Architecting a Custom Purple Team Infrastructure Scanner in Go.

By Mohamed Medjahdi, a Security Engineer and DevSecOps Specialist, Purple Teaming often suffers from excessive noise and poor coordination when simulating attacks. This led him to create OmniScan, an advanced offensive security suite written entirely in Go. The motivation for building OmniScan stemmed from the need for concurrency, state management, and TLS interception to automate misconfiguration detection and threat actor reconnaissance across complex cloud infrastructures.

The architecture of OmniScan is split into two core engines: the Crawler Engine, built on colly for asynchronous web crawling with JavaScript endpoint extraction and Cloudflare bypass capabilities, and the Pipeline Orchestrator, a DAG execution engine that orchestrates external tools via YAML configurations. OmniScan's Pipeline Engine utilizes Go's sync.WaitGroup to run independent steps concurrently, ensuring efficient performance when handling thousands of endpoints and complex tasks.

One standout feature of OmniScan is the techFinder module, which uses a headless Chrome browser to inspect the actual DOM, evaluate JavaScript variables, and intercept network requests. This module identifies WAFs, JavaScript frameworks, and backend services with greater accuracy than standard fingerprinting methods. The techFinder runs in a controlled Process Group to manage resource-intensive tasks and ensure proper cleanup of Chrome instances when necessary.

OmniScan also includes a real TLS-intercepting MITM proxy called authscan. This proxy generates a local Certificate Authority on-the-fly when routing browsers through OmniScan, allowing automated Privilege Escalation (PrivEsc) and Insecure Direct Object Reference (IDOR) testing. The authscan module simplifies the process of fetching resources with high and low-privileged sessions, analyzing differences in status codes, content length, and DOM structure to identify vulnerabilities.

To ensure safe defaults during automated testing, destructive methods such as PUT, DELETE, and PATCH are only allowed with an explicit --allow-destructive flag in OmniScan. The suite aims to significantly reduce manual reconnaissance time and false-positive filtering during Purple Team engagements, with plans to integrate Local LLMs into the reporting pipeline for generating natural language attack narratives for stakeholders. OmniScan is being finalized and will be open-sourced on GitHub in the near future.