商业产业 Hacker News AI 2026-08-03T11:06 正文 ok 1638 words

Show HN：Nightcrawler——运行在智能手机上的本地 AI 渗透测试 Agent

英文标题：🔶 Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone

Nightcrawler 是一款可完全在智能手机本地运行的自主渗透测试 Agent，能够在无云端连接的情况下发现主机、枚举服务、测试漏洞并生成报告。项目以 OnePlus 8、Kali NetHunter 和 LFM2.5-1.2B 本地模型为核心，利用手机 Adreno GPU 进行 OpenCL 推理，并通过 Scope Proxy 对命令实施范围校验。作者称，该系统在 72 小时以上的多网络自主运行中，每个网络可发现 30 余台主机、自动执行 2,000 多条命令并发现 10 多项漏洞。对开发者而言，该项目展示了小型本地模型、MCP 工具调用和移动端硬件在授权安全测试自动化中的结合方式，但部署前必须获得网络所有者的书面授权。

打开原文相关 3 · 机会 1

4.7 KB

55.2 KB

中文

一款完全运行在智能手机上的自主渗透测试 Agent。将手机接入一个网络后即可离开，它会发现主机、绘制服务地图、寻找漏洞并生成渗透测试报告——全程无需云端连接。

 ░█▄░█ █ █▀▀ █░█ ▀█▀ █▀▀ █▀█ ▄▀█ █░█░█ █░░ █▀▀ █▀█
 ░█░▀█ █ █▄█ █▀█ ░█░ █▄▄ █▀▄ █▀█ ▀▄▀▄▀ █▄▄ ██▄ █▀▄  v0.1.0

 AUTONOMOUS MOBILE PENTEST AGENT
 OnePlus 8 · NetHunter · LFM2.5-1.2B · OpenCL GPU

渗透测试（pentesting）是指在获得网络所有者明确许可的前提下，通过模拟攻击来测试计算机网络安全性的实践。专业渗透测试人员受雇于客户，在真实攻击者发现问题之前找出漏洞。

Nightcrawler 将这一过程自动化并部署在手机上。它使用运行于手机 GPU 本地的小型 AI 模型（LFM2.5-1.2B-Instruct-Heretic，12 亿参数）来决定下一步行动——探测哪台主机、使用什么工具、寻找什么信息。不需要互联网连接或云端 API。

WiFi 入侵（可选）——如果设备被放置时没有 WiFi，它可使用外接 USB WiFi 适配器自主破解 WPA2 网络
侦察——通过隐蔽扫描发现网络中的设备
枚举——探测已发现的服务（Web 服务器、文件共享、SSH、DNS 等）
利用——测试已知漏洞和默认凭据
报告——生成包含发现结果及修复建议的结构化渗透测试报告

该 Agent 的行为类似一名耐心的人类渗透测试人员：它在不同主机之间轮换，每回合只执行一个小动作，并在数小时内逐步积累知识。与传统漏洞扫描器一次性轰炸所有主机相比，这使其更难被发现。

术语	含义
投放盒（Drop box）	留置在目标网络中、自主执行测试的设备
范围（Scope）	你被授权测试的网络和主机集合
交战规则（Rules of Engagement，ROE）	规定你获准执行哪些操作的法律文件
隐蔽性（Stealth）	用于规避网络监控系统（IDS/IPS）发现的技术
MCP	Model Context Protocol，即供 AI 使用工具的标准接口
C2	Command and Control，即用于监控和引导 Agent 的 Web 控制台

┌──────────────────────────────────────────────────────────┐
│                   手机（OnePlus 8）                        │
│                                                           │
│  ┌─────────────┐     ┌──────────────────┐                │
│  │  LFM2.5     │     │  Agent 循环       │                │
│  │  1.2B 模型  │◄───►│  (main.py)       │                │
│  │  运行于 GPU │     │  决定下一步       │                │
│  │  (:8080)    │     │  执行什么操作     │                │
│  └─────────────┘     └────────┬─────────┘                │
│                               │                           │
│                      ┌────────▼─────────┐                │
│                      │  Scope Proxy     │  ← 安全层       │
│                      │  在执行前校验     │    阻止超出     │
│                      │  每一条命令       │    范围的操作   │
│                      └────────┬─────────┘                │
│                               │                           │
│                      ┌────────▼─────────┐                │
│                      │  Kali MCP Server │  ← 执行实际     │
│                      │  nmap、curl、    │    命令         │
│                      │  smbclient、...  │                │
│                      └──────────────────┘                │
│                                                           │
│  ┌──────────────────┐  ┌──────────────────┐              │
│  │  Web 控制台       │  │  SQLite 数据库    │              │
│  │  (:8888)         │  │  主机、漏洞、     │              │
│  │  监控和引导       │  │  凭据、命令       │              │
│  └──────────────────┘  └──────────────────┘              │
└──────────────────────────────────────────────────────────┘

