File size: 3,021 Bytes
659ab0a 304fb53 90a97b2 304fb53 90a97b2 659ab0a ef26c79 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 304fb53 90a97b2 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 | ---
license: mit
language:
- en
tags:
- penetration-testing
- autonomous-agent
- mcp
- kali-linux
- llm
- cybersecurity
- red-team
- ethical-hacking
- bug-bounty
- python
- flask
- bug-bounty,
- pentesting-tools,
- mcp,
- mcp-server,
- mcp-agent-loop,
- ethical-hacker,
- ethical-hacking-tools,
library_name: other
pipeline_tag: text-generation
base_model:
- Qwen/Qwen2.5-1.5B-Instruct-GGUF
---
# 🔐 PenMaster Security
**Autonomous AI-powered penetration testing agent — fully local, no cloud, no API keys.**
Built on Kali Linux with a local LLM (Qwen 2.5-14B via LM Studio) and a Flask-based MCP tool server. The agent runs recon, attacks, and generates professional pentest reports — all autonomously.
---
## What It Does
- 🔍 Autonomous recon — masscan + nmap to discover open ports and services
- ⚔️ Autonomous attack loop — selects and chains tools based on what it finds
- 🧠 Persistent negative experience cache — learns what fails across ALL sessions and never repeats mistakes
- 📝 Auto-generates branded HTML pentest reports on session end (Ctrl+C)
- 🔒 100% local — Qwen 2.5-14B running in LM Studio, nothing leaves your machine
---
## Tool Arsenal (18 Tools)
| Tool | Purpose |
|------|---------|
| `run_masscan` | Fast port discovery |
| `run_nmap` | Deep service/version scanning |
| `run_nikto` | Web vulnerability scanning |
| `run_sqlmap` | SQL injection testing |
| `run_hydra` | Credential brute forcing |
| `run_ncrack` | Network authentication cracking |
| `run_searchsploit` | CVE/exploit database lookup |
| `run_metasploit` | Exploit framework integration |
| `run_curl` | HTTP interaction and payload staging |
| `run_wget` | File retrieval and payload staging |
| `run_enum4linux` | SMB/Samba enumeration |
| `run_smbclient` | SMB share access and enumeration |
| `run_ftp` | FTP service interaction |
| `run_ssh` | SSH service interaction |
| `run_telnet` | Telnet service interaction |
| `run_wpscan` | WordPress vulnerability scanning |
| `run_dirb` | Web directory brute forcing |
| `run_set` | Social Engineering Toolkit |
---
## Sovereign Agent Upgrades
- ✅ Autonomous tool reasoning — agent selects tools based on discovered services
- ✅ Persistent negative experience cache — SHA-256 fingerprinting blacklists failing tool/parameter combos across sessions
- ✅ Social Engineering Toolkit (SET) integration
- ✅ Auto HTML pentest report generation
---
## Stack
- **Model:** Qwen 2.5-14B Instruct (abliterated) via LM Studio
- **OS:** Kali Linux
- **Server:** Flask MCP server (port 8000)
- **Agent:** Python autonomous loop
- **Reports:** Auto-generated HTML on exit
---
## Intended Use
Designed for:
- Professional penetration testing against **authorized targets only**
- Security audits for small businesses, WordPress sites, and ecommerce
- Bug bounty hunting workflows
- AI/security research and development
---
## GitHub
[XenoCoreGiger31/Local-Model](https://github.com/XenoCoreGiger31/Local-Model) |