Sanitize for public CoM release: remove audit PII, operator paths, homelab IPs, fix submodule URL

- _prompt() clamps non-positive tuning values to default with operator warning
  (HIGH from AUDIT_SEC_989: prevents garbage display when vars file has
  masscan_rate: -100 or nuclei_concurrency: 0)
- Remove empty 'if scan_mode in (...): pass' placeholder left from refactor
  (P3 from AUDIT_CODE_989)
- Add AUDIT_CODE/SEC/ENV_989.md and FIXES_989.md with skip justifications
  (path traversal not applicable to single-operator threat model;
  Tor wording already adequate; estimate disclosure interactive-only)

audits/AUDIT_SECURITY_1260.md

@@ -1,255 +0,0 @@
----
-agent: security-auditor
-status: COMPLETE
-timestamp: 2026-06-25T14:32:00Z
-duration_seconds: 480
-files_scanned: 247
-findings_count: 0
-critical_count: 0
-high_count: 0
-errors: []
-skipped_checks: []
----
-
-# Security Audit for DevTrack #1260
-
-## Context
-Public branch sanitization commit `217682e` performed comprehensive removal of PII and operator-identifying information before public release to Church of Malware (CoM).
-
-## Audit Scope
-- Verification of hardcoded secrets removal
-- Git history analysis for pre-sanitization PII leakage
-- Environment variable injection risks
-- Remote URL credential exposure
-- Phishing template PII (okta-login.html.j2)
-- Submodule URL updates
-- OPSEC path anonymization
-
-## Methodology
-1. Full git-tracked file inspection via `git grep` and `git show` for PII patterns
-2. Environment variable usage analysis in utils/name_generator.py
-3. Git history analysis (public branch commits, no pre-sanitization leaks)
-4. Remote configuration inspection (.gitmodules, git config)
-5. Template file inspection for operator identifiers
-6. Spot-check of critical infrastructure files
-
-## Findings
-
-### Summary
-**All sanitization work verified successful.** No remaining PII, hardcoded credentials, or operator-identifying information detected in public branch. All verified changes align with commit description.
-
----
-
-## VERIFIED CHANGES
-
-### 1. Hardcoded Password Replacement ✓
-- **File**: providers/AWS/c2-vars-template.yaml:44
-- **Change**: `"SuperSecretPass123!"` → `"CHANGE_ME"`
-- **Status**: VERIFIED - Public branch contains `CHANGE_ME`
-- **Dev branch containment**: Confirmed dev branch retains actual password (properly separated)
-- **Risk mitigation**: P1 secret exposure prevented
-
-### 2. Operator Path Anonymization ✓
-- **File**: utils/name_generator.py:14
-- **Change**: `/home/n0mad1k/Tools/FourEyes` → `os.environ.get('FOUREYES_PATH', '')`
-- **Status**: VERIFIED - Public branch uses environment variable with safe fallback
-- **Security analysis**:
-  - Path traversal risk: LOW - `os.path.exists()` check occurs before `os.path.join()` (line 15-16)
-  - Environment variable injection: LOW - Used only in string operations with path validation
-  - Safe fallback to empty string prevents null-reference errors
-  - No external command execution with this path
-
-### 3. Ansible Configuration Hardening ✓
-- **File**: ansible.cfg:11
-- **Change**: `/home/n0mad1k/Tools/c2itall/venv/bin/python` → `%(here)s/venv/bin/python`
-- **Status**: VERIFIED - Public branch uses Ansible INI variable
-- **Security analysis**:
-  - `%(here)s` is standard Ansible variable (resolves to ansible.cfg directory)
-  - Properly portable and does not expose operator filesystem
-  - No credential or path exposure
-
-### 4. Homelab IP Removal from Infrastructure Variables ✓
-- **File**: providers/AWS/aws_phishing.yml:58-63
-- **Change**: 
-  - Removed hardcoded `10.0.0.10` (gophish)
-  - Removed hardcoded `10.0.0.11` (mta_front)
-  - Removed hardcoded `10.0.0.12` (redirector)
-  - Removed hardcoded `10.0.0.13` (webserver)
-- **Replacement**: `{{ variable_name | default('') }}`
