RELEASED  ●  v3.7.1

HAWKEYE

3,092 CVE attack flows. Zero false positives. Vulnerability intelligence from scan to shell to report — nmap NSE scanning, live NVD enrichment, MITRE ATT&CK, and 3,376 Metasploit exploit pairs where every detection is a real, module-verified attack path. Discover, inject, exploit, loot, and report — in one native GUI.

Rust + egui Debian / Kali / Ubuntu x86-64 Live NVD + MITRE feeds
3,092
CVE ATTACK FLOWS
3,376
EXPLOIT PAIRS
0
FALSE POSITIVES
5
AI COPILOTS

Five walkthroughs. Scan to shell to report.

A five-part series showing HawkEye on live targets — from the first sweep to source-and-supply-chain analysis. No slides, no mockups: the real engine on real hosts.

01Network & Vulnerability Scanning
02Network & Vulnerability Profiling
03Deep Vulnerability CHAIN Proofing
04Source Code & Supply-Chain Analysis
05Overview of Other Features

3,092 CVE attack flows. Zero false positives.

Other scanners flood you with "maybes." HawkEye maps 3,092 CVEs to 3,376 Metasploit exploit pairs — every detection is a real, fireable attack path. And before anything lands in your report as a finding, it's proven.

Proof, not guesswork
Every attack is verified by the exploit module's own check — the authoritative source. Vulnerable, not vulnerable, or inconclusive. No hand-waving, no CVSS-by-version guessing.
Module-verified
🛡
The ABS: a script error is not a false positive
A fumbled exploit or a network hiccup can't downgrade a real vulnerability. If check proved the target vulnerable, the report says so — an operator's mistake never becomes a "false positive."
Anti-mis-mark
🎯
3,376 pairs, one logic
The same detect → map → stage → prove pipeline runs across the entire Metasploit base. EternalBlue, BlueKeep, ZeroLogon, PrintNightmare, Log4Shell and 3,000+ more — all held to the same standard.
Same logic, every CVE

An AI copilot that actually drives the engagement.

Not a chat box bolted on. HawkEye feeds the live engagement state to the model of your choice — cloud or a fully-local one you control — and turns its judgement into action.

🧠×N
Multi-AI Consensus
Ask the same question across Claude, OpenAI, Gemini, Ollama and Newton in parallel and see them side by side. Agreement between independent models is a confidence signal — no single point of hallucination.
Cross-checked
🧭
Next-Step Engine
The AI reads what you've found and proposes the next moves — "EternalBlue → domain on .102", "secretsdump the DC", "RDP-lateral to the workstation" — each rendered as a one-click button that fires the real attack chain.
Suggestion → shell, one click
📄
AI Report Author
Fold an AI-written executive summary straight into the auto-saved HTML report — client-ready posture, business risk and priorities in plain language, on top of the topology graph and findings tables.
Written analysis, not just tables
🔒
Local-First Privacy
Run a fully-local model via Ollama or your own Newton endpoint — client data never leaves the box. A one-toggle local-only mode disables every cloud backend, with a clear warning before anything is ever sent out.
Client data stays on-box

Every button is also a command.

The whole GUI is a thin skin over one engine — and that engine is fully driveable from the shell. Same scans, same CVE intel, same clean attack chains, same reports, now scriptable into CI, cron, a remote SSH box, or an AI agent. hawkeye <command> --help documents every verb; run with no arguments to launch the GUI.

Full CLI parity
scan · dast · source · cve · autopentest · learn · rogue · aggressive · report · history · arsenal · ai — every workflow the GUI exposes, plus --format json on every command for clean machine parsing.
CI-able · JSON out
🤖
Agentic pentest driver
hawkeye ai agent scans, asks the model to prioritise, then auto-runs the safe recon steps and hands you clean-compromise scaffolds — looping over hosts enumeration surfaces.
Scan → plan → act
🛑
Safe by construction
The agent runs recon on its own, but never auto-fires an exploit. Clean chains are scaffolded behind --authorize; the destructive EternalBlue path is refused unless you explicitly opt in. A DoS is a failed pentest — the tool won't sell you a crash as a win.
Clean in-and-out first
📂
Day-2 resume
hawkeye history list / resume restores a saved engagement — findings, auto-pentest report and settings — so you pick up at the customer exactly where you left off.
Lossless engagement state

