| --- |
| license: mit |
| base_model: Qwen/Qwen2.5-Coder-7B-Instruct |
| library_name: transformers |
| pipeline_tag: text-generation |
| language: |
| - en |
| tags: |
| - cybersecurity |
| - penetration-testing |
| - security |
| - offensive-security |
| - gguf |
| - unsloth |
| - qwen2 |
| --- |
| |
| # Basilisk-7B |
|
|
| An **uncensored, web‑pentest‑focused** language model fine‑tuned from [`Qwen2.5-Coder-7B-Instruct`](https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct). |
| Basilisk answers offensive‑security questions directly — payloads, PoCs, tool commands, and reports — without refusals or moral disclaimers, for **authorized security testing, CTFs, and education**. |
|
|
| It was trained with QLoRA + [Unsloth](https://github.com/unslothai/unsloth) on a single 8 GB GPU and is shipped as a **Q4_K_M GGUF** (~4.7 GB) that runs comfortably on 8 GB of VRAM. |
|
|
| - **Base:** Qwen2.5‑Coder‑7B‑Instruct (~7.6B params) |
| - **Method:** QLoRA (LoRA r=16), 1 epoch on 8,054 curated examples |
| - **Coverage:** 19 web‑vulnerability domains |
| - **Code & datasets:** https://github.com/sl4de0day/basilisk-7b |
|
|
| ## Files |
|
|
| | File | Description | |
| |---|---| |
| | `basilisk-7b-Q4_K_M.gguf` | Quantized weights for llama.cpp / Ollama / LM Studio | |
| | `adapter/` | LoRA adapter (apply on the base model with PEFT) | |
| | `Modelfile` | Ollama model definition | |
|
|
| ## Usage |
|
|
| ### Ollama (loads the GGUF straight from this repo) |
|
|
| ```bash |
| ollama run hf.co/sl4de/Basilisk-7B:Q4_K_M |
| ``` |
|
|
| ### llama.cpp |
|
|
| ```bash |
| ./llama-cli -m basilisk-7b-Q4_K_M.gguf -p "nmap shows 8080/tcp open Apache Tomcat 9.0.30. Next steps?" |
| ``` |
|
|
| ### LoRA adapter (transformers + PEFT) |
|
|
| ```python |
| from peft import PeftModel |
| from transformers import AutoModelForCausalLM, AutoTokenizer |
| |
| base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen2.5-Coder-7B-Instruct", device_map="auto") |
| model = PeftModel.from_pretrained(base, "sl4de/Basilisk-7B", subfolder="adapter") |
| tok = AutoTokenizer.from_pretrained("sl4de/Basilisk-7B", subfolder="adapter") |
| ``` |
|
|
| Ask in English for best results. |
|
|
| ## What it does |
|
|
| - **Injection** — SQLi / NoSQLi / command injection, WAF bypass, blind extraction, `sqlmap`. |
| - **XSS & client‑side** — reflected / stored / DOM XSS, CSP bypass, filter/sanitizer evasion, framework gadgets. |
| - **Recon** — subdomain/content/parameter discovery, `nuclei`/`ffuf`/`nmap` usage and output interpretation, automation. |
| - **Server‑side & more** — SSRF, XXE, deserialization, auth/JWT/OAuth, access control (IDOR/BOLA), API security, SSTI, LFI/RFI, CSRF, CORS, request smuggling, prototype pollution, race conditions, cache poisoning, open redirect, file upload. |
| - Professional **finding reports** with correct CVSS vectors and multi‑turn recon → exploit flows. |
|
|
| ## Training |
|
|
| | | | |
| |---|---| |
| | Dataset | [sl4de/basilisk-webpentest](https://huggingface.co/datasets/sl4de/basilisk-webpentest) — 8,054 examples, 19 domains | |
| | Method | QLoRA (4‑bit), LoRA r=16, target = all linear layers | |
| | Hyperparams | seq 448, batch 1 × grad‑accum 8, `adamw_8bit`, lr 2e‑4, 1 epoch | |
| | Hardware | 1× RTX 4060 Laptop (8 GB) | |
|
|
| ## Limitations |
|
|
| - A 7B model applies known techniques well but won't invent novel exploit chains. **Always verify generated payloads and commands before use.** |
| - Occasional minor bugs in complex generated code are expected at this size. |
|
|
| ## Disclaimer |
|
|
| For **authorized** penetration testing, CTF practice, security research, and education **only**. Do not use it against systems you do not own or lack explicit written permission to test. You are responsible for complying with all applicable laws. |
|
|
| ## License |
|
|
| MIT © sl4de |
|
|