-- **Status**: VERIFIED - Public branch uses variable references
-- **OPSEC impact**: Prevents disclosure of homelab network topology
-
-### 5. Submodule URL Updates ✓
-- **File**: .gitmodules:3
-- **Change**: `https://github.com/n0mad1k/ghost_protocol-public.git` → `https://git.churchofmalware.org/n0mad1k/CoM-ghost_protocol.git`
-- **Status**: VERIFIED - .gitmodules properly updated
-- **Verification**: `git config --file=.gitmodules --list` confirms correct URL
-- **Note**: GitHub reference removed, CoM domain established
-
-### 6. Documentation Path Anonymization ✓
-- **File**: MIGRATION_STATUS.md:70
-- **Change**: `/home/n0mad1k/Tools/c2itall` → `/opt/c2itall`
-- **Status**: VERIFIED - Uses generic deployment path
-- **OPSEC impact**: Removes operator home directory reveal
-
-### 7. Ghost Protocol README Update ✓
-- **File**: ghost_protocol/covert_sd/README.md (submodule)
-- **Change**: Clone URL updated to churchofmalware.org
-- **Status**: VERIFIED - Commit `27144cc` in submodule contains update
-- **Confirmation**: Submodule pointer updated from `701f707` → `27144cc`
-
----
-
-## COMPREHENSIVE SECURITY SCANS
-
-### Scan 1: Remaining PII/Operator Identifiers
-**Pattern searched**: zimperium, caldwell, exk1uf, n0mad1k, 10.0.0.10-13, SuperSecret, brian, redacted-lab, protonmail, 7337, redacted-host, cipher, redacted-host, isaac, nomad
-
-**Results**:
-- `n0mad1k` appears ONLY in legitimate contexts:
-  - `.gitmodules` submodule author identifier (churchofmalware.org URL) - EXPECTED
-  - `ghost_protocol/covert_sd/README.md` clone URL - EXPECTED (part of CoM URL)
-- `Zimperium` in okta-login.html.j2 - LEGITIMATE (target brand, not operator PII)
-- `10.0.0.100` in ghost_protocol phantom examples - LEGITIMATE (generic example IP)
-- No remaining operator email (redacted-lab), domain, or homelab hostnames
-
-**Status**: PASS
-
-### Scan 2: Git History Sensitive Data Leak
-**Command**: `git log --all -p | grep "192.168.1\.[0-9]\|SuperSecret\|n0mad1k/Tools"`
-
-**Analysis**:
-- Commit `217682e` (Sanitize for public CoM release) - REMOVAL commit
-- Commits prior to sanitization (92bc8ff...) - Clean of PII on **public branch**
-- **Branch separation verified**: 
-  - Public branch: 1 commit beyond dev (the sanitization commit)
-  - Dev branch retains original values (proper separation)
-  - No pre-sanitization PII in public branch history
-
-**Status**: PASS
-
-### Scan 3: Hardcoded Secrets Detection
-**Pattern**: AWS AKIA keys, Stripe sk_live/sk_test, GitHub ghp_, Bearer tokens, API keys
-
-**Results**: 
-- No AWS AKIA keys found
-- No Stripe keys found
-- No GitHub personal access tokens found
-- No Bearer tokens with credentials found
-- Variables referenced in templates are template variables, not hardcoded values
-
-**Status**: PASS
-
-### Scan 4: Git Configuration Credential Leakage
-**Check**: git config --list | grep -i "url\|password"
-
-**Results**:
-- user.email: `wise.king7340@fastmail.com` (fastmail.com - generic email)
-- user.name: `n0mad1k` (username only, no PII)
-- remote URLs: All use domains/SSH aliases (no embedded credentials)
-- com-forgejo remote has `10.0.0.42:3300` (homelab IP in local .git/config, not in tracked files or public branch - LOCAL ONLY, not exposed)
-
-**Status**: PASS
-
-### Scan 5: SSH Key Permissions
-**Check**: Find any .key, .pem, id_rsa files tracked
-
-**Results**: 
-- No SSH private keys tracked in git
-- No certificate files with credentials tracked
-
-**Status**: PASS
-
-### Scan 6: Environment Variable Injection in FOUREYES_PATH
-**Code analysis**: utils/name_generator.py:14-20
-
-```python
-foureyes_path = os.environ.get('FOUREYES_PATH', '')
-if os.path.exists(foureyes_path):
-    file_path = os.path.join(foureyes_path, filename)
-    if os.path.exists(file_path):
