Orchestration Module Reference

Orchestration Module Reference

If you are new to OCI or OCInferno, read Getting Started first.

This reference is generated from the current module mappings and parser flags in source code. It covers the modules run runner flags plus the cross-cutting Everything/OpenGraph modules. Per-service read-only enumeration modules live in Enumeration-Module-Reference; offensive write modules live in Exploit-Module-Reference.

Table of Contents

• Runner Flags (modules run)
• Everything Modules
  • enum_all
  • process_config_check
  • process_network_resources
• OpenGraph Modules
  • process_oracle_cloud_hound_data
  • process_og_node_color_images
• Enumeration Modules -> see Enumeration-Module-Reference
• Exploit Modules -> see Exploit-Module-Reference

Runner Flags (modules run)

These are wrapper-level flags handled by modules run before module-specific flags are passed through.

Flag	Purpose
--cids <ocid...>	Run against explicit compartment IDs (space/comma supported).
--current-cid	Run against only current session compartment.
--all-cids	Run against all discovered compartments in workspace context.
--proxy <url>	Override workspace proxy config for this run only.
-v, --debug	Enable debug logging for this run.
--get	Pass --get to modules that support it (ex. Call GetUser on each user after calling ListUsers).
--download [tokens...]	Pass --download to modules that support it. For enum_all, optional tokens or umbrella categories (metadata, content) are supported (for example --download buckets api_specs or --download metadata).

There is no --save/--no-save flag: enumeration always persists to the DB as it runs (gcpwn parity, no opt-in step).

Everything Modules

enum_all

• Service Group: Everything
• Example Resources: Compartments, IAM principals/domains, networking, storage, registries, vault resources (cross-service coverage).
• Category: Enumeration
• Module Path: modules.everything.enumeration.enum_all
• Author: Scott (@WebbinRoot)
• What It Does: Run cross-service enumeration in dependency order

Get/Download Notes

• --get is supported and is passed through to submodules that implement detail enrichment.
• No download flags means no download routing.
• --download with no tokens downloads all token groups.
• --download <tokens...> downloads only those token groups.
• --not-downloads <tokens...> by itself means "download all except these tokens".
• If both --download and --not-downloads are provided, exclusions are subtracted from the selected download set.
• Default download paths:
  • Root: ./ocinferno_output/<workspace>/downloads/ (module-specific subpaths below).

