Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
Nightcrawler is an innovative, autonomous penetration testing agent that operates entirely from a smartphone, leveraging a local AI model for decision-making. This project stands out for its self-contained, offline capabilities and stealth-first approach to network security analysis. It appeals to HN's interest in cutting-edge cybersecurity, on-device AI, and practical applications of open-source technology.
The Lowdown
Nightcrawler is presented as a groundbreaking, fully autonomous penetration testing (pentesting) agent designed to run directly on a smartphone. Developed to simulate real-world cyberattacks with explicit permission, this tool offers a unique, self-contained solution for uncovering network vulnerabilities without relying on cloud infrastructure or internet connectivity. Its core innovation lies in using a small, local AI model to intelligently navigate and execute pentesting operations.
- Autonomous Operation: The agent functions independently, capable of cracking WPA2 networks (with an optional USB WiFi adapter), discovering hosts, enumerating services, exploiting vulnerabilities, and generating comprehensive pentest reports.
- Local AI-Powered Decisions: It utilizes a 1.2 billion-parameter AI model (LFM2.5-1.2B-Instruct-Heretic) running entirely on the phone's GPU for real-time decision-making, such as selecting targets, tools, and vulnerabilities to pursue.
- Stealth and Safety: Nightcrawler employs stealth techniques like slow scan rates, host rotation, and cover traffic to avoid detection, and includes a two-layer scope enforcement mechanism to prevent out-of-scope actions.
- Comprehensive Capabilities: The system boasts 27 exploit playbooks, a 24,956-entry CVE database for vulnerability matching, passive discovery modes, and self-healing mechanisms to manage AI model limitations.
- Hardware Requirements: It runs on Android phones with Kali NetHunter and root access (tested on OnePlus 8), requiring at least 12GB RAM for optimal performance.
- Real-time Monitoring: A web dashboard provides real-time insights into agent activity, host details, network maps, and offers command and control functionalities, all while stealth-filtering its presence.
- Proven Results: Over 72 hours of testing demonstrated its ability to discover numerous hosts, execute thousands of commands, find multiple vulnerabilities, and run several exploit playbooks autonomously.
Nightcrawler represents a significant step towards democratizing advanced penetration testing by making it accessible and operable from a mobile device. Its blend of local AI, comprehensive security features, and a focus on stealth offers a compelling tool for authorized security assessments, pushing the boundaries of what's possible in mobile cybersecurity.