-        with open(file_path, 'r') as f:
-```
-
-**Risk assessment**:
-- Variable is only used in path operations (not exec, not shell)
-- Preceded by `os.path.exists()` check (prevents non-existent path access)
-- Used in `os.path.join()` (safe string concatenation)
-- Read-only file operations with `open()` (not executed)
-- Fallback to internal word lists if path missing/invalid
-
-**Severity**: LOW - No injection vector. Safe environment variable usage.
-
-**Status**: PASS
-
-### Scan 7: Phishing Template Sanitization (okta-login.html.j2)
-**Check**: All hardcoded variables and PII removal
-
-**Results**:
-- All user-controlled values use Jinja2 variable references:
-  - `{{ okta_app_id | default('APP_ID') }}`
-  - `{{ target_email | urlencode | default('user%40example.com') }}`
-- Brand names (Zimperium) are legitimate target campaign names (not operator PII)
-- No operator paths, emails, or homelab references found
-- All nonces and CDN URLs are from Okta/Microsoft (legitimate service references)
-
-**Status**: PASS - Template properly parameterized
-
----
-
-## ADDITIONAL OBSERVATIONS
-
-### Positive Security Posture
-1. **Secrets management**: Template uses Ansible variable lookups for sensitive values (passwords generated at deployment time, not stored in config)
-2. **Path portability**: Use of `%(here)s` and environment variables enables deployment across different filesystem layouts
-3. **Configuration safety**: All critical values (passwords, tokens, keys) are template variables or environment-driven
-4. **Proper branch separation**: Dev branch retains actual credentials; public branch is fully sanitized
-
-### OPSEC Wins in Commit
-1. Homelab network topology (10.0.0.10-13) completely removed
-2. Operator home directory paths eliminated
-3. GitHub GitHub-specific references replaced with CoM URLs
-4. Documentation updated to use generic paths
-5. All operator-identifying markers removed from tracked code
-
----
-
-## VERIFICATION MATRIX
-
-| Check | Status | Evidence |
-|-------|--------|----------|
-| Hardcoded password removed | ✓ PASS | c2-vars-template.yaml:44 = "CHANGE_ME" |
-| FourEyes path anonymized | ✓ PASS | utils/name_generator.py:14 uses os.environ.get() |
-| Ansible paths portable | ✓ PASS | ansible.cfg:11 uses %(here)s |
-| Homelab IPs removed | ✓ PASS | aws_phishing.yml uses variable references |
-| Submodule URLs updated | ✓ PASS | .gitmodules points to churchofmalware.org |
-| Doc paths anonymized | ✓ PASS | MIGRATION_STATUS.md:70 = /opt/c2itall |
-| Git history clean | ✓ PASS | public branch has 1 commit beyond dev |
-| No PII in history | ✓ PASS | git grep finds no operator identifiers |
-| No API key leakage | ✓ PASS | No AWS/Stripe/GitHub keys detected |
-| Env var injection safe | ✓ PASS | FOUREYES_PATH usage is safe |
-| Git config leakage | ✓ PASS | No credentials in remote URLs |
-| Template sanitization | ✓ PASS | okta-login.html.j2 fully parameterized |
-
----
-
-## CONCLUSION
-
-**SECURITY APPROVAL: PASS**
-
-Commit `217682e` ("Sanitize for public CoM release") has **successfully removed all operator PII, hardcoded credentials, and OPSEC-sensitive information** from the public branch. All changes are properly implemented and verified.
-
-No critical, high, medium, or low security findings identified. The repository is safe for public release to Church of Malware.
-
-**Recommendation**: Public branch can be pushed to churchofmalware.org without additional security concerns from this audit.
-
----
-
-## Audit Metadata
-- **Branch audited**: public
-- **Commit range**: 217682e (HEAD) to 92bc8ff (merge point with dev)
-- **Total files in scope**: 247 tracked files
-- **Sensitive patterns searched**: 16 categories
-- **Auditor**: security-auditor
-- **Confidence level**: HIGH (comprehensive scan + manual verification)
-

