auth, HTTP/HTTPS) without deploying agents

Integration

External Tool Ingestion

Parses and correlates output from Seatbelt JSON, WinPEAS, HardeningKitty CSV, BloodHound/SharpHound JSON, PingCastle XML, PrivescCheck JSON

Intelligence

Threat Intel Enrichment

Cross-references findings with static threat indicator lists and optional external API enrichment for known-bad indicators.

Output

Remediation Command Assembly

Optionally generates PowerShell/CMD remediation scripts via the cmd_assembler module for identified findings.

Security

ADCS Auditing

Active Directory Certificate Services security analysis for misconfigured templates and enrollment policies

Use Cases

Windows Endpoint Security Assessment

Comprehensive security audit of a Windows workstation or server as part of a penetration test or security review, covering hardening, credentials, privilege escalation, and persistence.

Active Directory Security Review

Evaluate domain-joined endpoints for AD-specific risks: ADCS ESC vulnerabilities, Kerberoastable accounts, credential exposure, and group policy weaknesses.

Compliance Baseline Verification

Assess Windows endpoints against CIS Benchmarks or DISA STIG baselines, producing a gap report of non-compliant settings with specific remediation guidance.

Incident Response Triage

Analyse a collection from a potentially compromised endpoint for indicators of persistence (registry run keys, scheduled tasks, WMI subscriptions) and credential exposure.

Medical Device Windows Host Assessment

Audit the Windows host component of medical device systems for security hardening, patch level, and compliance with healthcare security requirements.

CLI Reference

Command Examples

Analyze Collection

python3 dredge.py --collection /path/to/data --output-dir /path/to/output

Analyze pre-collected Windows host data.

WinRM Collection + Analysis

python3 dredge.py --winrm-host 10.0.0.5 --winrm-user admin --winrm-pass P@ss --output-dir /out

Collect data via WinRM and analyze.

Parse Seatbelt

python3 dredge.py --parse-seatbelt /path/to/seatbelt.txt --output-dir /out

Parse and analyze Seatbelt output.

Parse BloodHound

python3 dredge.py --parse-bloodhound /path/to/bh_export/ --output-dir /out

Analyze BloodHound data exports.

Finding Nomenclature

Dredge findings are prefixed by analyser domain. Each finding includes the specific Windows configuration or artefact that triggered the detection, the relevant registry key or file path where applicable, and risk-rated remediation guidance. Findings map to compliance frameworks (CIS, STIG, NIST 800-53) where applicable. The tool also produces supplemental intelligence files via the intel_writer module and can generate remediation command scripts via cmd_assembler.

Action Items

Dredge generates action items for privilege escalation and persistence findings — e.g., "Test AlwaysInstallElevated for MSI privilege escalation", "Investigate unquoted service path for service X", "Check if ADCS template allows domain user enrollment with SAN".

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`findings.json`	JSON	Universal findings array v1.1
`findings.csv`	CSV	CSV mirror of findings
`summary.json`	JSON	Aggregated statistics
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Dredge && python3 dredge.py [OPTIONS]` Run directly with command-line arguments.

Integration

Used By

Crucible (manages)
Prometheus (reports)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
pywinrm	diyan / Ansible community	python	https://github.com/diyan/pywinrm
PowerShell	Microsoft	system	https://github.com/PowerShell/PowerShell

Metadata

Name	Dredge
Category	Analysis
Version	1.8.1
Install Path	`/opt/pr0t31n/Dredge`
Main File	`dredge.py`
GitHub	https://github.com/pr0t31n/Dredge.git