完整系统设计请参阅 docs/ARCHITECTURE.md。

完全自主——运行期间无需人工介入
100% 本地推理——AI 在手机 GPU 上运行，无需云端
强制范围控制——双层防御机制阻止超出授权范围的操作
隐蔽优先——低速扫描、主机轮换、掩护流量，仅使用 nmap -T2
27 个利用剧本——可自动执行的多步骤攻击链
24,956 条 CVE 数据库——支持基于版本的漏洞匹配
Web 控制台——实时监控、主机管理和 C2 控制
WiFi 入侵模式——通过 USB 适配器自主破解 WPA2（灵感来自 Pwnagotchi）
被动发现——后台捕获 mDNS/NBNS/DHCP/ARP 广播
多网络支持——按网络隔离数据，通过以 MAC 地址为键的主机记录应对 DHCP 变化
自我修复——无效输出检测、上下文重置、看门狗和卡死检测
训练数据采集——记录成功交互，用于后续模型微调
报告生成——可下载的渗透测试报告，包含漏洞、利用链和修复建议

完整功能参考请参阅 docs/FEATURES.md。

安装了 Kali NetHunter 的 Android 手机（已在 OnePlus 8、Snapdragon 865 上测试）
通过 Magisk 获取的 Root 权限
12GB 以上内存（模型约使用 1.3GB，Android 约使用 4GB，其余供工具使用）
用于离线 WiFi 入侵模式的 USB WiFi 适配器（推荐 Ralink RT3572）
支持监控模式、带有 MAC80211 的 自定义内核（构建指南）
用于通过 Tailscale 卸载任务至更大模型的 NVIDIA AGX

所有推理均通过 Adreno 650 GPU 上的 OpenCL 完成：

模型	量化方式	提示词速度	生成速度
LFM2.5-1.2B-Instruct-Heretic（生产环境）	Q8_0	115 tok/s	13 tok/s
Qwen3.5-0.8B	Q8_0	30.5 tok/s	6.3 tok/s
Qwen3.5-4B	Q4_0	10.1 tok/s	2.0 tok/s

**注意：**Android 在电池供电时会限制 GPU 性能（速度降低 6 倍）。Nightcrawler 包含一个 GPU governor 守护进程，可强制最高性能，并在电量 ≤15% 时自动降频。

# 1. Install (inside Kali NetHunter chroot)
bash INSTALL.sh

# 2. Wait for llama-server to start (~5 min after boot)
curl -s http://127.0.0.1:8080/health  # Should return {"status":"ok"}

# 3. Start all services
bash scripts/run-36h.sh

# 4. Open the web dashboard (from any device on your Tailscale network)
# https://<your-tailscale-hostname>:8888

演练运行（不执行真实命令）

NC_DRY_RUN=1 python3 main.py

这将使用模拟 Kali 服务器，因此你可以在不执行真实网络命令的情况下测试 Agent 循环。

手动启动（不使用 tmux 启动器时）

kali-server-mcp --port 5000 &
python3 scope_proxy.py --config config.yaml --port 8800 --upstream http://127.0.0.1:5000 &
bash scripts/webui-daemon.sh start
python3 main.py &

