APT—01RECON
Map the unseen surface.
Resolve interfaces, routes, services, resolvers, environmental readiness, and blocking signatures before sending active traffic.
- Passive discovery
- Environment baselines
- Scope integrity
[ BLACKSITE CYBER WEAPON // OPERATOR-CONTROLLED ]OFN / 07
WEAPONSYSTEM ONLINE.
This is not another security dashboard. OFNIR is a high-capability adversarial research system built to think through hostile network behavior, apply authorized protocol pressure, watch the wire, and preserve every fragment of evidence.
23.5880° N58.3829° E00:00:00 GST
010 toolsProtocol arsenal
020 plansReusable operations
030 surfacesUnified command views
04SHA-256Evidence bound
00 / WEAPON AWAKENINGHIGH-CAPABILITY PRESENCE / ACKNOWLEDGED
[ BUILT TO MODEL THE ADVERSARY // FORBIDDEN TO ACT WITHOUT AUTHORITY. ]
THINK
LIKE THE
ADVERSARY.
A persistent adversary remains quiet, changes shape, and weaponizes uncertainty. OFNIR was built to hold that mindset inside a sealed research system—dangerous capability, deliberate human control, and evidence that cannot disappear.
DOCTRINE / 01THE TARGET NEVER SEES THE WHOLE MACHINE.LOADED
DOCTRINE / 02EVERY DEFENSE REVEALS ITS PRESSURE POINT.LOADED
DOCTRINE / 03ONLY THE WIRE REMEMBERS THE TRUTH.LOADED
01 / THREAT DOCTRINEKNOW THE ADVERSARY
STEALTH IS NOT
ABSENCE.
Modern enforcement does not fail cleanly. It leaks through timing, routing, resolver behavior, protocol mutation, and implementation drift.
OFNIR makes those fractures observable.
APT—02EVASION
Change one signal.
Apply controlled variations across TLS, TCP/IP, HTTP, DNS, QUIC, fragmentation, headers, and timing while the boundary stays fixed.
- Differential execution
- Protocol shaping
- Repeatable plans
APT—03ATTRIBUTION
Bind outcome to cause.
Correlate application behavior with packet timing, fingerprints, resets, manifests, and capture health before issuing a verdict.
- Wire correlation
- Evidence grading
- Reproducible findings
02 / OPERATIONAL ARSENALCONTROLLED FORCE
WEAPONIZE
THE LAB.
A single operating system for disciplined DPI research—from boundary definition to evidence-backed reporting. Built for authorized assessments, never autonomous action.
01 / PROTOCOL OPERATIONS23 TOOLS
Controlled evasion research
TLS fragmentation, TCP/IP behavior, HTTP and DNS mutation, QUIC, timing, header shaping, and differential tests.
- TLS
- TCP/IP
- HTTP
- DNS
- QUIC
02 / DISCOVERY OPERATIONS08 TOOLS
Reconnaissance & baseline
Define the target surface and prove reachability before active research begins.
- SCOPE
- ROUTES
- RESOLVERS
- READINESS
03 / EVIDENCE OPERATIONS12 TOOLS
Packet forensics & trust
Inspect PCAPs, TLS state, injected traffic, capture health, timing, and server fingerprints.
- PCAP
- SHA-256
- MANIFEST
- FINGERPRINT
04 / COMMAND OPERATIONS24 TOOLS / 15 PLANS
Analysis, automation & control
Coordinate reusable suites, role boundaries, verdict calibration, reporting, and read-only AI interpretation.
- PLANS
- REPORTS
- RBAC
- AI READ-ONLY
03 / WEAPON INTERFACENINE OPERATIONAL SURFACES
INSIDE THE
WEAPON CORE.
Real OFNIR interfaces—not fictional mockups. Select a dossier to inspect the command surface, capability context, and evidence controls behind the system.
OFN / INTELLIGENCE VIEWER
SIGNAL STABLE
04 / ADVERSARIAL SEQUENCECONTROL THE KILL CHAIN
BREAK THE
CHAIN.
Every meaningful finding follows a controlled sequence. The operator owns the target and authority; OFNIR owns the record.
ESTABLISHCONTROL
Fix the target, route, resolver, interface, authorization, and expected behavior.
INTRODUCEVARIATION
Change one protocol characteristic while every other condition remains stable.
CAPTURETHE WIRE
Preserve packet evidence, timing, application response, and environment state.
ATTRIBUTETHE EFFECT
Separate direct observation from inference and explicitly state confidence.
REPORTTHE LIMIT
Bind the finding to reproducible evidence and preserve every artifact.
05 / EVIDENCE TRUSTNO FALSE CONFIDENCE
NO ORPHAN
ARTIFACTS.
Before OFNIR displays, reports, or downloads an artifact, it verifies manifest membership, size, SHA-256 identity, run ownership, path containment, and symlink safety.
01Manifest bindingENFORCED
02Path containmentFAIL CLOSED
03Capture trust gradingACTIVE
04Evidence / inference splitEXPLICIT
MANIFEST / VERIFIED
ARTIFACT / SEALED06 / CONTROLLED CONSOLEHUMAN AUTHORITY ONLY
COMMAND
THE DARK.
The integrated terminal is reserved for Super Admin. Commands pass an explicit allowlist, filesystem paths remain inside the OFNIR workspace, deployment actions require confirmation, and every command enters a SHA-256 hash-chained audit log.
root@ofnir / authorized-lab.example
LOCAL RUNTIME // SECUREofnir ❯ scope inspect --target authorized-lab.example
[SCOPE] route pinned · authorization valid · control ready
ofnir ❯ run tls_fragmentation_suite --mode matrix
[WIRE] capture → runs/apt-0042/capture.pcap · trust=trusted
record split before SNI · server data observed · EVADED
control flow · reset observed · BLOCKED
artifact manifest · SHA-256 verified
untrusted artifact · excluded · fail-closed
ofnir ❯ ai summarize --run apt-0042
[AI · READ-ONLY] repeatable differential · confidence HIGH
ofnir ❯
SESSION 7F:42:A9WIRE LINKEDHASH CHAIN 00042
08 / CONTROL VAULTAUTHORIZATION REQUIRED
TAKE CONTROL
OF THE
WAR MIND.
Bring the target, written authority, research objective, and evidence standard. OFNIR provides the high-capability operating environment; the human operator remains the final execution gate.
Challenge license authority↗