DeepSeek-DSH Red Team: 9 Modes & 15 Plugins for Pentest, Code Audit, Cloud Security

Introduction

DeepSeek-DSH Red Team Mode is a plugin collection for the deepseek-harness framework (GitHub: https://github.com/deepseek-ai/deepseek-harness). It delivers nine ready-to-use security research work modes (presets) and fifteen runtime plugins, all self-contained and capable of offline deployment. The suite targets authorized red team activities covering penetration testing, red team assessment, code auditing, binary analysis, antivirus evasion, incident response, cloud security offense/defense, and CTF challenge solving.

The project repository is at https://github.com/SeaOf0/dsh-redteam-model/. Installation requires Node.js >= 22 (the harness itself mandates this); pnpm, dsh, bash, and Python are optional.

Nine Work Modes

Each mode defines a distinct security role with a specific positioning and core discipline set:

redteam (Security Researcher): Entry point for all security tasks. Provides task routing (shallow/professional/multi-task), ledger tracking, global regression summary, and next-step recommendations. Core disciplines: task ledger + routing table + "light" three disciplines.

pentest (Penetration Testing): Black-box testing of Web/API/app/mini-programs — reconnaissance, enumeration, vulnerability verification, and reporting. Core disciplines: discovery + verification = real validity; baseline/differential/marker triad; coverage matrix closure.

code-audit (Code Audit): White-box source code audit focusing on RCE mainlines (upload, unauthorized access, chaining, deserialization, overflow, etc., across seven categories). Core disciplines: dual-chain consistency (auditor chain vs. tracer chain); scan-hit reconciliation; Fortify classification and grading.

binary-analysis (Binary Analysis): Malware analysis, reverse engineering, unpacking and restoration. Core disciplines: sample registration gate (B0) as prerequisite; incomplete restoration = conclusion marked suspicious; hypothesis ledger final state.

attack-defense (Attack-Defense Assessment): Full kill-chain opposition on privilege and data — reconnaissance → breach → lateral movement → persistence → reporting. Core disciplines: gate-pass per phase before advancing; persistence registration; evidence first, cleanup later.

av-evasion (AV Evasion): Attacker-perspective evasion research — payload development and local experiment loops, presenting evasion techniques and detection intelligence in pairs (OPSEC intel). Core disciplines: local default validation + authorized target per task; paired delivery of evasion tech and detection intel; "V-gate" four declarations.

incident-response (Incident Response): Windows/Linux emergency response and attack tracing — evidence preservation → compromise investigation → attack chain timeline reconstruction → characterization → remediation advice → reporting. Core disciplines: evidence and timeline mainline (no evidence = mark suspicious); evidence first, remediation later; delete-type operations only produce inventories.

cloud-security (Cloud Security Offense/Defense): Penetration of cloud platforms (AWS, Azure, GCP, Alibaba Cloud, Tencent Cloud, Huawei Cloud) and cloud-native stacks (K8s, containers, Serverless, CI/CD) — attack surface mapping, AK/SK credential exploitation, IAM privilege escalation, metadata SSRF, container escape, cloud detection gaps. Core disciplines: cloud attack path mainline (entry → identity → permission → resource → impact); read-only probing first; every environment change logged for rollback.

ctf-solver (CTF Solving): Competition challenge solving — challenge registration, module routing (web/pwn/reverse/crypto/misc, etc.), solving loop, flag ledger and retrospective. Core disciplines: flag platform echo verification; solving ledger final state; unsolved challenges honestly record sticking points.

Four-Layer Asset Model

Every mode encapsulates four asset layers:

persona — role definition, epistemology, boundaries, reporting discipline.

playbook — methodology and gatekeeping textual contracts.

skills — loadable skills.

refs/ — external knowledge bases, original-text indexed, zero local paths.

Fifteen Runtime Plugins

Plugins extend the harness with governance, security, tooling, and UI capabilities. They mount on either the host (global) or specific preset planes.

dsh-stage-gate (host): Structural validation of 32 stage gates across eight modes (file/marker/table/hash registration), writes gate-log.md; manages operation_goal / operation_progress contracts and operation-state.json for interrupt recovery.

dsh-route-boost (host): Per-turn governance envelope — phase inference with sticky memory, gate checklist, mode boundaries, evidence level prediction, refs pointers, skill-dependent tool readiness (three-tier fallback), operation recovery rows, task scope determination (explicit user-specified items vs. full matrix), structured marker injection, line-granularity budgeting, delta-only delivery with injection accounting.

dsh-sec-enforce (host): Deterministic tool interception (guard quartet): report gate (blocks writing to reports/ unless gate-log PASS and all goal criteria met), write boundary (confined to task workspace), high-risk command confirmation, rate-limiting on naked scans.

dsh-refusal-guard (host): Refusal detection with one-time proximal re-injection (strong/weak detection, tool-turn exemption, 3-turn cooldown).

dsh-product-subagents (host): Provider for headless spawning of local claude / codex CLI for cross-harness review, triggered by user on suggested items.

dsh-mcp-studio (host): MCP loading workbench — onboarding, status, diagnostics for general MCPs (Burp Suite, Yakit, Chrome Dev MCP, etc.).

dsh-redteam-results (host, bundles): Session tab "Redteam Results" — task ledger dashboard + five-panel result pages (findings, assets, ledger, timeline, cloud attack paths), cross-session aggregation across nine modes with time-range filtering (verify/delete redirect to original session), SQLite row-level persistence.

