3,092 CVE attack flows. Zero false positives. Vulnerability intelligence from scan to shell to report — nmap NSE scanning, live NVD enrichment, MITRE ATT&CK, and 3,376 Metasploit exploit pairs where every detection is a real, module-verified attack path. Discover, inject, exploit, loot, and report — in one native GUI.
A five-part series showing HawkEye on live targets — from the first sweep to source-and-supply-chain analysis. No slides, no mockups: the real engine on real hosts.
Other scanners flood you with "maybes." HawkEye maps 3,092 CVEs to 3,376 Metasploit exploit pairs — every detection is a real, fireable attack path. And before anything lands in your report as a finding, it's proven.
check — the authoritative source. Vulnerable, not vulnerable, or inconclusive. No hand-waving, no CVSS-by-version guessing.check proved the target vulnerable, the report says so — an operator's mistake never becomes a "false positive."Not a chat box bolted on. HawkEye feeds the live engagement state to the model of your choice — cloud or a fully-local one you control — and turns its judgement into action.
The whole GUI is a thin skin over one engine — and that engine is fully driveable from the shell. Same scans, same CVE intel, same clean attack chains, same reports, now scriptable into CI, cron, a remote SSH box, or an AI agent. hawkeye <command> --help documents every verb; run with no arguments to launch the GUI.
--format json on every command for clean machine parsing.hawkeye ai agent scans, asks the model to prioritise, then auto-runs the safe recon steps and hands you clean-compromise scaffolds — looping over hosts enumeration surfaces.--authorize; the destructive EternalBlue path is refused unless you explicitly opt in. A DoS is a failed pentest — the tool won't sell you a crash as a win.hawkeye history list / resume restores a saved engagement — findings, auto-pentest report and settings — so you pick up at the customer exactly where you left off.Example usage & what you get back:
# 1. Scan a subnet, get machine-readable findings for a pipeline $ hawkeye scan 10.0.110.0/24 --profile full --format json → [{"host":"10.0.110.102","port":445,"cve_id":"CVE-2017-0144","severity":"Critical", "title":"SMBv1 MS17-010","msf_modules":["exploit/windows/smb/ms17_010_eternalblue"], ...}] # 2. Look up / search CVE intelligence from NVD $ hawkeye cve CVE-2021-42278 → ── CVE-2021-42278 ── CVSS 8.8 (HIGH) Active Directory sAMAccountName spoofing (NoPac). ... $ hawkeye cve --search "smb signing" --limit 5 # 3. Source / repo assessment — SAST + SBOM + secure-practice audit $ hawkeye source ./target-app --format json # findings[] as JSON # 4. Emit a CLEAN attack-chain scaffold (nothing fires without you) $ hawkeye aggressive nopac --target 10.0.110.100 --domain lab.local \ --user joe --pass 'Summer2024' --authorize → ✔ CLEAN — CVE-2021-42278/42287: low-priv domain user → Domain Admin → dump. No crash. scaffold: reports/scaffolds/CLEAN_nopac_10-0-110-100.sh $ hawkeye aggressive eternalblue --target 10.0.110.102 --authorize → ☠ blocked — destructive (BSOD/DoS risk). Prefer a clean chain; --accept-destructive to override. # 5. AGENTIC MODE — scan, let the model plan, auto-run the safe recon, scaffold the rest $ hawkeye ai agent 10.0.110.0/24 --drive --authorize --backend ollama → ╔══ HawkEye agentic AI pentest ══╗ policy: clean in-and-out wins · a DoS is a FAILED pentest · destructive = opt-in only ── round 1/2 · scanning 1 target(s) ── [CRITICAL] 10.0.110.102:445 CVE-2017-0144 SMBv1 MS17-010 ── AI-recommended next steps (clean-first) ── 1. [recon ] ENUM 10.0.110.100 — enumerate AD, MachineAccountQuota looks open 2. [clean ] NOPAC 10.0.110.100 — low-priv → Domain Admin, no crash 3. [DESTRUCTIVE ] ETERNALBLUE 10.0.110.102 — last resort, may BSOD ▶ auto-run ENUM on 10.0.110.100 … ✔ scaffolded NOPAC → reports/scaffolds/CLEAN_nopac_10-0-110-100.sh ☠ REFUSED to auto-arm ETERNALBLUE — destructive. Prefer a clean chain. ── AI engagement summary ── most likely clean path: NoPac → DA → NTDS dump ... # 6. Report + day-2 resume $ hawkeye report 20260712_lab.json --format html -o engagement.html $ hawkeye history list # → saved engagements, [resumable] $ hawkeye history resume <id> # → full state as JSON, pick up where you left off
Two upgrades land in 3.6. HawkEye now recognises mobile devices on the wire and carries a curated mobile vulnerability knowledge base — headlined by IonStack, the one-click Android 17 root chain. And every finding now gets an explicit validation verdict: HawkEye re-checks its own work and tells you what's proven versus what to verify. That's the whole difference between a tool that sprays a thousand modules and one a client actually trusts — our edge is truth, not stealth.
