Release the RAVEN: Kibana Under Siege

This report (Part 3 of the "Release the RAVEN" series) demonstrates RAVEN's offensive modules targeting Kibana on port 5601: kb-recon (fingerprinting and plugin detection), kb-cve (CVE scanning and exploitation, including CVE-2018-17246 LFI and CVE-2019-7609 Timelion prototype-pollution RCE), and kb-loot (extraction of saved objects, dashboards, and embedded credentials). It describes a lab-verified, fully automated Timelion RCE chain that uses template pre-caching and a headless-browser trigger to force worker forks and achieve code execution, and highlights that Kibana is often an overlooked, high-risk attack surface.