Nightcrawler - Autonomous AI pentesting agent on a smartphone
Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
Nightcrawler is an autonomous penetration testing agent that runs entirely on a smartphone, using a local AI model to discover hosts, map services, find vulnerabilities, and generate reports—all without cloud connectivity. Drop it on a network, and it stealthily performs reconnaissance, enumeration, and exploitation over hours, with a web dashboard for monitoring and control. It's designed for authorized security testing, with built-in scope enforcement and 27 exploit playbooks.
Drop the phone on a network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report — all without cloud connectivity.
- voodooEntity
The following rant is not against the owner/project - but...
What an irony. I cant publish a attack surface mapping / pentesting tool i wrote which runs fully deterministic and really controlable due to "dual use" legal problems - but llm driven tools hit public space......
sorry for the rant....
- vctrnk
This looks interesting. My current phone is an Asus ROG Phone 3, which I think suffices (Snapdragon 865+ plus 12Gb RAM) but isn't rooted. Even on outdated Android 12 this phone covers everything I could possibly need as-is, and I don't intend to replace it. But, this might be the final push to upgrade ROM to something newer. I saw crDroid 16.0 still supports this ROG variant.
Will this work with Nethunter Rootless, or ir Magisk support w/root imperative?
- aaa_aaa
Judas Priest reference?
- haeseong
What does the 50% look like when it fails? Garbage the parser throws out is easy to handle, but a well formed command aimed at the wrong host gets past the scope check, and you would only catch that reading the report afterward.
- oquidave
Why phone? This cuts out a lot of phones. Why not on a computer?