5555/5037 ADB, 62078 lockdownd) and hostname — then apply the checks that actually fit a handset instead of treating it like a server.hawkeye modules browses every capability as a named module — each declaring how it validates a finding. Our answer to the "1150 modules" pitch: no evasive/polymorphic payloads, just honest, checkable coverage.Example usage & what you get back:
# 1. Scan finds a phone: exposed ADB is a real win; IonStack is flagged to verify $ hawkeye scan 10.0.110.0/24 --validate → [CRITICAL] 10.0.110.60:5555 Android Debug Bridge (ADB) exposed — Remote Code Execution [ HIGH] 10.0.110.60:- Android device — potentially exposed to IonStack 1-click root chain validation: 1 CONFIRMED · 2 POTENTIAL FP · 0 FALSE POSITIVE · 0 UNVALIDATED # 2. Browse the module catalog (KittySploit-style), filter by category $ hawkeye modules --category mobile → [mobile] mobile-recognise Mobile device recognition [mobile] mobile-adb Android ADB-over-TCP exposure [mobile] mobile-ionstack IonStack 1-click Android root (posture) [mobile] mobile-kb Mobile vuln knowledge base # 3. Full detail for one module — including exactly how it validates $ hawkeye modules mobile-ionstack → ── IonStack 1-click Android root (posture) [mobile-ionstack] ── cve: CVE-2026-10702 + CVE-2026-43499 safety: Safe validation: host-side/click chain — NOT wire-observable → POTENTIAL FALSE POSITIVE by design; verify Firefox ≥151.0.3 and June-2026+ Android patch on-device. # 4. Validation-first triage: re-check findings, label each with a verdict + confidence $ hawkeye validate 10.0.110.60 --format json → [{"finding_id":0,"verdict":"CONFIRMED","confidence":85, "method":"TCP re-probe: 10.0.110.60:5555 reachable"}, {"finding_id":1,"verdict":"POTENTIAL FALSE POSITIVE","confidence":50, "method":"posture check — host-side chain, not observable over the network"}] # 5. The agentic driver now reasons over VERDICTS, not raw guesses $ hawkeye ai agent 10.0.110.0/24 --drive --authorize → prioritising CONFIRMED findings first; POTENTIAL FALSE POSITIVE flagged to verify, FALSE POSITIVE ignored — no wild goose chases, no crash sold as a win.
In 3.6 every network finding got a validation verdict. In 3.7 the same honesty reaches Source Assessment. A raw regex hit is only a candidate — HawkEye now consults your repo's git history to decide the truth: a secret committed to history is CONFIRMED (leaked forever — rotate it), a match in an untracked or test/fixture file is flagged POTENTIAL FALSE POSITIVE, and every matcher is graded precise / normal / noisy so a broad pattern never masquerades as a proven bug. Optionally, a local AI takes a second look — with the scanned code fenced as untrusted data, so a booby-trapped comment can't hijack it.