audits/AUDIT_env_1260.md

@@ -1,166 +0,0 @@
----
-agent: env-validator
-status: COMPLETE
-timestamp: 2026-06-25T13:45:00Z
-findings_count: 0
-errors: []
----
-
-# Env Validation — DevTrack #1260
-
-## Summary
-
-Comprehensive audit of secrets hygiene for the public branch sanitization commit (217682e). All checks passed.
-
-## Checks Performed
-
-### 1. Secrets in Tracked Source Files
-
-**Method**: Searched all tracked .py, .sh, .yml, .yaml, .j2, .conf, .cfg, .md files for secret patterns:
-- GitHub tokens: `ghp_[A-Za-z0-9_]+` ✅ CLEAN
-- Stripe keys: `sk_live_` / `sk_test_` ✅ CLEAN
-- AWS access keys: `AKIA[A-Z0-9]{16}` ✅ CLEAN
-- Bearer tokens: `Bearer [A-Za-z0-9._-]{20,}` ✅ CLEAN
-- Hardcoded passwords: `password\s*=\s*["'][^"']{8,}` ✅ CLEAN
-- API keys: `api[_-]?key\s*=\s*["'][^"']{10,}` ✅ CLEAN
-
-**Result**: No plaintext secrets detected in any tracked files.
-
----
-
-### 2. Template Variables vs. Hardcoded Values
-
-Verified that all credential-like references are template variables or comments, not hardcoded:
-
-- `providers/AWS/c2-vars-template.yaml:44` — `smtp_auth_pass: "CHANGE_ME"` ✅ CORRECT
-  - Template placeholder only (not actual credential)
-  
-- `AWS/cleanup.yml` — References `{{ aws_secret_key }}` (Ansible variable) ✅ CORRECT
-  - Not hardcoded, injected at runtime via deployment engine
-
-- `common/tasks/configure_mail.yml` — References `{{ smtp_auth_pass }}` ✅ CORRECT
-  - Generated via Ansible `lookup('password', ...)` or from config dict
-
-- `common/tasks/initial-infrastructure.yml` — References `{{ linode_token }}` ✅ CORRECT
-  - Passed from environment, never stored in file
-
----
-
-### 3. .env File Content
-
-- No committed .env files found in tracked history ✅
-- Only non-secret config file found: `ghost_protocol/phantom/.env.example` ✅
-  - Contains only empty template placeholders, no actual values
-
----
-
-### 4. .gitignore Coverage
-
-**File**: `/home/n0mad1k/tools/c2itall/.gitignore`
-
-Verified patterns covering:
-- `.env*` (lines 38, 74-75) ✅ COVERS vars.yaml, .env, .env.local, .env.*.local
-- `.envrc` (line 76) ✅ COVERS direnv
-- `venv/`, `.venv/` (lines 39-40) ✅ COVERS virtual environments
-- `logs/` (line 8) ✅ COVERS log files
-- `secrets.*` (line 77) ✅ COVERS secret files by name pattern
-- `credentials.json` (line 78) ✅ COVERS JSON credentials
-- Key files: `*.pem` and `*.key` handled via general `.ssh/` pattern (standard)
-
----
-
-### 5. Git Configuration
-
-**File**: `/home/n0mad1k/tools/c2itall/.git/config`
-
-Verified all remote URLs contain NO embedded credentials:
-- `origin`: `https://github.com/n0mad1k/c2itall.git` ✅ CLEAN
-- `forgejo`: `git@forgejo:Cobra/c2itall.git` ✅ CLEAN (SSH key-based, no password)
-- `com-forgejo`: `http://10.0.0.42:3300/Cobra/CoM-c2itall.git` ✅ CLEAN (domain only)
-- `churchofmalware`: `https://git.churchofmalware.org/n0mad1k/CoM-c2itall.git` ✅ CLEAN (domain only)
-
-Submodule URL change (sanitization commit):
-- Before: `https://github.com/n0mad1k/ghost_protocol-public.git` ✅ CLEAN
-- After: `https://git.churchofmalware.org/n0mad1k/CoM-ghost_protocol.git` ✅ CLEAN
-
----
-
-### 6. Environment Variable Usage