Example usage & what you get back:

# 1. Scan a subnet, get machine-readable findings for a pipeline
$ hawkeye scan 10.0.110.0/24 --profile full --format json
→ [{"host":"10.0.110.102","port":445,"cve_id":"CVE-2017-0144","severity":"Critical",
     "title":"SMBv1 MS17-010","msf_modules":["exploit/windows/smb/ms17_010_eternalblue"], ...}]

# 2. Look up / search CVE intelligence from NVD
$ hawkeye cve CVE-2021-42278
→ ── CVE-2021-42278 ──  CVSS 8.8  (HIGH)
   Active Directory sAMAccountName spoofing (NoPac). ...
$ hawkeye cve --search "smb signing" --limit 5

# 3. Source / repo assessment — SAST + SBOM + secure-practice audit
$ hawkeye source ./target-app --format json     # findings[] as JSON

# 4. Emit a CLEAN attack-chain scaffold (nothing fires without you)
$ hawkeye aggressive nopac --target 10.0.110.100 --domain lab.local \
      --user joe --pass 'Summer2024' --authorize
→ ✔ CLEAN — CVE-2021-42278/42287: low-priv domain user → Domain Admin → dump. No crash.
   scaffold: reports/scaffolds/CLEAN_nopac_10-0-110-100.sh
$ hawkeye aggressive eternalblue --target 10.0.110.102 --authorize
→ ☠ blocked — destructive (BSOD/DoS risk). Prefer a clean chain; --accept-destructive to override.

# 5. AGENTIC MODE — scan, let the model plan, auto-run the safe recon, scaffold the rest
$ hawkeye ai agent 10.0.110.0/24 --drive --authorize --backend ollama
→ ╔══ HawkEye agentic AI pentest ══╗
   policy: clean in-and-out wins · a DoS is a FAILED pentest · destructive = opt-in only
   ── round 1/2 · scanning 1 target(s) ──
   [CRITICAL] 10.0.110.102:445  CVE-2017-0144  SMBv1 MS17-010
   ── AI-recommended next steps (clean-first) ──
     1. [recon      ] ENUM   10.0.110.100 — enumerate AD, MachineAccountQuota looks open
     2. [clean      ] NOPAC  10.0.110.100 — low-priv → Domain Admin, no crash
     3. [DESTRUCTIVE ] ETERNALBLUE 10.0.110.102 — last resort, may BSOD
   ▶ auto-run ENUM on 10.0.110.100 …
   ✔ scaffolded NOPAC → reports/scaffolds/CLEAN_nopac_10-0-110-100.sh
   ☠ REFUSED to auto-arm ETERNALBLUE — destructive. Prefer a clean chain.
   ── AI engagement summary ── most likely clean path: NoPac → DA → NTDS dump ...

# 6. Report + day-2 resume
$ hawkeye report 20260712_lab.json --format html -o engagement.html
$ hawkeye history list          # → saved engagements, [resumable]
$ hawkeye history resume <id>    # → full state as JSON, pick up where you left off

It knows a phone when it sees one — and it won't cry wolf.

Two upgrades land in 3.6. HawkEye now recognises mobile devices on the wire and carries a curated mobile vulnerability knowledge base — headlined by IonStack, the one-click Android 17 root chain. And every finding now gets an explicit validation verdict: HawkEye re-checks its own work and tells you what's proven versus what to verify. That's the whole difference between a tool that sprays a thousand modules and one a client actually trusts — our edge is truth, not stealth.

📱
Mobile device recognition
Scans now classify hosts as Android / iOS from OS fingerprint, device-debug ports (5555/5037 ADB, 62078 lockdownd) and hostname — then apply the checks that actually fit a handset instead of treating it like a server.
Android · iOS · BYOD
IonStack + mobile vuln KB
IonStack (CVE-2026-10702 Firefox IonMonkey JIT RCE → CVE-2026-43499 "GhostLock" kernel UAF) plus Dirty Pipe, Stagefright, BlueBorne, Janus, SockPuppet & Operation Triangulation — surfaced as posture advisories to verify against the on-device patch level. Exposed ADB is flagged as a real, clean win.
1-click root · patch posture
Validation-first verdicts
Every finding is labelled CONFIRMED, POTENTIAL FALSE POSITIVE, FALSE POSITIVE or UNVALIDATED — from a safe TCP re-probe and static reasoning, never an exploit or a DoS. Version-inferred and host-side findings say so; disproved ones are demoted automatically.
No FP-laden reports
🧩
Friendly module catalog
hawkeye modules browses every capability as a named module — each declaring how it validates a finding. Our answer to the "1150 modules" pitch: no evasive/polymorphic payloads, just honest, checkable coverage.
Truth > stealth

