An AI pentest agent, exploitation and recon — on Android
Lupus bundles the Metasploit Framework, Nmap, Nuclei and a full recon, web, Active Directory and media/IoT arsenal — with a workspace database, session manager and an autonomous AI agent — built for a phone, so you do in a tap what would take a long command on a tiny keyboard. A genuinely useful free tier; Pro unlocks the complete testing workflow. See every tool on the Tools page. For authorized security testing only.
Lupus AI Agent
An autonomous agent that runs recon, scanning, exploitation, post-exploitation and reporting on its own, orchestrating every tool below and writing findings into the workspace database. It works in local and remote mode. Free includes 5 credits each month. Each opens a window of up to 1 hour shared across conversations; Pro removes that credit cap while active.
Bring your own provider API key, including for free models. Lupus Pro and AI session credits do not include provider tokens. Model availability, usage charges and quotas depend on your provider account.
Free models are for tests without personal, confidential or client data. For authorized engagements only.
Browse the full arsenal →Exploitation
- Metasploit exploits & auxiliary
- Meterpreter & shell sessions
- msfconsole (raw)
- Exploit-DB / searchsploit
Recon & scanning
- Nmap with basic scan profiles
- naabu fast port scan
- httpx · katana · ffuf · gobuster
- subfinder · dnsx · dnsrecon
AD, SMB & credentials
- Impacket suite
- NetExec (nxc)
- smbclient
- Responder (root)
Media, IoT & cameras
- Chromecast & smart-TV control
- IP cameras (Cameradar, ONVIF)
- UPnP / SSDP / DLNA
- Routers & IoT (RouterSploit)
Your first workspace
- 1 workspace
- View saved hosts, services, vulnerabilities, credentials and loot
- Up to 3 open tasks / tabs
On-site operation
- Mobile data routing for on-device AI provider traffic
- Engine on-device or on a remote agent
- Execute as root
- On-device tool updates
Automate with the AI agent
- Let the agent plan and run tools, then save findings to your workspace. Keep using it beyond Free’s monthly credits with your own API key.
Control sessions visually
- Browse and transfer files, manage processes, and use network, pivoting and monitoring controls from the phone.
Investigate deeper
- Run integrated Nuclei vulnerability scans and choose intensive or comprehensive Nmap profiles.
Manage payloads and post-exploitation
- Generate payload files with msfvenom, configure listeners and run post-exploitation modules through dedicated screens.
Organize separate engagements
- Use multiple workspaces, create and edit records, import/export data, and keep more tasks open.
Bring your own modules
- Upload custom modules and payload files to My Arsenal and sync them to your selected agent. 50 MB per account, 20 MB per file.