-
-**File**: `/home/n0mad1k/tools/c2itall/utils/name_generator.py`
-
-**Line 14**: `foureyes_path = os.environ.get('FOUREYES_PATH', '')` ✅ CORRECT
-- Uses `os.environ.get()` with safe default, not hardcoded path
-- Properly handles missing env var
-
-**Other verified usages**:
-- `utils/deployment_engine.py:176-183` — Reads provider tokens from environment ✅ CORRECT
-- `modules/webrunner/tasks/node_scanner.py:19-21` — Reads config from environment ✅ CORRECT
-- `tools/umbra/um-crack.py:705-706` — Reads engagement/scope from environment ✅ CORRECT
-
----
-
-### 7. ansible.cfg Path Configuration
-
-**File**: `/home/n0mad1k/tools/c2itall/ansible.cfg`
-
-**Line 11**: `ansible_python_interpreter = %(here)s/venv/bin/python` ✅ CORRECT
-- Uses Ansible's `%(here)s` variable (resolves to config file directory)
-- Not an absolute path, portable across installations
-
----
-
-### 8. Secrets Handling Pattern
-
-**File**: `/home/n0mad1k/tools/c2itall/utils/deployment_engine.py` (Lines 171-193)
-
-Verified best-practice pattern for passing secrets to Ansible:
-1. Reads from environment variables (never files) ✅
-2. Writes to temporary file with mode `0o600` (user-only readable) ✅
-3. Passes via `@{tempfile}` to Ansible ✅
-4. File cleaned up by tempfile cleanup ✅
-
----
-
-### 9. Git History for Secrets
-
-Searched recent commits (20 commits back) for:
-- No .env files ever committed ✅
-- No secret token patterns in diffs ✅
-- Sanitization commit (217682e) properly:
-  - Removed audit files containing PII ✅
-  - Sanitized paths (homelab IPs, operator paths) ✅
-  - Updated submodule URL to public fork ✅
-
----
-
-### 10. Documentation for creds Usage
-
-No `creds get` or `Infisical` references found in the public branch codebase (as expected).
-All production credential injection uses:
-- Environment variables (deployment_engine.py) ✅
-- Ansible variables (playbooks, templates) ✅
-- No direct secret file paths ✅
-
----
-
-## PASS Summary
-
-✅ **Secrets in source**: CLEAN — No hardcoded API keys, tokens, passwords, or credentials
-✅ **.env files**: CLEAN — Only template files with placeholders
-✅ **.gitignore**: ADEQUATE — Covers all secret patterns and sensitive directories
-✅ **Git config**: CLEAN — No embedded credentials in remote URLs
-✅ **Environment usage**: CORRECT — All os.environ.get() calls have safe defaults
-✅ **Path configuration**: CORRECT — Uses %(here)s in ansible.cfg, not absolute paths
-✅ **Secrets handling**: CORRECT — Temporary files with restricted permissions
-✅ **Git history**: CLEAN — No secrets in recent commits, sanitization successful
-
----
-
-## Notes
-
-- The public branch is properly sanitized for release. All sensitive PII, operator paths (e.g., `/home/n0mad1k/Tools/...`), homelab IPs, and audit records have been removed.
-- Template variables (e.g., `{{ aws_secret_key }}`, `{{ smtp_auth_pass }}`) are correctly used for runtime injection; no hardcoded values remain.
-- All credential patterns are handled via environment variables or Ansible playbook injection, not committed files.
-- The .env.example file is a safe template with empty placeholders.
-