Example usage & what you get back:

# 1. Scan finds a phone: exposed ADB is a real win; IonStack is flagged to verify
$ hawkeye scan 10.0.110.0/24 --validate
→ [CRITICAL] 10.0.110.60:5555  Android Debug Bridge (ADB) exposed — Remote Code Execution
   [    HIGH] 10.0.110.60:-    Android device — potentially exposed to IonStack 1-click root chain
   validation: 1 CONFIRMED · 2 POTENTIAL FP · 0 FALSE POSITIVE · 0 UNVALIDATED

# 2. Browse the module catalog (KittySploit-style), filter by category
$ hawkeye modules --category mobile
→ [mobile] mobile-recognise      Mobile device recognition
   [mobile] mobile-adb           Android ADB-over-TCP exposure
   [mobile] mobile-ionstack      IonStack 1-click Android root (posture)
   [mobile] mobile-kb            Mobile vuln knowledge base

# 3. Full detail for one module — including exactly how it validates
$ hawkeye modules mobile-ionstack
→ ── IonStack 1-click Android root (posture) [mobile-ionstack] ──
   cve: CVE-2026-10702 + CVE-2026-43499   safety: Safe
   validation: host-side/click chain — NOT wire-observable → POTENTIAL FALSE POSITIVE by
   design; verify Firefox ≥151.0.3 and June-2026+ Android patch on-device.

# 4. Validation-first triage: re-check findings, label each with a verdict + confidence
$ hawkeye validate 10.0.110.60 --format json
→ [{"finding_id":0,"verdict":"CONFIRMED","confidence":85,
     "method":"TCP re-probe: 10.0.110.60:5555 reachable"},
    {"finding_id":1,"verdict":"POTENTIAL FALSE POSITIVE","confidence":50,
     "method":"posture check — host-side chain, not observable over the network"}]

# 5. The agentic driver now reasons over VERDICTS, not raw guesses
$ hawkeye ai agent 10.0.110.0/24 --drive --authorize
→ prioritising CONFIRMED findings first; POTENTIAL FALSE POSITIVE flagged to verify,
   FALSE POSITIVE ignored — no wild goose chases, no crash sold as a win.

Now it doesn't cry wolf about your code either.

In 3.6 every network finding got a validation verdict. In 3.7 the same honesty reaches Source Assessment. A raw regex hit is only a candidate — HawkEye now consults your repo's git history to decide the truth: a secret committed to history is CONFIRMED (leaked forever — rotate it), a match in an untracked or test/fixture file is flagged POTENTIAL FALSE POSITIVE, and every matcher is graded precise / normal / noisy so a broad pattern never masquerades as a proven bug. Optionally, a local AI takes a second look — with the scanned code fenced as untrusted data, so a booby-trapped comment can't hijack it.

🕓
Git-history revalidation
Each code finding is re-judged against git: a committed secret is CONFIRMED (it's in history permanently, even if a later commit deletes it), an untracked/local file or a /tests/·/fixtures/ path is demoted to POTENTIAL FALSE POSITIVE. Findings carry the committing author/date for provenance.
Don't cry wolf · code edition
🎚
Confidence-tiered matchers
Every SAST rule is graded precise (an AKIA… key, a PEM header — stands on its own), normal, or noisy (a bare eval(, the word MD5 — needs verifying). Noisy hits are born as POTENTIAL FALSE POSITIVE. Grow your own rules in ~/.hawkeye/sast-rules.json.
precise · normal · noisy
🛡
Prompt-injection-safe AI audit
--ai-investigate asks a local model to adjudicate the un-confirmed findings — but the scanned code is fenced as untrusted data and the model is told never to obey instructions hidden in a comment or string. It may only confirm or downgrade, never invent.
ignore-previous-instructions ✗
🔑
SSH deploy-key connector
Assess a private repo without leaving the app: generate an ed25519 deploy key with one click, copy the public half to install on the host, bind it to the repo. Plus --diff main to scan only files changed vs a ref (a fast PR/CI gate) and a per-file SHA-256 cache that skips unchanged files on re-scan.
private repos · PR gate · resume

