The AI hacks. You set how far.
An AI pentest cockpit that plans the attack and runs it live — from approve-every-command to fully autonomous, on your leash.
Recon to Domain Admin, grounded in real technique knowledge, gated at every step.
/engage — point it at a target and walk awayInvoke it once, answer a short scoping interview, and HackPit runs the entire engagement itself — recon → rank → hunt every surface → chain findings → validate → write the report. No approve-each. One stop, then it goes silent until the findings land on your desk.
Scope-locked · every request audited · reports written, never auto-submitted · authorized targets only.
Tell it a target — a box, a domain, a bug-bounty scope.
It composes an attack path, each step from a real technique.
The AI suggests the next command — and the reason for it.
You okay it. Nothing runs until you do. Every time.
It executes in a sandbox and reasons from the result.
Describe a target → an ordered recon-to-privesc plan, built from a real knowledge base, not guesses.
The AI proposes each command; in manual mode you approve every one before it runs live.
Load BloodHound, see the route to Domain Admin, and walk it live over WinRM.
IAM privesc graphs, and one route stitched across web → cloud → on-prem.
Race conditions, request smuggling, cache poisoning, a token workbench, nuclei, an intruder.
Hand it your session and every scanner probes as you — most bounty bugs live behind auth.
For every action, the exact footprint a defender would see — telemetry, ATT&CK, the alert that fires.
OSCP / CPTS / H1 reports written from what you actually did, CVSS computed not asserted.
C2, tunnels, evasion, code audit, 155-tool arsenal — see the full catalogue.
:kali shell and a full :terminal (vim, msfconsole, evil-winrm).:exploits maps a service + version to public exploits.Runs entirely on your machine — no cloud, no account, nothing leaving your box. Use a fully local LLM or a frontier one. The repo ships code only; the knowledge base builds locally, so a fresh clone starts empty.
A real offensive tool — with C2, evasion and a live Windows/AD path. Run it only against systems you own or have explicit written permission to test. In engagement mode, your approval is the only thing bounding where a command goes.
The repo ships code only — the knowledge base is kept private, so a fresh clone starts empty. Build your own, or message me for full access. It won't hunt without one.