Supported Flags

Flag(s)	Description	Details
--comp	Enumerate compartments first via enum_comp. Current scope: also scans newly-discovered compartments in the SAME run. All scope: refreshes discovery then scans all discovered compartments. Combining --comp with --config-check/--opengraph and no explicit --modules still runs full service enumeration before the once-only step (this used to silently skip enumeration in that combo -- fixed).	action=store_true
--config-check	Run config_check once (after scans).	action=store_true
--download	Enable download routing for enum_all. Accepts individual tokens and/or umbrella categories (composable). Examples: --download # all downloads --download buckets # object storage content --download metadata # light: compute, api_content, api_specs, orm_jobs, function_config, container_env, devops_pipeline_config --download content # heavy: buckets, objects, blobs, object_storage, vault_secrets, artifacts, sdks, orm_variables, orm_templates, iot_models, iot_instances, certificate_bundles, dataflow_scripts, datascience_artifacts --download metadata vault_secrets # category + individual token composed Available individual tokens: api_content, api_specs, artifacts, blobs, buckets, certificate_bundles, compute, container_env, dataflow_scripts, datascience_artifacts, devops_pipeline_config, function_config, iot_instances, iot_models, object_storage, objects, orm_jobs, orm_templates, orm_variables, sdks, vault_secrets	nargs=*
--modules	Run only selected service groups (CSV/space separated); omit to run ALL. Accepts full tokens or short aliases (storage→object_storage, compute→core_compute, iam→identity, oke/k8s→kubernetes, kms→vault, lb→load_balancer, nlb→network_load_balancer, rm→resource_manager, db→databases, ar/cr/ci, …). Examples: --modules dns,devops OR --modules storage compute. Run --list-modules for the full token list.	nargs=*
--list-modules	List every --modules service token (with aliases) and exit.	action=store_true
--no-recursive-compartments	Do not recursively expand from root compartment(s). When set, enum_all scans only the provided root target compartment(s).	action=store_true
--not-downloads	Exclude download token groups or categories (CSV/space separated). Examples: --download --not-downloads object_storage --not-downloads api_specs,sdks Uses the same tokens/categories listed under --download.	nargs=*
--not-modules	Exclude selected service groups (CSV/space separated). Example: --not-modules object_storage Uses the same module tokens listed under --modules.	nargs=*
--opengraph	Run OpenGraph once (after scans).	action=store_true
--regions	Region scope for enumeration (CSV/space separated), e.g. --regions us-ashburn-1,us-phoenix-1 or --regions all (every subscribed region). Default: the session's current region only. Global services (IAM/identity, tagging, compartments) always run in the home region only, regardless of this flag.	nargs=*
--find-regions	Discover the tenancy's subscribed regions once (list_region_subscriptions), persist them, and enumerate across ALL of them -- shorthand for a fresh --regions all.	action=store_true
--parallel-services N	Run up to N service groups concurrently instead of sequentially.	type=int
--resume <token>	Resume a previous (interrupted or --parallel-services) run from its resume ledger instead of starting fresh.	string
--list-tokens	List resumable run tokens for this workspace/compartment scope and exit.	action=store_true

Example Module Commands

# Common use case: Enumerate everything, graph everything, and download all token groups.
modules run enum_all --comp --opengraph --download

# TLDR: Enumerate and download all EXCEPT object storage token groups.
modules run enum_all --not-downloads object_storage

# TLDR: Run full cross-service enumeration with no download routing.
modules run enum_all

# TLDR: List every --modules token (with aliases), then exit.
modules run enum_all --list-modules

# TLDR: Run selected service groups with detail enrichment (short aliases work too).
modules run enum_all --comp --modules identity,core_network --get

# TLDR: Same run using short aliases (storage=object_storage, compute=core_compute).
modules run enum_all --comp --modules storage,compute --get

# TLDR: Run selected services and download only selected artifact/content groups.
modules run enum_all --modules object_storage,resource_manager --download buckets,orm_variables

# TLDR: Run selected services and download only selected artifact/content groups.
modules run enum_all --comp --no-recursive-compartments --modules vault --download vault_secrets

process_config_check

• Service Group: Everything
• Example Resources: Saved config-audit findings, misconfiguration checks, compliance/risk signals derived from enumerated data.
• Category: Enumeration
• Module Path: modules.everything.processing.process_config_check
• Author: Scott (@WebbinRoot)
• What It Does: Run saved-data configuration audits

Supported Flags

Flag(s)	Description	Details
--json-out	Write findings JSON to a file path.
--quiet	Do not print report (still stores on session).	action=store_true
--services	Comma-separated services to audit (default: all 65 -- see the Config Checks Reference coverage table for the full current list, or run process_config_check --help which prints it dynamically from the live service-auditor registry). Example: api_gateway,networking,object_storage

Example Module Commands

# TLDR: Run module with default behavior and current scope.
modules run process_config_check
# TLDR: Run a targeted scenario using the provided filters/options.
modules run process_config_check --services iam,network --json-out ./ocinferno_output/config-check.json
# TLDR: Run a targeted scenario using the provided filters/options.
modules run process_config_check --quiet

process_network_resources

• Service Group: Everything
• Category: Process
• Module Path: modules.everything.processing.process_network_resources
• Author: Scott (@WebbinRoot)
• What It Does: Two-step saved-data network analysis. Step 1 (inventory): sweeps every saved service table and surfaces all network identifiers (IPs, CIDRs, URLs, FQDNs, subnet/VCN/NSG refs), grouped by kind and persisted to the network_inventory table. Step 2 (denormalize): inverts the subnet→security-list and subnet→route-table relationships, backfilling attached_subnet_ids onto each security-list and route-table row. Both steps are Process — no OCI API calls; run enum_all / enum_core_network first.