Example usage & what you get back:

# 1. Assess a repo — findings now carry a git-informed VERDICT
$ hawkeye source ./checkout --sast
→ [CRITICAL] Hardcoded AWS access key id — src/config.py   «CONFIRMED»
     GIT REVALIDATION: secret is COMMITTED to git history — rotate it
     last commit: a1b2c3d · alice · 2025-11-02
   [    HIGH] Hardcoded credential — tests/fixtures/seed.py  «POTENTIAL FALSE POSITIVE»
     GIT REVALIDATION: in a test/fixture path — likely a mock; verify
   [     LOW] Use of weak hash (MD5) — src/util.js          «POTENTIAL FALSE POSITIVE»
     matcher tier: noisy — verify before reporting

# 2. PR/CI gate: scan only what changed vs main
$ hawkeye source ./checkout --diff main
→ SAST: --diff 'main' → 3 changed source file(s)

# 3. Let a LOCAL model adjudicate the un-confirmed findings (injection-safe)
$ hawkeye source ./checkout --sast --ai-investigate --ai-backend ollama
→ AI investigate: 4 adjudicated, 1 downgraded to FALSE POSITIVE

# 4. Generate an SSH deploy key for a private repo — copy the public half
$ hawkeye sshkey gen prod-deploy
→ ✔ generated SSH deploy key 'prod-deploy'
   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5… hawkeye-prod-deploy
   Install this PUBLIC key as a read-only deploy key on the repo host.

The verdict rides the same status badge as network findings — in the GUI, in --format json, and in the AI's engagement context. One honesty model, everywhere.

Seven phases. One tool.

Most vuln scanners stop at "here's a finding." HawkEye takes you from raw port to professional report with ATT&CK context and MSF commands at every step.

PHASE 01
Scan Engine
Nmap NSE vuln scripts over five profiles — Quick, Full, Web App, Stealth, Custom. Live output. Auto CVE extraction from script output.
PHASE 02
CVE Intelligence
Every CVE ID enriched in real time from NVD API v2 — CVSS score, description, CPE. OWASP Top 10 category. Keyword CVE search built in.
PHASE 03
ATT&CK Mapping
Findings automatically mapped to MITRE ATT&CK techniques across all 14 tactics. Coverage heatmap. Metasploit module suggested per finding.
PHASE 04
PoC Intelligence
Chain findings into a kill chain. Fetch live ExploitDB PoC code per CVE. Generate MSF resource scripts. Launch msfconsole directly. Python exploit scaffolds pre-filled with target data.
PHASE 05
Professional Report
One click → branded HTML report. SVG donut chart, severity grid, ATT&CK coverage table, full findings with MSF commands and remediation steps.

Everything in the loop.

No tab-switching between five different tools. No copy-pasting CVE IDs into NVD. No writing reports by hand.