部署前请编辑 config.yaml：

mission:
  id: "CLIENT-YYYY-XXX"           # Your engagement ID
  scope:
    networks: ["auto"]             # "auto" = detect from wlan0 at startup
    excluded_hosts: ["auto"]       # "auto" = gateway + self IP
    excluded_ports: [502, 503]     # SCADA/ICS ports to never touch
  authorization: "ROE-YYYY-XXX.pdf"
  max_runtime_hours: 0             # 0 = no limit

model:
  local:
    ctx_size: 8192
    port: 8080

动态范围检测意味着在不同网络之间移动时无需改动配置——Agent 会在启动时从 wlan0 读取当前子网。

nightcrawler/
├── main.py                  # Entry point
├── config.yaml              # Mission scope + model config
├── scope_proxy.py           # Scope enforcement proxy
├── INSTALL.sh               # Installer
│
├── agent/                   # Core agent logic
│   ├── loop.py              # Decision loop + error recovery
│   ├── planner.py           # Phase state machine (recon → exploit)
│   ├── llm_client.py        # LLM API client (llama.cpp / remote)
│   ├── db.py                # SQLite backend (hosts, vulns, creds)
│   ├── host_memory.py       # Per-host observations + auto-tagging
│   ├── cve_db.py            # 24,956-entry CVE database
│   ├── attack_planner.py    # Strategic directives for exploit phase
│   ├── output_parser.py     # Extract structured data from tool output
│   ├── offline_manager.py   # WiFi breach pipeline state machine
│   ├── net_detect.py        # Auto-detect network from wlan0
│   ├── cover_traffic.py     # Stealth blending with realistic web traffic
│   ├── passive_capture.py   # Background tcpdump for broadcast traffic
│   └── ...
│
├── proxy/                   # Scope enforcement components
│   ├── scope.py             # IP/port/host validation
│   ├── rate_limiter.py      # Command rate limiting + jitter
│   └── command_filter.py    # Destructive command blocklist
│
├── webui/                   # Web dashboard (Flask)
│   ├── server.py            # API + stealth middleware
│   └── templates/index.html # Dashboard UI
│
├── data/                    # Static data files
│   ├── cve_exploits.json    # CVE→exploit command mappings
│   └── playbooks.json       # 27 multi-step attack playbooks
│
├── prompts/                 # LLM prompt templates (hot-reloadable)
├── scripts/                 # Operational scripts (start, stop, watchdogs)
├── tests/                   # Test suites (API, UI, offline mode)
├── kernels/                 # WiFi driver modules + kernel docs
├── simulation/              # Dry-run mock server
├── docs/                    # Architecture, GPU setup, features
├── logs/                    # Runtime data (gitignored)
└── models/                  # Model files (gitignored)

该 Agent 使用一个简单但有效的循环：

选择目标——加权随机选择（70% 为已知开放端口的主机，30% 为新发现目标）
构建上下文——将主机记忆、网络观察结果和阶段指引注入提示词
询问 LLM——模型生成 REASONING: ... COMMAND: ...
校验——Scope Proxy 检查命令是否处于授权范围内且不具破坏性
执行——通过 Kali MCP Server 运行命令
学习——输出解析器提取发现结果并更新主机记忆
重置上下文——清除对话、保留持久记忆，然后重复

12 亿参数模型的命令成功率约为 50%（这是其规模固有的限制）。该 Agent 通过以下机制弥补：

无效输出检测——连续 5 次无效后重置，并采用不同的 few-shot 示例
重复检测——强制工具和目标多样化
基于时间的卡死检测——5 分钟兜底机制强制重置上下文
直接执行剧本——多步骤攻击绕过 LLM，直接执行

位于 :8888 的控制台提供实时监控和控制：

实时信息流——显示每一条命令、发现结果和 Agent 决策
主机卡片——可点击查看端口、服务和漏洞
网络地图——交互式力导向图，可拖动、缩放和平移
漏洞详情——CVE 标签、利用链和修复步骤
C2 控制——标记/拉黑主机、强制切换阶段、暂停/恢复、注入命令
离线模式——带有动画表情的 Pwnagotchi 风格 WiFi 攻击 UI

该控制台经过隐蔽过滤：它会伪装 nginx 响应头，并对来自目标网络的连接返回空的 404 页面。

基于跨多个网络超过 72 小时的自主运行结果：

每个网络发现 30 多台主机
自主执行 2,000 多条命令
在多项服务中发现 10 多个漏洞
通过直接执行运行 6 个以上剧本
Agent 内存在整个运行期间稳定保持在 35–50MB（无泄漏）

