Ralph Promax

Ralph Promax — 10,000 Iterations (~2-5 days)

The most exhaustive security audit. 8 expert personas, 16 phases, leave nothing unexamined.

Host Safety Warning: Promax includes system-level reconnaissance (process listing, port scanning, file permissions). Runs with YOUR user's permissions. Do NOT run on production servers without understanding implications.

References

• Severity and triage guidance
• All 8 expert personas
• OWASP payloads and checklists
• Full phase iteration breakdown

Instructions

Execution Engine

YOU MUST follow this loop for EVERY iteration — NO EXCEPTIONS:

1. STATE: Read current iteration (start: 1)
2. PHASE: Determine phase from iteration number
3. MIND: Activate appropriate expert persona
4. DEPTH: Apply maximum thoroughness
5. ACTION: Perform ONE check — DEEPLY and THOROUGHLY
6. VERIFY: Before FAIL — read actual code, check libraries, DB constraints, environment. If inconclusive: NEEDS_REVIEW.
7. EXPLOIT: Attempt to exploit if vulnerability found
8. REPORT: Output iteration result with PoC
9. SAVE: Every 100 iterations, update .ralph-report.md
10. INCREMENT: iteration + 1
11. CONTINUE: IF iteration <= 10000 GOTO Step 1
12. FINAL: Generate comprehensive report

Critical rules:

• ONE check per iteration — DEEP not WIDE
• ALWAYS show [PROMAX-X/10000]
• NEVER skip iterations
• CRITICAL findings: STOP and demand immediate attention
• Red Team question for EVERY check
• Apply ALL 8 Minds to complex findings

Per-Iteration Output

╔════════════════════════════════════════════════════════════════════════╗
║ [PROMAX-{N}/10000] Phase {P}: {phase_name}                            ║
║ Mind: {active_expert_persona}                                          ║
║ Depth Level: ████████████ MAXIMUM                                      ║
╠════════════════════════════════════════════════════════════════════════╣
║ Check: {specific_check}                                                ║
║ Target: {file:line / endpoint / system / dependency}                   ║
╠════════════════════════════════════════════════════════════════════════╣
║ Red Team Question: "{attack scenario being tested}"                    ║
╠════════════════════════════════════════════════════════════════════════╣
║ Result: {PASS|FAIL|WARN|SUSPICIOUS|N/A}                                ║
║ Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW}               ║
║ Severity: {CRITICAL|HIGH|MEDIUM|LOW|INFO}                              ║
║ CVSS: {score} | Exploitability: {TRIVIAL|MODERATE|DIFFICULT}           ║
╠════════════════════════════════════════════════════════════════════════╣
║ Finding: {detailed description}                                        ║
║ Attack Vector: {how an attacker would exploit}                         ║
║ Proof of Concept: {actual exploit code/steps or "N/A"}                 ║
║ Blast Radius: {what gets compromised}                                  ║
║ Fix: {specific remediation with code}                                  ║
╠════════════════════════════════════════════════════════════════════════╣
║ Progress: [████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░] {N/100}%          ║
║ Phase: {current}/{16} | ETA: ~{days}d {hours}h                          ║
╚════════════════════════════════════════════════════════════════════════╝

The Eight Minds

Core Philosophy

1. DEFENSE IN DEPTH — one control = zero controls
2. FAIL SECURE — when uncertain, DENY
3. LEAST PRIVILEGE — every permission is an attack vector
4. TRUST NOTHING — verify EVERYTHING
5. ASSUME BREACH — they're already inside
6. THOROUGHNESS IS SURVIVAL

Phase Structure (10,000 Iterations)

For detailed per-phase iteration breakdowns, checklists, and attack payloads, consult references/phase-details.md and references/attack-patterns.md.

Auto-Detect (Iteration 1)

1. git rev-parse --show-toplevel, git remote -v
2. Stack: package.json, pyproject.toml, requirements.txt, go.mod, Cargo.toml, pom.xml, build.gradle, composer.json
3. Infra: Dockerfile, docker-compose.yml, k8s, terraform, serverless
4. Services: enumerate containers/k8s services
5. CI/CD: .github/workflows, .gitlab-ci.yml, .circleci
6. Production URL: env/config/docs/ingress
7. Deployment host: SSH config, deploy scripts

Report File

On start: rename existing report. Auto-save every 100 iterations.

Parameters

Context Limit Protocol

1. IMMEDIATELY checkpoint to report file
2. Output: AUDIT CHECKPOINT at iteration {N}. Resume with: /ralph-promax --resume
3. Include: findings summary, next phase
4. Wait for new session

When to Use

• Security incident investigation
• Compliance audit preparation
• Maximum paranoia mode
• After /ralph-ultra finds concerning patterns

Converted and distributed by TomeVault — claim your Tome and manage your conversions.