Nmap NSE Vuln Scanning
Runs the full nmap vuln script category plus HTTP, SSL, SMB, and service-specific scripts. Parses XML output into structured findings automatically.
200+ NSE scripts
🗄
Live NVD CVE Enrichment
Every CVE extracted from scan output is looked up in real time via NVD API v2. CVSS v3 score, full description, affected CPEs, and references pulled automatically.
NVD API v2
🎯
MITRE ATT&CK Mapping
Findings mapped to ATT&CK techniques across all 14 tactics. Direct CVE→technique map for 30+ high-value CVEs. Keyword fallback for everything else. Click to open MITRE.
STIX-aligned
🔫
3,376 Metasploit Attack Pairs
The complete CVE→exploit map, generated from Metasploit's own module metadata — 3,092 CVEs across 3,376 module pairs. Every CVE we detect that has a Metasploit module becomes a ready-to-fire, staged attack. Not a curated handful — the whole framework.
3,092 CVE flows
Aggressive Pentest — Attack Chains
One-click chains against discovered hosts: EternalBlue→SYSTEM→domain-hash dump, psexec, secretsdump, Kerberoast, RDP lateral. Recon → inject rogue VLANs/subnets → exploit → loot — the whole engagement, operator-gated.
Recon → shell → domain
🧠
AI Assist — Analyst Copilot NEW v3
Pluggable AI over your findings: Claude, OpenAI, Gemini, a fully-local Ollama model, or your own Newton endpoint. Triage by real risk, get authorized next steps + tooling, and draft client remediation — throttled for rate/cost, private when you run it local.
Claude · OpenAI · Gemini · Ollama · Newton
💣
PoC Intelligence
Fetch live ExploitDB PoC code for any CVE. Auto-generate MSF resource scripts (LHOST/LPORT pre-filled). Python3 exploit scaffolds written to disk, ready to customise.
ExploitDB + MSF + Python
🔬
9,000+ Nuclei Templates
Runs the full projectdiscovery/nuclei-templates library natively — no nuclei binary required. CVEs, misconfigurations, exposed panels, default logins, and technology fingerprints.
Auto-sync on launch
📄
Professional HTML Report
Dark-themed, print-ready HTML report. SVG donut chart, per-severity counts, MITRE ATT&CK coverage table, every finding with CVSS, CVE link, MSF, OWASP, and remediation.
PDF-quality output

Know your coverage.

The ATT&CK tab shows which techniques were triggered across all findings — grouped by tactic, counted, and linked directly to MITRE. Know exactly where the attack surface is before you write a word.

Initial
Access
T1190
Execution

T1059
Persistence
 
Priv Esc

T1068
Def Evasion
 
Cred Access

T1003
Discovery

T1083
Lateral Mov

T1210
Collection
 
C2

T1071
Exfil
 
Impact

T1498
Recon
 
Res Dev
 

Report in one click.

Fill in client name, author, and classification. Click Generate. An HTML report opens in your browser — print to PDF or send as-is. Same format your clients expect.

  • SVG severity donut + per-category counts
  • MITRE ATT&CK coverage table by tactic
  • Every finding: CVSS, CVE link, techniques, MSF commands, OWASP, remediation
  • Classification banner (CONFIDENTIAL, RESTRICTED, etc.)
  • Auto-opens in browser, print-to-PDF ready
hawkeye-report-1749703200.html
⚠ CONFIDENTIAL ⚠
EXECUTIVE SUMMARY
3
CRITICAL
7
HIGH
12
MEDIUM
4
LOW
MITRE ATT&CK COVERAGE
Initial Access · Execution · Privilege Escalation · Lateral Movement · Credential Access
FINDINGS
CRITICAL · CVE-2021-44228 · Log4Shell on 10.0.1.5:8080
HIGH · CVE-2017-0144 · EternalBlue on 10.0.1.12:445
+24 more findings…

Where does HawkEye fit?

Nessus and OpenVAS find network vulnerabilities. Acunetix goes deep on browser-based web DAST — and stops there. None of them exploit what they find, chain it into a domain takeover, or hand you an AI second opinion. HawkEye does all of it in one operator-grade desktop tool: a 190K+ check arsenal it drives natively (Nmap NSE, OpenVAS NVTs, 9K+ Nuclei templates, Nikto, CMS, headless DAST), then 3,092 CVEs mapped to 3,376 fireable Metasploit modules and automated attack chains — EternalBlue → SYSTEM → domain-hash dump, secretsdump, Kerberoast, RDP lateral — every finding a module-verified attack path, not a version-guess (zero false positives). It detects rogue gateways, rogue networks and rogue VLANs host-scanners never look for, recognises mobile devices and exposed ADB (RCE), and proves upload→RCE with a harmless beacon — never a payload. Then a multi-model AI copilot (Claude, OpenAI, Gemini, local Ollama, or your Newton endpoint — with cross-model consensus) triages, suggests the next fireable move, and writes the client report. No subscription. No cloud required. Your data stays yours.