欢迎贡献！贡献指南请参阅 CONTRIBUTING.md。

需要协助的领域

模型微调——将命令格式遵循率从约 50% 提升至 85% 以上
新剧本——为更多服务添加利用链
CVE 数据库——将覆盖范围扩展到当前 24,956 条记录之外
适配器支持——使用更多 USB WiFi 芯片组进行测试
文档——面向不同手机的教程和安装指南
测试——增加测试覆盖率，特别是边缘情况

Clone the repo

git clone https://github.com/garagehq/nightcrawler.git cd nightcrawler

Dry-run mode (no real commands, no hardware needed)

NC_DRY_RUN=1 python3 main.py

Run tests

python3 -m pytest tests/

本工具仅限用于获得授权的渗透测试。 在部署 Nightcrawler 前，你必须获得网络所有者出具的书面许可（交战规则，Rules of Engagement）。未经授权对不属于你、或你未获许可测试的网络使用该工具属于违法行为。

MIT——详情请参阅 LICENSE。

如果你喜欢这个项目，可以请作者喝杯咖啡 ☕：

buymeacoffee.com/cyrilengmann

English / 原文

An autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report — all without cloud connectivity.

 ░█▄░█ █ █▀▀ █░█ ▀█▀ █▀▀ █▀█ ▄▀█ █░█░█ █░░ █▀▀ █▀█
 ░█░▀█ █ █▄█ █▀█ ░█░ █▄▄ █▀▄ █▀█ ▀▄▀▄▀ █▄▄ ██▄ █▀▄  v0.1.0

 AUTONOMOUS MOBILE PENTEST AGENT
 OnePlus 8 · NetHunter · LFM2.5-1.2B · OpenCL GPU

Penetration testing (pentesting) is the practice of testing a computer network's security by simulating an attack — with the network owner's explicit permission. Professional pentesters are hired to find vulnerabilities before real attackers do.

Nightcrawler automates this process on a phone. It uses a small AI model (LFM2.5-1.2B-Instruct-Heretic, 1.2 billion parameters) running locally on the phone's GPU to decide what to do next — which host to probe, which tool to use, what to look for. No internet connection or cloud API required.

WiFi Breach (optional) — If dropped without WiFi, it can autonomously crack WPA2 networks using an external USB WiFi adapter
Reconnaissance — Discovers devices on the network using stealthy scans
Enumeration — Probes discovered services (web servers, file shares, SSH, DNS, etc.)
Exploitation — Tests for known vulnerabilities and default credentials
Reporting — Generates a structured pentest report with findings and remediation advice

The agent operates like a patient human pentester — it rotates across hosts, does one small action per turn, and builds knowledge gradually over hours. This makes it much harder to detect than traditional vulnerability scanners that blast every host at once.

Term	What it means
Drop box	A device left on a target network to perform testing autonomously
Scope	The set of networks/hosts you're authorized to test
Rules of Engagement (ROE)	A legal document specifying what you're allowed to do
Stealth	Techniques to avoid detection by network monitoring (IDS/IPS)
MCP	Model Context Protocol — a standard interface for AI tool use
C2	Command and Control — the web dashboard for monitoring and steering the agent

┌──────────────────────────────────────────────────────────┐
│                   PHONE (OnePlus 8)                       │
│                                                           │
│  ┌─────────────┐     ┌──────────────────┐                │
│  │  LFM2.5     │     │  Agent Loop      │                │
│  │  1.2B model │◄───►│  (main.py)       │                │
│  │  on GPU     │     │  Decides what     │                │
│  │  (:8080)    │     │  to do next       │                │
│  └─────────────┘     └────────┬─────────┘                │
│                               │                           │
│                      ┌────────▼─────────┐                │
│                      │  Scope Proxy     │  ← Safety layer │
│                      │  Validates every │    Blocks out-  │
│                      │  command before  │    of-scope     │
│                      │  execution       │    actions      │
│                      └────────┬─────────┘                │
│                               │                           │
│                      ┌────────▼─────────┐                │
│                      │  Kali MCP Server │  ← Runs the    │
│                      │  nmap, curl,     │    actual       │
│                      │  smbclient, ...  │    commands     │
│                      └──────────────────┘                │
│                                                           │
│  ┌──────────────────┐  ┌──────────────────┐              │
│  │  Web Dashboard   │  │  SQLite DB       │              │
│  │  (:8888)         │  │  Hosts, vulns,   │              │
│  │  Monitor & steer │  │  creds, commands │              │
│  └──────────────────┘  └──────────────────┘              │
└──────────────────────────────────────────────────────────┘

For the full system design, see docs/ARCHITECTURE.md.