Supported Flags

Flag(s)	Description
--no-inventory	Skip the network-identifier sweep (step 1).
--no-denormalize	Skip the subnet denormalization backfill (step 2).
--kinds	Inventory: comma-separated kinds to include (default: all). Options: ip, cidr, fqdn, url, net_ref.
--table	Inventory: only sweep this one source table (e.g. compute_instances).
--value-contains	Inventory: only report values containing this substring.
--json-out	Inventory: write the full inventory JSON to a file path.
--quiet	Inventory: do not print the identifier tables (still persists and reports counts).
--no-security-lists	Denormalize: skip security-list backfill.
--no-route-tables	Denormalize: skip route-table backfill.

Example Module Commands

# Both steps (default)
modules run process_network_resources

# Only IPs and CIDRs, skip denormalization
modules run process_network_resources --kinds ip,cidr --no-denormalize

# Search for a specific prefix
modules run process_network_resources --value-contains 10.0.1 --no-denormalize

# Inventory only: sweep one table, export to JSON
modules run process_network_resources --table compute_instances \
  --json-out ./ocinferno_output/net.json --quiet --no-denormalize

# Denormalize only (skip inventory)
modules run process_network_resources --no-inventory

# Denormalize: security lists only
modules run process_network_resources --no-inventory --no-route-tables

---

OpenGraph Modules

process_oracle_cloud_hound_data

• Service Group: OpenGraph
• Example Resources: OpenGraph nodes/edges, IAM relationship graph, CloudHound export JSON.
• Category: Enumeration
• Module Path: modules.opengraph.processing.process_oracle_cloud_hound_data
• Author: Scott (@WebbinRoot)
• What It Does: Build OpenGraph nodes/edges and export OCI CloudHound JSON

Supported Flags

Flag(s)	Description	Details
--apply-custom-node-attributes	Push OCI custom node styles to BloodHound custom-nodes API after export.	action=store_true
--cond-eval	IAM: attempt conditional evaluation	action=store_true; dest=conditional_evaluation
--custom-nodes-token	Bearer token for custom-nodes API (or set OCINFERNO_CUSTOM_NODES_TOKEN).
--custom-nodes-url	BloodHound custom-nodes API endpoint.	default=http://127.0.0.1:8080/api/v2/custom-nodes
--debug	Enable debug logging	action=store_true
--debug-report	Write a debug report JSON alongside output	action=store_true
--drop-no-cond-perms	IAM: drop conditionals with no effective permissions. Modes: time, general, all (comma-separated; blank => all).	nargs=?; default=(False, False); metavar=MODES
--dynamic-groups	Run only the dynamic-group membership build step.	action=store_true; dest=dynamic_groups_only
--expand-inherited	IAM: expand inherited scope/location edges.	action=store_true; dest=expand_inheritance
--export-only	Skip builds; only export opengraph_* tables	action=store_true
--from-inventory <path>	Path to an OCI resource-inventory JSON file (from enum_resource_search --out ...). Additively emits an OCIGenericResource node per resource -- lets you build BloodHound data offline from a file, no live tenancy.
--groups	Run only the group membership build step.	action=store_true; dest=groups_only
--include-all	IAM: include all parsed IAM edges/nodes (not only default allowlist output).	action=store_true
--infer-domain	IAM: infer identity domains (optional domain hint; blank => Default).	nargs=?; metavar=DOMAIN
--max-split-mb <MB>	Target max size (MB) per split part (with --split).	type=float; default=90.0
--out	Output JSON path (default: session-managed export path)
--reset	Delete opengraph tables before build	action=store_true
--split	Split the export into size-bounded, self-contained OpenGraph part files + a manifest (for graphs that exceed BloodHound's upload limit).	action=store_true
--stream	Stream the single-file export node-by-node/edge-by-edge with a progress line (bounded memory for very large graphs).	action=store_true
--save	Pass-through flag for module-runner consistency; unused by this module.	action=store_true

