🔐 PenMaster Security
Autonomous AI-powered penetration testing agent — fully local, no cloud, no API keys.
Built on Kali Linux with a local LLM (Qwen 2.5-14B via LM Studio) and a Flask-based MCP tool server. The agent runs recon, attacks, and generates professional pentest reports — all autonomously.
What It Does
- 🔍 Autonomous recon — masscan + nmap to discover open ports and services
- ⚔️ Autonomous attack loop — selects and chains tools based on what it finds
- 🧠 Persistent negative experience cache — learns what fails across ALL sessions and never repeats mistakes
- 📝 Auto-generates branded HTML pentest reports on session end (Ctrl+C)
- 🔒 100% local — Qwen 2.5-14B running in LM Studio, nothing leaves your machine
Tool Arsenal (18 Tools)
| Tool | Purpose |
|---|---|
run_masscan |
Fast port discovery |
run_nmap |
Deep service/version scanning |
run_nikto |
Web vulnerability scanning |
run_sqlmap |
SQL injection testing |
run_hydra |
Credential brute forcing |
run_ncrack |
Network authentication cracking |
run_searchsploit |
CVE/exploit database lookup |
run_metasploit |
Exploit framework integration |
run_curl |
HTTP interaction and payload staging |
run_wget |
File retrieval and payload staging |
run_enum4linux |
SMB/Samba enumeration |
run_smbclient |
SMB share access and enumeration |
run_ftp |
FTP service interaction |
run_ssh |
SSH service interaction |
run_telnet |
Telnet service interaction |
run_wpscan |
WordPress vulnerability scanning |
run_dirb |
Web directory brute forcing |
run_set |
Social Engineering Toolkit |
Sovereign Agent Upgrades
- ✅ Autonomous tool reasoning — agent selects tools based on discovered services
- ✅ Persistent negative experience cache — SHA-256 fingerprinting blacklists failing tool/parameter combos across sessions
- ✅ Social Engineering Toolkit (SET) integration
- ✅ Auto HTML pentest report generation
Stack
- Model: Qwen 2.5-14B Instruct (abliterated) via LM Studio
- OS: Kali Linux
- Server: Flask MCP server (port 8000)
- Agent: Python autonomous loop
- Reports: Auto-generated HTML on exit
Intended Use
Designed for:
- Professional penetration testing against authorized targets only
- Security audits for small businesses, WordPress sites, and ecommerce
- Bug bounty hunting workflows
- AI/security research and development
GitHub
Model tree for automajicly/Local_Security_Model
Base model
Qwen/Qwen2.5-1.5B Finetuned
Qwen/Qwen2.5-1.5B-Instruct Quantized
Qwen/Qwen2.5-1.5B-Instruct-GGUF