A security-testing framework: drive real attacks against your own apps, networks, containers and cloud inside an isolated lab, from an attacker's point of view, and find out how far an attacker could actually get.
redstep runs real attacks, so it is built to run them only where they belong. Every action is confined by independent layers: an isolated lab with no route to the internet or production, a scope gate that refuses any target not on the allowlist, and an intensity ladder that keeps force behind an explicit opt-in. Use it only against systems you own or are authorized to test.
You stand up a disposable, isolated copy of your own system, attack it from the outside in, and watch what a real attacker would reach. When an attack succeeds that is a security failure, not a pass: redstep captures a success witness, you apply a fix, and a pinned replay confirms the attack is now blocked.
redstep- the framework (a library and theredstepbinary).redstep-macros- its procedural-macro support; not used on its own.
Rust (edition 2024) and Docker (the lab is built as Docker containers).
docs/ holds the specifications (docs/specs/), the roadmap (docs/roadmap/),
the settled cross-cutting decisions (docs/adr/) and the coding rules
(docs/rules/). The playground/ directory is the vulnerable target the demos
run against. redstep is pre-1.0 and under active development; the roadmap
lists what each release delivers and its status.
Dual-licensed under either of
- MIT license (LICENSE-MIT)
- Apache License, Version 2.0 (LICENSE-APACHE)
at your option.