Capability ◈ HawkEye Nessus OpenVAS Acunetix Intruder Indusface ManageEngine SiteLock Tripwire
Network / infrastructure scanning ✓ 190K+ checks
Nmap NSE · OpenVAS · Nuclei · Nikto · CMS · Katana
✓ 185K plugins ✓ 170K+ NVTs basic partial ✓ agent ✓ enterprise
TRUE attack validation — zero false positives ✓ module-verified ✗ version-guess ✗ version-guess web proof-based
Rogue gateway detection
Rogue network / subnet discovery ✓ auto-recurse manual scope manual scope
Rogue VLAN detection & hopping ✓ 802.1Q
Web app scanning (DAST) ✓ best-in-class
9K templates · CDP crawl · SQLi/XSS/SSTI/LFI/cmdi · SSRF/XXE OOB · exploit-verified
basic plugins basic ✓ deep DAST ✓ OWASP web agent malware only
JavaScript / SPA scanning ✓ Chromium CDP ✓ Chromium partial partial
API scanning (OpenAPI / GraphQL) ✓ spec + GraphQL ✓ spec import partial partial
Live NVD CVE enrichment (real-time) ✓ NVD API v2 vendor cycle vendor cycle web CVEs only
MITRE ATT&CK auto-mapping ✓ 14 tactics partial
Metasploit attack mapping ✓ 3,376 exploit pairs
3,092 CVEs → fireable modules
Automated exploitation & attack chains ✓ EternalBlue→domain, secretsdump, Kerberoast, RDP
AI analyst copilot (multi-model) ✓ Claude/OpenAI/Gemini/Ollama/Newton
consensus · next-step engine · report author · local-first
Mobile device & ADB/RCE detection ✓ Android/iOS + exposed-ADB RCE OS fp only OS fp only MDM only
Benign upload→RCE proof (OOB-verified) ✓ harmless canary beacon detects only
ExploitDB PoC fetch + scaffold ✓ live fetch
Kill chain / scenario builder
OWASP Top 10 mapping partial partial
Stealth / custom scan profiles ✓ 5 profiles partial partial
Professional report (one click) ✓ built-in basic
Native desktop GUI ✓ Rust/egui ✗ web UI ✗ web UI ✗ SaaS ✗ SaaS ✗ SaaS ✗ web UI ✗ SaaS ✗ web UI
Price -NA- $4,390/yr Free $4,995/yr+ $101/mo+ $59/app/mo $695/yr $15/mo+ Enterprise

Browser-Engine DAST

Chromium headless engine with Chrome DevTools Protocol (CDP). Detects vulnerabilities invisible to static HTTP scanners: DOM-based XSS (URL param → dangerous sink, fragment injection), client-side template injection (Angular/Vue/React), prototype pollution via JSON.parse, postMessage origin bypass, open redirects in JS routing, sensitive data in localStorage/sessionStorage, SPA framework dev-mode detection, and dynamic form endpoint discovery.

DOM XSS CSTI (Angular/Vue) Prototype Pollution PostMessage Bypass localStorage PII SPA Forms Discovery

Exploit Chaining & Report Engine

Automated kill-chain engine with 15+ MITRE ATT&CK patterns. Detects multi-step attack paths from your findings: SQLi→credential dump→pivoting, XSS→session hijack→account takeover, SSRF→cloud metadata→IAM theft, subdomain takeover→phishing, prototype pollution→RCE, and more. Includes remediation priority roadmap (CVSS + EPSS + CISA KEV), scan history with delta comparison, and push integrations for Jira, Linear, Slack, and generic webhooks. One-click PDF export via headless Chromium.

15+ Kill Chain Patterns Remediation Roadmap Scan History & Delta Jira / Linear / Slack PDF Export

Built for operators, priced for operators.

One seat per operator. Licensed per operator year — usage is registered server-side for compliance and audit purposes.

Licensing paused. Due to a general lack of engagement, this project has gone private. Already-issued licenses will continue to work, but no new licenses will be issued to the general public at this point in time.
ARSENAL
All 9 Tools
-NA-
per operator / month
  • HawkEye Pro
  • Email Pentest Sidekick
  • AD Pentester Sidekick
  • PrivEsc Pentester Sidekick
  • InfraScan Pentester Sidekick
  • CredDump, DFIR, NHH Crack Server
Get Arsenal License