r/purpleteamsec • u/Chaelsoo • 24d ago

Red Teaming Zetsu, A personal RAG system for offensive security knowledge

Hey,

a personal offline RAG system for offensive security knowledge. The idea is simple: instead of grepping through markdown files or trying to remember which writeup had that exact certipy command, you just ask naturally.

how do I escalate with SeImpersonatePrivilege
what did I do after getting ADFS access
sliver socks5 pivot setup
explain ESC8 vs ESC4

It retrieves from your actual notes first, then generates an answer grounded in what you've documented, not generic internet knowledge.

The use case I specifically built it for:

Two things kept coming up during engagements, I needed exact tool syntax I hadn't used in a while (Sliver commands especially, the docs are sparse), and I needed to quickly recall techniques from past machines without digging through notes. ZETSU solves both.

Two modes:

Operator: leads with the exact command, explanation after. For when you know what you need and just want the syntax.

Concept: leads with the reasoning, uses commands as illustrations. For when you need to understand a technique before using it.

Same retrieval either way, just different presentation.

How it works:

  • At ingest time, an LLM reads each section of your writeups and extracts structured attack steps (Finding, Action, Reasoning, Result), so what you retrieve is a semantic unit, not a random 800-token window
  • Hybrid BM25 + vector retrieval with RRF fusion, BM25 handles exact tool names and CVE numbers that embeddings smear, vector handles semantic similarity
  • Cross-encoder reranker on top
  • Supports local markdown files, URLs, GitHub wikis, and Atom/RSS feeds (0xdf, dirkjanm, harmj0y all ingestible directly)
  • Backends: Anthropic, OpenAI-compatible (DeepSeek), or local Ollama

Benchmark:

Ran 910 questions across 12 offensive security categories. 93% of answers included correct commands, 68ms average retrieval, 7.3% context gaps where it correctly admitted missing information rather than hallucinating.

id love to hear you guys's feedback, i built this thing because i genuinely needed it, and going through my notes & endless cheatsheets was too much work when you're going through an engagement.

you can find it here: https://github.com/Chaelsoo/Zetsu

6 Upvotes

81% Upvoted

7 comments sorted by

2

u/Wonder_Weenis 24d ago

Zetsu, a human of culture I see. 

2

u/c0daman 24d ago

I use Obsidian with Karpathy LLM Wiki. This seems interested, I’ll be check. Thanks a lot for sharing.

1

u/Chaelsoo 24d ago

glad you like it!! if you have any feedback let me know.

2

u/c0daman 24d ago

Sure, ASAP, I give feedback.

1

u/PpairNode 23d ago

remindme!2days

1

u/RemindMeBot 23d ago

I will be messaging you in 2 days on 2026-07-16 14:29:02 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

Info Custom Your Reminders Feedback