Example Module Commands

# TLDR: Run a targeted scenario using the provided filters/options.
modules run process_oracle_cloud_hound_data --reset
# TLDR: Run a targeted scenario using the provided filters/options.
modules run process_oracle_cloud_hound_data --export-only --out ./ocinferno_output/opengraph.json
# TLDR: Run a targeted scenario using the provided filters/options.
modules run process_oracle_cloud_hound_data --expand-inherited --infer-domain

process_og_node_color_images

• Service Group: OpenGraph
• Category: Process
• Module Path: modules.opengraph.processing.process_og_node_color_images
• Author: Scott (@WebbinRoot)
• What It Does: Standalone BloodHound custom-node styling push. Re-applies OCI node color and image styles to an existing BloodHound instance without regenerating the full graph — useful after a BloodHound upgrade, after importing data manually, or any time you want to refresh node styles without re-running process_oracle_cloud_hound_data. Equivalent to process_oracle_cloud_hound_data --apply-custom-node-attributes but with none of the graph-build overhead.

Supported Flags

Flag(s)	Description
--custom-nodes-url	BloodHound custom-nodes API endpoint (default http://127.0.0.1:8080/api/v2/custom-nodes, or OCINFERNO_CUSTOM_NODES_URL).
--custom-nodes-token	Bearer JWT for the API (or OCINFERNO_CUSTOM_NODES_TOKEN).
--auth-mode	bearer (JWT, default) or signature (API key HMAC).
--custom-nodes-token-id	BloodHound API token ID for signature auth (or OCINFERNO_CUSTOM_NODES_TOKEN_ID).
--custom-nodes-token-key	BloodHound API token key/secret for signature auth (or OCINFERNO_CUSTOM_NODES_TOKEN_KEY).
--prompt-token	Prompt for bearer token or signature id+key if not supplied via flag/env.
--insecure	Disable TLS verification (local self-signed BloodHound only).

Example Module Commands

# Bearer auth via env var
export OCINFERNO_CUSTOM_NODES_TOKEN="your-bloodhound-jwt"
modules run process_og_node_color_images

# Bearer auth via flag
modules run process_og_node_color_images --custom-nodes-token YOUR_JWT

# Prompt for token interactively
modules run process_og_node_color_images --prompt-token

# Signature (API key) auth
modules run process_og_node_color_images --auth-mode signature \
  --custom-nodes-token-id TOKEN_ID --custom-nodes-token-key TOKEN_KEY

# Remote BloodHound instance
modules run process_og_node_color_images \
  --custom-nodes-url https://bloodhound.internal/api/v2/custom-nodes \
  --custom-nodes-token YOUR_JWT

---

Enumeration Modules

Every read-only, per-service enumeration module (enum_apigateway through enum_vault) is documented on its own page: Enumeration-Module-Reference.

Exploit Modules

OCInferno ships offensive (write) modules under the Exploit category, in modules/identityclient/exploit/. Each corresponds to a dangerous/privesc edge in OpenGraph (see Default Priv-Escalation Mode) and performs a mutating IAM action -- create/impersonate a user, add yourself to a group, mint an admin policy, etc. Read/exfil primitives (dump Vault secrets, function config/env, instance metadata) are not separate exploit modules -- they are --download/--dump flags on the relevant enum modules (enum_vault --dump, enum_functions --download, enum_core_compute --download). Most exploit modules support both classic IAM and identity-domain targets (--idd --domain-url ...).

Full plain-English descriptions, minimum-permission prerequisites, flag tables, and examples for all exploit modules: Exploit-Module-Reference.