/tests/·/fixtures/ path is demoted to POTENTIAL FALSE POSITIVE. Findings carry the committing author/date for provenance.AKIA… key, a PEM header — stands on its own), normal, or noisy (a bare eval(, the word MD5 — needs verifying). Noisy hits are born as POTENTIAL FALSE POSITIVE. Grow your own rules in ~/.hawkeye/sast-rules.json.--ai-investigate asks a local model to adjudicate the un-confirmed findings — but the scanned code is fenced as untrusted data and the model is told never to obey instructions hidden in a comment or string. It may only confirm or downgrade, never invent.--diff main to scan only files changed vs a ref (a fast PR/CI gate) and a per-file SHA-256 cache that skips unchanged files on re-scan.Example usage & what you get back:
# 1. Assess a repo — findings now carry a git-informed VERDICT $ hawkeye source ./checkout --sast → [CRITICAL] Hardcoded AWS access key id — src/config.py «CONFIRMED» GIT REVALIDATION: secret is COMMITTED to git history — rotate it last commit: a1b2c3d · alice · 2025-11-02 [ HIGH] Hardcoded credential — tests/fixtures/seed.py «POTENTIAL FALSE POSITIVE» GIT REVALIDATION: in a test/fixture path — likely a mock; verify [ LOW] Use of weak hash (MD5) — src/util.js «POTENTIAL FALSE POSITIVE» matcher tier: noisy — verify before reporting # 2. PR/CI gate: scan only what changed vs main $ hawkeye source ./checkout --diff main → SAST: --diff 'main' → 3 changed source file(s) # 3. Let a LOCAL model adjudicate the un-confirmed findings (injection-safe) $ hawkeye source ./checkout --sast --ai-investigate --ai-backend ollama → AI investigate: 4 adjudicated, 1 downgraded to FALSE POSITIVE # 4. Generate an SSH deploy key for a private repo — copy the public half $ hawkeye sshkey gen prod-deploy → ✔ generated SSH deploy key 'prod-deploy' ssh-ed25519 AAAAC3NzaC1lZDI1NTE5… hawkeye-prod-deploy Install this PUBLIC key as a read-only deploy key on the repo host.
The verdict rides the same status badge as network findings — in the GUI, in --format json, and in the AI's engagement context. One honesty model, everywhere.
Most vuln scanners stop at "here's a finding." HawkEye takes you from raw port to professional report with ATT&CK context and MSF commands at every step.
No tab-switching between five different tools. No copy-pasting CVE IDs into NVD. No writing reports by hand.
vuln script category plus HTTP, SSL, SMB, and service-specific scripts. Parses XML output into structured findings automatically.The ATT&CK tab shows which techniques were triggered across all findings — grouped by tactic, counted, and linked directly to MITRE. Know exactly where the attack surface is before you write a word.
Fill in client name, author, and classification. Click Generate. An HTML report opens in your browser — print to PDF or send as-is. Same format your clients expect.
Nessus and OpenVAS find network vulnerabilities. Acunetix goes deep on browser-based web DAST — and stops there. None of them exploit what they find, chain it into a domain takeover, or hand you an AI second opinion. HawkEye does all of it in one operator-grade desktop tool: a 190K+ check arsenal it drives natively (Nmap NSE, OpenVAS NVTs, 9K+ Nuclei templates, Nikto, CMS, headless DAST), then 3,092 CVEs mapped to 3,376 fireable Metasploit modules and automated attack chains — EternalBlue → SYSTEM → domain-hash dump, secretsdump, Kerberoast, RDP lateral — every finding a module-verified attack path, not a version-guess (zero false positives). It detects rogue gateways, rogue networks and rogue VLANs host-scanners never look for, recognises mobile devices and exposed ADB (RCE), and proves upload→RCE with a harmless beacon — never a payload. Then a multi-model AI copilot (Claude, OpenAI, Gemini, local Ollama, or your Newton endpoint — with cross-model consensus) triages, suggests the next fireable move, and writes the client report. No subscription. No cloud required. Your data stays yours.
