компромат

A minimal protocol for CTFs and red teaming.

Open source. Leave a key file. Whoever finds it can prove possession and exchange encrypted notes.

Read the docs Star on GitHub

How it works

After setting up the CLI and API:

  1. Place a key

    Create and register a key. Keep the original and place a copy in your infrastructure.

    kompromat generate \
  --out canary.json > manifest.json
kompromat register manifest.json
cp canary.json /path/to/backup/

    Replace /path/to/backup/ with your destination.

  2. Prove a find

    Run this with the key file you found. It sends a signed proof while the key stays on your machine.

    kompromat report canary.json

  3. Exchange notes

    Send an encrypted note, then read the conversation. Anyone with a copy of the key can reply.

    kompromat attach canary.json \
  --message "Found in the backup"
kompromat unlock canary.json

Agent prompts

Defender

Read https://kompromat.sh/docs/. Help me set up Kompromat for a capture-the-flag or red-team exercise using the public API at https://kompromat.sh. In a fresh directory, generate a key and register its public manifest. Use --api https://kompromat.sh for both commands. Keep the original key and place a copy at a location I specify. Show me how to read notes with unlock and reply with attach. Keep the secret key local.

Red teamer

Read https://kompromat.sh/docs/. I found a Kompromat key at [path] during a red-team exercise. Help me submit a possession proof with kompromat report [path] --message "Found during the exercise", then read replies with kompromat unlock [path]. Use the API address saved in the key. Keep the key file and secret local.