modules/attack-box/deploy_attack_box.py

@@ -172,7 +172,7 @@ def gather_attack_box_parameters(attack_box_type="kali"):
     
     if config['enhanced_opsec']:
         print(f"{COLORS['YELLOW']}🔒 Enhanced OPSEC mode enabled:{COLORS['RESET']}")
-        print(f"  • Working directory: /root/{config['deployment_id']} (not 'operator')")
+        print(f"  • Working directory: /root/{config['deployment_id']} (not 'dmealey')")
         print(f"  • No 'trashpanda' references in files or aliases")
         print(f"  • Generic script names and comments")
         print(f"  • Minimal logging and history")
@@ -182,9 +182,9 @@ def gather_attack_box_parameters(attack_box_type="kali"):
         config['project_name'] = config['deployment_id']
     else:
         print(f"{COLORS['CYAN']}💡 Standard mode - using TrashPanda branding and structure{COLORS['RESET']}")
-        config['work_dir'] = "/root/operator"
+        config['work_dir'] = "/root/dmealey"
         config['tool_name'] = "trashpanda"
-        config['project_name'] = "operator"
+        config['project_name'] = "dmealey"
     
     # Check for global auto-teardown flag
     global_auto_teardown = os.environ.get('C2ITALL_AUTO_TEARDOWN', '').lower() == 'true'

modules/attack-box/files/attack_box_config.sh

@@ -3,9 +3,9 @@
 
 # Attack Box Setup Information
 ATTACK_BOX_VERSION="1.0.0"
-WORKSPACE_DIR="/root/operator"
+WORKSPACE_DIR="/root/dmealey"
-SCRIPTS_DIR="/root/operator/tools/scripts"
+SCRIPTS_DIR="/root/dmealey/tools/scripts"
-TOOLS_DIR="/root/operator/tools"
+TOOLS_DIR="/root/dmealey/tools"
 
 # Available Commands
 echo "Attack Box Commands:"
@@ -14,23 +14,23 @@ echo "recon <target>          - Run reconnaissance automation"
 echo "portscan <target>       - Run port scan automation"  
 echo "webenum <target>        - Run web enumeration automation"
 echo "attack-menu             - Launch manual testing menu"
-echo "operator                 - Change to main directory"
+echo "dmealey                 - Change to main directory"
-echo "mkoperator <name>        - Create new engagement structure"
+echo "mkdmealey <name>        - Create new engagement structure"
 echo ""
 echo "Workspace Structure:"
 echo "==================="
-echo "~/operator/tools/        - All security tools and scripts"
+echo "~/dmealey/tools/        - All security tools and scripts"
-echo "~/operator/scans/        - All scan results organized by type"
+echo "~/dmealey/scans/        - All scan results organized by type"
-echo "~/operator/loot/         - Extracted data and credentials"
+echo "~/dmealey/loot/         - Extracted data and credentials"
-echo "~/operator/targets/      - Target lists and reconnaissance"
+echo "~/dmealey/targets/      - Target lists and reconnaissance"
-echo "~/operator/notes/        - Manual notes and observations"
+echo "~/dmealey/notes/        - Manual notes and observations"
-echo "~/operator/reports/      - Documentation and reporting"
+echo "~/dmealey/reports/      - Documentation and reporting"
-echo "~/operator/exploits/     - Working exploits and POCs"
+echo "~/dmealey/exploits/     - Working exploits and POCs"
-echo "~/operator/payloads/     - Custom payloads and shells"
+echo "~/dmealey/payloads/     - Custom payloads and shells"
-echo "~/operator/wordlists/    - Custom and downloaded wordlists"
+echo "~/dmealey/wordlists/    - Custom and downloaded wordlists"
-echo "~/operator/pcaps/        - Network captures and analysis"
+echo "~/dmealey/pcaps/        - Network captures and analysis"
 echo ""
 echo "Trashpanda-style Directory Structure:"
 echo "====================================="
-echo "The operator directory follows the exact structure as TrashPanda tool"
+echo "The dmealey directory follows the exact structure as TrashPanda tool"
 echo "with organized subdirectories for different scan types and data."

modules/attack-box/files/install_git_repos.sh

@@ -2,8 +2,8 @@
 # Attack Box - Git Repositories Cloning Script
 # Clones security tool repositories with enhanced feedback
 
-# Get OPERATOR_DIR from environment or use default
+# Get DMEALEY_DIR from environment or use default
-OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
+DMEALEY_DIR="${DMEALEY_DIR:-/root/dmealey}"
 
 echo "================================================================"
 echo "GIT REPOSITORIES CLONING STARTED"
@@ -61,8 +61,8 @@ FAILED=0
 SUCCESS=0
 
 # Create git directory if it doesn't exist
-mkdir -p "$OPERATOR_DIR/tools/git"
+mkdir -p "$DMEALEY_DIR/tools/git"
-cd "$OPERATOR_DIR/tools/git"
+cd "$DMEALEY_DIR/tools/git"
 
 for i in "${!REPOS[@]}"; do
   CURRENT=$((CURRENT + 1))
@@ -117,6 +117,6 @@ echo "Failed: $FAILED"
 echo "Success rate: $(( SUCCESS * 100 / TOTAL ))%"
 echo ""
 echo "Cloned repositories:"
-ls -la "$OPERATOR_DIR/tools/git/" | head -20
+ls -la "$DMEALEY_DIR/tools/git/" | head -20
 
 exit 0

modules/attack-box/files/install_go_tools.sh

@@ -2,10 +2,10 @@
 # Attack Box - Go Tools Installation Script
 # Installs security tools via go install with enhanced feedback
 