| Capability | ◈ HawkEye | Nessus | OpenVAS | Acunetix | Intruder | Indusface | ManageEngine | SiteLock | Tripwire |
|---|---|---|---|---|---|---|---|---|---|
| Network / infrastructure scanning | ✓ 190K+ checks Nmap NSE · OpenVAS · Nuclei · Nikto · CMS · Katana |
✓ 185K plugins | ✓ 170K+ NVTs | basic | ✓ | partial | ✓ agent | ✗ | ✓ enterprise |
| TRUE attack validation — zero false positives | ✓ module-verified | ✗ version-guess | ✗ version-guess | web proof-based | ✗ | ✗ | ✗ | ✗ | ✗ |
| Rogue gateway detection | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Rogue network / subnet discovery | ✓ auto-recurse | manual scope | manual scope | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Rogue VLAN detection & hopping | ✓ 802.1Q | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Web app scanning (DAST) | ✓ best-in-class 9K templates · CDP crawl · SQLi/XSS/SSTI/LFI/cmdi · SSRF/XXE OOB · exploit-verified |
basic plugins | basic | ✓ deep DAST | ✓ | ✓ OWASP | web agent | malware only | ✗ |
| JavaScript / SPA scanning | ✓ Chromium CDP | ✗ | ✗ | ✓ Chromium | partial | partial | ✗ | ✗ | ✗ |
| API scanning (OpenAPI / GraphQL) | ✓ spec + GraphQL | ✗ | ✗ | ✓ spec import | partial | partial | ✗ | ✗ | ✗ |
| Live NVD CVE enrichment (real-time) | ✓ NVD API v2 | vendor cycle | vendor cycle | web CVEs only | ✓ | ✓ | ✓ | ✗ | ✓ |
| MITRE ATT&CK auto-mapping | ✓ 14 tactics | ✗ | ✗ | ✗ | ✗ | ✗ | partial | ✗ | ✗ |
| Metasploit attack mapping | ✓ 3,376 exploit pairs 3,092 CVEs → fireable modules |
✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Automated exploitation & attack chains | ✓ EternalBlue→domain, secretsdump, Kerberoast, RDP | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| AI analyst copilot (multi-model) | ✓ Claude/OpenAI/Gemini/Ollama/Newton consensus · next-step engine · report author · local-first |
✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Mobile device & ADB/RCE detection | ✓ Android/iOS + exposed-ADB RCE | OS fp only | OS fp only | ✗ | ✗ | ✗ | MDM only | ✗ | ✗ |
| Benign upload→RCE proof (OOB-verified) | ✓ harmless canary beacon | ✗ | ✗ | detects only | ✗ | ✗ | ✗ | ✗ | ✗ |
| ExploitDB PoC fetch + scaffold | ✓ live fetch | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Kill chain / scenario builder | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| OWASP Top 10 mapping | ✓ | partial | ✗ | ✓ | partial | ✓ | ✗ | ✗ | ✗ |
| Stealth / custom scan profiles | ✓ 5 profiles | partial | partial | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Professional report (one click) | ✓ built-in | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | basic | ✓ |
| Native desktop GUI | ✓ Rust/egui | ✗ web UI | ✗ web UI | ✗ SaaS | ✗ SaaS | ✗ SaaS | ✗ web UI | ✗ SaaS | ✗ web UI |
| Price | -NA- | $4,390/yr | Free | $4,995/yr+ | $101/mo+ | $59/app/mo | $695/yr | $15/mo+ | Enterprise |
Chromium headless engine with Chrome DevTools Protocol (CDP). Detects vulnerabilities invisible to static HTTP scanners: DOM-based XSS (URL param → dangerous sink, fragment injection), client-side template injection (Angular/Vue/React), prototype pollution via JSON.parse, postMessage origin bypass, open redirects in JS routing, sensitive data in localStorage/sessionStorage, SPA framework dev-mode detection, and dynamic form endpoint discovery.
Automated kill-chain engine with 15+ MITRE ATT&CK patterns. Detects multi-step attack paths from your findings: SQLi→credential dump→pivoting, XSS→session hijack→account takeover, SSRF→cloud metadata→IAM theft, subdomain takeover→phishing, prototype pollution→RCE, and more. Includes remediation priority roadmap (CVSS + EPSS + CISA KEV), scan history with delta comparison, and push integrations for Jira, Linear, Slack, and generic webhooks. One-click PDF export via headless Chromium.
One seat per operator. Licensed per operator year — usage is registered server-side for compliance and audit purposes.