dsh-hunter (host, bundles): Session tab "Hunter" — unified asset search across FOFA, Hunter, Quake (auto DSL-to-platform syntax, pagination, quota-limited export, independent API key storage); code audit result page "Live Test" button for one-click verification (fingerprint search → liveness probe → EXP validation, authorized assets only).

dsh-campaign-memory (host, bundles): Session tab "Campaign Memory" — cross-session tactic/fingerprint/tool/lesson/detection-fingerprint沉淀 (raw storage, no sanitization — credentials stored as-is or as pointers), same-mode same-workspace same-topic deduplication on write, full-read accounting, heat × 30-day decay sorting (stale entries yield, access revives), workspace-isolated recall (new workspace clean start, cross-zone explicit retrieval with source tags), detection fingerprints auto-purge at 30 days, target fingerprints expire at 180 days (marked expired, resurrect on rewrite); model-side write/search/get/list/remove tools + assembly-time high-frequency memory injection.

dsh-mode-group (host, bundles): Two-level session mode selector — built-in and researcher modes top-level, eight professional security modes folded into "Professional Security Modes" submenu (viewport-adaptive flip, touch-enlarged hit areas).

dsh-session-pulse (host, bundles): Session status panel (nine modes) — top-right task progress chip (real-time done/total + progress bar, green when complete) + sub-agent chip; right drawer "Sub-agent Directory" (running/ended groups, click to enter sub-agent session, live updates); left prompt column on chat page (user inputs sequentially listed, hover preview, click smooth-scroll to message with highlight, chat tab only).

dsh-attack-atlas (host, bundles): Session tab "AttackAtlas Attack Surface Graph" — eight professional mode architecture matrices (battlefield zone × tactic column × sub-items) with four-state lighting and phase bands, target anchoring, double-click dispatch; custom methodology (five module types, five-loop closure queries, layered runtime envelopes); tool/MCP/custom tool modules (install approval protocol); capability library (custom main/sub classes merged into graph and methodology).

dsh-scanner-tools (preset: pentest/attack-defense/cloud-security/ctf-solver): Local scanner wrappers — nuclei / httpx / ffuf plus declarative registry of thirteen tools ( nmap, masscan, subfinder, gau, whatweb, wafw00f, dirsearch, sqlmap, nikto, hydra, impacket, netexec, crackmapexec) — six-rung tool invocation ladder (local → MCP → installed alternative → MCP fallback → ask to install → script), conservative defaults with explicit override audit, blind-scan prevention logging, full-disk output with preview cap, consecutive failure circuit breaker.

dsh-semgrep-audit (preset: code-audit): Local semgrep wrapper + preset offline rule sets auto-located (Java custom / PHP / OSS three layers), dual-write hits to scan-reconcile.md and .csv for reconciliation (hit ≠ vulnerability, review and chain completion before result registration), detection tools never auto-install, --metrics=off offline, artifacts only in task workspace.

dsh-webshell-mgr (preset: attack-defense): Session tab "Webshell Manager" — generator (PHP/JSP/ASPX × basic/encrypted/Behinder/Godzilla flavors) → protocol auto-recognition connect (seven channels) → command execution/file management (upload/download/permissions/timestamp forge/remote download/text edit) / database ops (native PDO MySQL/PostgreSQL/SQLite/MSSQL) / payload plugin system (declarative extensions), operation ledger audit; integrates with attack-defense mode foothold node methodology.

Installation

Method 1: Settings Page Manager (Recommended)

Install the entire collection as a single dsh plugin (requires dsh web 0.1.0-rc.6+, verified on 0.1.1-rc.2):

dsh plugin --profile web add github:SeaOf0/dsh-redteam-model

Open dsh web Settings → Redteam Manager to:

One-click deploy nine security modes ( .agent-presets symlinks).

Install / update / uninstall fifteen runtime plugins.

View operation progress and failure reasons.

The manager only modifies the current profile, auto-backups before writes; uninstall removes runtime declarations only, not source code.

Method 2: Source Code One-Click CLI Deployment

Obtain source code (choose one):

git clone https://github.com/SeaOf0/dsh-redteam-model.git

Or download ZIP from repository page and extract.

cd dsh-redteam-model/deploy
node deploy.mjs          # Install: preset symlinks + plugin mounts + deps (idempotent, re-runnable)
node deploy.mjs --check  # Offline verify: nine presets mounted + plugin loader paths + bundle declarations
node deploy.mjs --start  # Background start dsh web → http://127.0.0.1:3080

Also supports npx ./deploy. Windows (Win10+ built-in bsdtar): same flow, preset symlinks use junctions (no admin required).

Post-Deployment Verification (2 Minutes)

Open http://127.0.0.1:3080 — roster lists nine modes (redteam Security Researcher + eight professional modes).

In any session, have the model call gates_list — returns professional mode gate schemas.

In pentest/attack-defense/cloud-security/ctf-solver sessions, nuclei_scan and other scanner tools are visible (other modes hide them = preset plane correct).

After initiating a task, observe [route-boost] mode=... phase=... runtime envelope snapshots.

Attempt to write to reports/ before passing the report gate — sec-enforce intercepts and guides.

Optional machine-specific dependencies (auto-degrade if missing): claude / codex CLI (cross-harness dual-sign channel), nmap / nuclei / httpx / ffuf / jadx / frida / mingw toolchains (playbook tool plane detection + three-tier fallback: detected tool → MCP → approved install).

Project Repository

https://github.com/SeaOf0/dsh-redteam-model/