Fully autonomous — no human in the loop during operation
100% local inference — AI runs on the phone's GPU, no cloud needed
Scope-enforced — two-layer defense prevents out-of-scope actions
Stealth-first — slow scan rates, host rotation, cover traffic, nmap -T2 only
27 exploit playbooks — multi-step attack chains that execute automatically
24,956-entry CVE database — version-aware vulnerability matching
Web dashboard — real-time monitoring, host management, C2 controls
WiFi breach mode — autonomous WPA2 cracking with USB adapter (Pwnagotchi-inspired)
Passive discovery — background capture of mDNS/NBNS/DHCP/ARP broadcasts
Multi-network — data isolated per network, survives DHCP changes via MAC-keyed hosts
Self-healing — garbage detection, context reset, watchdogs, stuck detection
Training capture — logs successful interactions for future model fine-tuning
Report generation — downloadable pentest report with vulns, exploit chains, remediation

See docs/FEATURES.md for the complete feature reference.

Android phone with Kali NetHunter (tested on OnePlus 8, Snapdragon 865)
Root access via Magisk
12GB+ RAM (model uses ~1.3GB, Android uses ~4GB, rest for tools)
USB WiFi adapter for offline WiFi breach mode (Ralink RT3572 recommended)
Custom kernel with MAC80211 for monitor mode (build guide)
NVIDIA AGX for offloading to a larger model over Tailscale

All inference via OpenCL on Adreno 650 GPU:

Model	Quantization	Prompt Speed	Generation Speed
LFM2.5-1.2B-Instruct-Heretic (production)	Q8_0	115 tok/s	13 tok/s
Qwen3.5-0.8B	Q8_0	30.5 tok/s	6.3 tok/s
Qwen3.5-4B	Q4_0	10.1 tok/s	2.0 tok/s

Note: Android throttles the GPU on battery power (6x slowdown). Nightcrawler includes a GPU governor daemon that forces max performance and auto-throttles at ≤15% battery.

# 1. Install (inside Kali NetHunter chroot)
bash INSTALL.sh

# 2. Wait for llama-server to start (~5 min after boot)
curl -s http://127.0.0.1:8080/health  # Should return {"status":"ok"}

# 3. Start all services
bash scripts/run-36h.sh

# 4. Open the web dashboard (from any device on your Tailscale network)
# https://<your-tailscale-hostname>:8888

Dry Run (no real commands executed)

NC_DRY_RUN=1 python3 main.py

This uses a mock Kali server so you can test the agent loop without executing real network commands.

Manual Start (if not using tmux launcher)

kali-server-mcp --port 5000 &
python3 scope_proxy.py --config config.yaml --port 8800 --upstream http://127.0.0.1:5000 &
bash scripts/webui-daemon.sh start
python3 main.py &

Edit config.yaml before deployment:

mission:
  id: "CLIENT-YYYY-XXX"           # Your engagement ID
  scope:
    networks: ["auto"]             # "auto" = detect from wlan0 at startup
    excluded_hosts: ["auto"]       # "auto" = gateway + self IP
    excluded_ports: [502, 503]     # SCADA/ICS ports to never touch
  authorization: "ROE-YYYY-XXX.pdf"
  max_runtime_hours: 0             # 0 = no limit

model:
  local:
    ctx_size: 8192
    port: 8080

Dynamic scope detection means zero config changes when moving between networks — the agent reads the current subnet from wlan0 at startup.

nightcrawler/
├── main.py                  # Entry point
├── config.yaml              # Mission scope + model config
├── scope_proxy.py           # Scope enforcement proxy
├── INSTALL.sh               # Installer
│
├── agent/                   # Core agent logic
│   ├── loop.py              # Decision loop + error recovery
│   ├── planner.py           # Phase state machine (recon → exploit)
│   ├── llm_client.py        # LLM API client (llama.cpp / remote)
│   ├── db.py                # SQLite backend (hosts, vulns, creds)
│   ├── host_memory.py       # Per-host observations + auto-tagging
│   ├── cve_db.py            # 24,956-entry CVE database
│   ├── attack_planner.py    # Strategic directives for exploit phase
│   ├── output_parser.py     # Extract structured data from tool output
│   ├── offline_manager.py   # WiFi breach pipeline state machine
│   ├── net_detect.py        # Auto-detect network from wlan0
│   ├── cover_traffic.py     # Stealth blending with realistic web traffic
│   ├── passive_capture.py   # Background tcpdump for broadcast traffic
│   └── ...
│
├── proxy/                   # Scope enforcement components
│   ├── scope.py             # IP/port/host validation
│   ├── rate_limiter.py      # Command rate limiting + jitter
│   └── command_filter.py    # Destructive command blocklist
│
├── webui/                   # Web dashboard (Flask)
│   ├── server.py            # API + stealth middleware
│   └── templates/index.html # Dashboard UI
│
├── data/                    # Static data files
│   ├── cve_exploits.json    # CVE→exploit command mappings
│   └── playbooks.json       # 27 multi-step attack playbooks
│
├── prompts/                 # LLM prompt templates (hot-reloadable)
├── scripts/                 # Operational scripts (start, stop, watchdogs)
├── tests/                   # Test suites (API, UI, offline mode)
├── kernels/                 # WiFi driver modules + kernel docs
├── simulation/              # Dry-run mock server
├── docs/                    # Architecture, GPU setup, features
├── logs/                    # Runtime data (gitignored)
└── models/                  # Model files (gitignored)

The agent uses a simple but effective loop:

Pick a target — weighted random selection (70% hosts with known ports, 30% new discovery)
Build context — inject host memory, network observations, phase guidance into prompt
Ask the LLM — model produces REASONING: ... COMMAND: ...
Validate — scope proxy checks the command is in-scope and not destructive
Execute — command runs via Kali MCP server
Learn — output parser extracts findings, updates host memory
Reset context — clear conversation, keep persistent memory, repeat

The 1.2B model has a ~50% command success rate (inherent to its size). The agent compensates with:

Garbage detection — 5-streak reset with varied few-shot examples
Duplicate detection — forces tool/target diversification
Time-based stuck detection — 5-minute backstop forces context reset
Direct playbook execution — multi-step attacks bypass the LLM entirely

The dashboard at :8888 provides real-time monitoring and control:

Live feed — every command, finding, and agent decision
Host cards — clickable cards showing ports, services, vulnerabilities
Network map — interactive force-directed graph (drag, zoom, pan)
Vulnerability details — CVE tags, exploit chains, remediation steps
C2 controls — star/blacklist hosts, force phase, pause/resume, inject commands
Offline mode — Pwnagotchi-inspired WiFi attack UI with animated face

The dashboard is stealth-filtered: it spoofs nginx headers and returns empty 404s to connections from the target network.

From 72+ hours of autonomous operation across multiple networks:

30+ hosts discovered per network
2,000+ commands executed autonomously
10+ vulnerabilities found across multiple services
6+ playbooks executed via direct execution
Agent memory stable at 35-50MB throughout (no leaks)

Contributions are welcome! See CONTRIBUTING.md for guidelines.

Areas where help is needed

Model fine-tuning — improving command format compliance from ~50% to 85%+
New playbooks — adding exploit chains for more services
CVE database — expanding coverage beyond the current 24,956 entries
Adapter support — testing with more USB WiFi chipsets
Documentation — tutorials, setup guides for different phones
Testing — more test coverage, especially for edge cases

Clone the repo

git clone https://github.com/garagehq/nightcrawler.git cd nightcrawler

Dry-run mode (no real commands, no hardware needed)

NC_DRY_RUN=1 python3 main.py

Run tests

python3 -m pytest tests/

This tool is for authorized penetration testing only. You must have written permission (Rules of Engagement) from the network owner before deploying Nightcrawler. Unauthorized use against networks you don't own or have permission to test is illegal.

MIT — see LICENSE for details.

If you enjoy this project, you can buy me a coffee ☕: