nightcrawler - Local AI powered red teamer on a phone

项目说明

Nightcrawler

An autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a network, walk away, and it discovers hosts, maps services, finds , and generates a pentest report — all without cloud connectivity.

What is this?

Penetration testing (pentesting) is the practice of testing a computer network's security by simulating an attack — with the network owner's explicit permission. Professional pentesters are hired to find *before* real attackers do.

Nightcrawler automates this process on a phone. It uses a small AI model (LFM2.5-1.2B-Instruct-Heretic, 1.2 billion parameters) running locally on the phone's GPU to decide what to do next — which host to probe, which tool to use, what to look for. No internet connection or cloud API required.

Demo

▶️ Watch Nightcrawler in action on Instagram

How it works

1. WiFi Breach (optional) — If dropped without WiFi, it can autonomously crack WPA2 networks using an external USB WiFi adapter
2. Reconnaissance — Discovers devices on the network using stealthy scans
3. Enumeration — Probes discovered services (web servers, file shares, SSH, DNS, etc.)
4. Exploitation — Tests for known and default credentials
5. Reporting — Generates a structured pentest report with findings and remediation advice

The agent operates like a patient human pentester — it rotates across hosts, does one small action per turn, and builds knowledge gradually o. This makes it much harder to detect than traditional scanners that blast every host at once.

Key concepts

| Term | What it means |
|------|--------------|
| Drop box | A device left on a target network to perform testing autonomously |
| Scope | The set of networks/hosts you're authorized to test |
| Rules of Engagement (ROE) | A legal document specifying what you're allowed to do |
| Stealth | Techniques to avoid detection by network monitoring (IDS/IPS) |
| MCP | Model Context Protocol — a standard interface for AI tool use |
| C2 | Command and Control — the web dashboard for monitoring and steering the agent |

Architecture

For the full system design, see docs/ARCHITECTURE.md.

Features

See docs/FEATURES.md for the complete feature reference.

Hardware

Required

Optional

GPU Performance

All inference on Adreno 650 GPU:

| Model | Quantization | Prompt Speed | Generation Speed |
|-------|-------------|-------------|-----------------|
| LFM2.5-1.2B-Instruct-Heretic (production) | Q8_0 | 115 tok/s | 13 tok/s |
| Qwen3.5-0.8B | Q8_0 | 30.5 tok/s | 6.3 tok/s |
| Qwen3.5-4B | Q4_0 | 10.1 tok/s | 2.0 tok/s |

> Note: Android throttles the GPU on battery power (6x slowdown). Nightcrawler includes a GPU go daemon that forces max performance and auto-throttles at ≤15% battery.

Quick Start

Dry Run (no real commands executed)

This uses a mock Kali server so you can test the agent loop without executing real network commands.

Manual Start (if not using tmux launcher)

Configuration

Edit config.yaml before deployment:

Dynamic scope detection means zero config changes when moving between networks — the agent reads the current subnet from wlan0 at startup.

Project Structure

How the Agent Thinks

The agent uses a simple but effective loop:

1. Pick a target — weighted random selection (70% hosts with known ports, 30% new discovery)
2. Build context — inject host memory, network obser, phase guidance into prompt
3. Ask the LLM — model produces REASONING: ... COMMAND: ...
4. — scope proxy checks the command is in-scope and not destructive
5. Execute — command runs via Kali MCP server
6. Learn — output parser extracts findings, updates host memory
7. Reset context — clear con, keep persistent memory, repeat

The 1.2B model has a ~50% command success rate (inherent to its size). The agent compensates with:

Web Dashboard

The dashboard at :8888 provides real-time monitoring and control:

The dashboard is stealth-filtered: it spoofs nginx headers and returns empty 404s to connections from the target network.

Tested Results

From 72+ hours of autonomous operation across multiple networks:

Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines.

Areas where help is needed

De setup

Legal

This tool is for authorized penetration testing only. You must ha permission (Rules of Engagement) from the network owner before deploying Nightcrawler. Unauthorized use against networks you don't own or ha to test is illegal.

License

MIT — see LICENSE for details.

Support

If you enjoy this project, you can buy me a coffee ☕:

<a href=" target="_blank"><img src=" alt="Buy Me A Coffee" height="50" width="210"></a>

> buymeacoffee.com/cyrilengmann

项目信息

开发语言：Python

Star 数：820

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Local AI powered red teamer on a phone展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。