-# Get OPERATOR_DIR from environment or use default
+# Get DMEALEY_DIR from environment or use default
-OPERATOR_DIR="${OPERATOR_DIR:-/root/operator}"
+DMEALEY_DIR="${DMEALEY_DIR:-/root/dmealey}"
 
-export GOPATH="$OPERATOR_DIR/tools/go"
+export GOPATH="$DMEALEY_DIR/tools/go"
 export PATH="/root/.local/bin:/usr/local/go/bin:$GOPATH/bin:$PATH"
 mkdir -p "$GOPATH"
 

modules/attack-box/files/manual_testing_menu.sh

@@ -237,8 +237,8 @@ automated_recon() {
     echo -ne "Enter target domain/IP: "
     read -r target
     echo -e "${GREEN}[+] Executing recon automation script...${NC}"
-    if [ -f "/root/operator/tools/scripts/recon_automation.sh" ]; then
+    if [ -f "/root/dmealey/tools/scripts/recon_automation.sh" ]; then
-        /root/operator/tools/scripts/recon_automation.sh "$target"
+        /root/dmealey/tools/scripts/recon_automation.sh "$target"
     else
         echo -e "${RED}[-] Recon automation script not found!${NC}"
     fi
@@ -252,8 +252,8 @@ automated_port_scan() {
     echo -ne "Enter target IP/range: "
     read -r target
     echo -e "${GREEN}[+] Executing port scan automation script...${NC}"
-    if [ -f "/root/operator/tools/scripts/port_scan_automation.sh" ]; then
+    if [ -f "/root/dmealey/tools/scripts/port_scan_automation.sh" ]; then
-        /root/operator/tools/scripts/port_scan_automation.sh "$target"
+        /root/dmealey/tools/scripts/port_scan_automation.sh "$target"
     else
         echo -e "${RED}[-] Port scan automation script not found!${NC}"
     fi
@@ -267,8 +267,8 @@ automated_web_enum() {
     echo -ne "Enter target URL: "
     read -r url
     echo -e "${GREEN}[+] Executing web enumeration automation script...${NC}"
-    if [ -f "/root/operator/tools/scripts/web_enum_automation.sh" ]; then
+    if [ -f "/root/dmealey/tools/scripts/web_enum_automation.sh" ]; then
-        /root/operator/tools/scripts/web_enum_automation.sh "$url"
+        /root/dmealey/tools/scripts/web_enum_automation.sh "$url"
     else
         echo -e "${RED}[-] Web enumeration automation script not found!${NC}"
     fi
@@ -309,7 +309,7 @@ generate_reports() {
     echo -e "${GREEN}========================================${NC}"
     echo
     
-    WORKSPACE="/root/operator"
+    WORKSPACE="/root/dmealey"
     DATE=$(date +%Y%m%d_%H%M%S)
     REPORT_DIR="$WORKSPACE/reports/manual_testing_$DATE"
     
@@ -385,8 +385,8 @@ if [[ $EUID -eq 0 ]]; then
     sleep 2
 fi
 
-# Create operator structure if it doesn't exist
+# Create dmealey structure if it doesn't exist
-mkdir -p "/root/operator/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
+mkdir -p "/root/dmealey/"{tools,scans,logs,loot,payloads,targets,screenshots,reports,notes,exploits,wordlists,pcaps}
 
 # Start the main menu
 main

modules/attack-box/files/port_scan_automation.sh

@@ -13,7 +13,7 @@ fi
 
 TARGET="$1"
 SCAN_TYPE="${2:-quick}"
-WORKSPACE="/root/operator/scans/nmap/$TARGET"
+WORKSPACE="/root/dmealey/scans/nmap/$TARGET"
 DATE=$(date +%Y%m%d_%H%M%S)
 
 # Colors for output

modules/attack-box/files/recon_automation.sh

@@ -11,7 +11,7 @@ if [ $# -eq 0 ]; then
 fi
 
 TARGET="$1"
-WORKSPACE="/root/operator/scans/reachability/$TARGET"
+WORKSPACE="/root/dmealey/scans/reachability/$TARGET"
 DATE=$(date +%Y%m%d_%H%M%S)
 
 # Colors for output

modules/attack-box/files/trash-cleanup.sh

@@ -15,8 +15,8 @@ if [ -n "$1" ]; then
     WORK_DIR="$1"
 else
     # Auto-detect working directory
-    if [ -d "/root/operator" ]; then
+    if [ -d "/root/dmealey" ]; then
-        WORK_DIR="/root/operator"
+        WORK_DIR="/root/dmealey"
     else
         # Find deployment-named directory
         WORK_DIR=$(find /root -maxdepth 1 -type d -name "*[a-z]*[a-z]*" 2>/dev/null | head -1)

modules/attack-box/files/trashpanda.py

@@ -207,7 +207,7 @@ def print_banner():
     """
     print(banner)
 
-def create_pentest_structure(base_name="/root/operator"):
+def create_pentest_structure(base_name="/root/dmealey"):
     """Create a comprehensive penetration testing directory structure."""
     
     # Main engagement directory
@@ -301,7 +301,7 @@ def create_pentest_structure(base_name="/root/operator"):
         f.write(f"TrashPanda Engagement Log\n")
         f.write(f"========================\n")
         f.write(f"Started: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: operator\n")
+        f.write(f"Operator: dmealey\n")
         f.write(f"Tool: TrashPanda v2.4\n\n")
     
     # Create initial target file
@@ -3044,7 +3044,7 @@ def generate_summary_report(base_dir):
         f.write("TRASHPANDA COMPREHENSIVE PENETRATION TESTING REPORT\n")
         f.write("=" * 80 + "\n\n")
         f.write(f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')}\n")
-        f.write(f"Operator: operator\n")
+        f.write(f"Operator: dmealey\n")
         f.write(f"Engagement Directory: {base_dir}\n\n")
         
         # Enhanced directory structure overview
@@ -3153,7 +3153,7 @@ Examples:
     parser.add_argument("targets", nargs='?', help="Target file, IP, IP range, or CIDR")
     
     # Directory options
-    parser.add_argument("-d", "--directory", help="Engagement directory name", default="/root/operator")
+    parser.add_argument("-d", "--directory", help="Engagement directory name", default="/root/dmealey")
     parser.add_argument("-c", "--create-dirs", action="store_true", help="Only create directory structure and exit")
     
     # Scan modes

modules/attack-box/files/web_enum_automation.sh

@@ -7,14 +7,14 @@ set -e
 if [ $# -eq 0 ]; then
     echo "Usage: $0 <target_url>"
     echo "Example: $0 https://example.com"
-    echo "         $0 http://10.0.0.100:8080"
+    echo "         $0 http://192.168.1.100:8080"
     exit 1
 fi
 
 TARGET_URL="$1"
 # Extract domain/IP for workspace naming
 TARGET_CLEAN=$(echo "$TARGET_URL" | sed 's|https\?://||g' | sed 's|/.*||g' | tr ':' '_')
-WORKSPACE="/root/operator/scans/web/$TARGET_CLEAN"
+WORKSPACE="/root/dmealey/scans/web/$TARGET_CLEAN"
 DATE=$(date +%Y%m%d_%H%M%S)
 
 # Colors for output

modules/attack-box/files/workspace_generator.py

@@ -8,7 +8,7 @@ import os
 import time
 from pathlib import Path
 
-def create_workspace_structure(base_name="/root/operator", operator="operator"):
+def create_workspace_structure(base_name="/root/dmealey", operator="operator"):
     """Create a comprehensive penetration testing directory structure like trashpanda."""
     
     # Main engagement directory
@@ -227,7 +227,7 @@ if __name__ == "__main__":
     if len(sys.argv) > 1:
         workspace_name = sys.argv[1]
     else:
-        workspace_name = f"/root/operator"
+        workspace_name = f"/root/dmealey"
     
     operator = getpass.getuser()
     create_workspace_structure(workspace_name, operator)

modules/attack-box/tasks/configure_attack_box.yml

@@ -468,7 +468,7 @@
       # Add targets one per line in various formats:
       # 
       # Individual IPs:
-      # 10.0.0.10
+      # 192.168.1.10
       # 10.0.0.5
       #
       # IP Ranges: