HAWK - Hostile Assessment War-Kit
If you've run even a handful of security assessments, you already know the tools aren't the bottleneck. nmap, Metasploit, Burp Suite, netexec, the rest of the Kali toolbox: each one is excellent at the one job it does. The slow, error-prone part is everything in between. You run a scan here, copy a result over there, half-remember that a credential you found an hour ago might open the box you're staring at now, and you hold a running model of the whole engagement in your head while three tools finish in the background. Then at the end you rebuild a report out of scrollback and a scratch file.
That in-between layer, the connective tissue that ties the tools together, is the part nobody ships. So I built it. HAWK is my take on that missing layer: one place that drives the tools through an entire engagement and keeps everything they produce tied together.
What HAWK actually is
HAWK stands for Hostile Assessment War-Kit. It's a portable, offline GUI that runs a full penetration test from a single window. It lays the engagement out as a ten-phase kill chain, drives the tools you already have through those phases, parses what they return into structured findings, tracks the credentials you recover, and assembles the report while you work.
What it isn't matters just as much. The name oversells it on purpose, so let me undersell it: HAWK doesn't scan, and it doesn't exploit anything. There's no AI in there making calls for you. It doesn't even ship with nmap or Burp, it just drives the copies already on your Kali box. The tools do the work. HAWK is the layer that remembers what they found and ties it together.
Why I built it
I'm a computer engineering student, and HAWK started as a way to fix my own mess. The more I practiced, the more I realized the hard part of getting better wasn't learning yet another tool. It was not dropping the ball between them. I kept losing findings, forgetting which credential came from where, and burning an evening rebuilding a report I could have been writing all along. I never wanted something that would think for me. I wanted something that stopped me from losing the thread. Building it ended up teaching me more than any single course: how brutal it is to parse messy tool output reliably, how much work it takes to keep state consistent across a long session, and where exactly the line sits between helping the operator and quietly taking over their judgment.
How it works
Under the hood, HAWK is built around that ten-phase kill chain: reconnaissance, port scanning, enumeration, web assessment, vulnerability analysis, exploitation, Active Directory, post-exploitation, lateral movement, and reporting. Each phase knows which tools belong to it, so you move from top to bottom instead of juggling flags from memory for a tool you haven't touched in a month.
When you pick a tool, HAWK builds the command for you from the target and a couple of inputs, and it always shows you the exact command before anything runs. Nothing is hidden, which was a hard rule for me: you should always see what's about to touch the target. As the tool finishes, a panel I call Target Intel reads the raw output and turns it into structured findings. Every finding is tagged against the frameworks you actually report on: CWE, OWASP, a CVSS score, whether CISA lists the issue as known-exploited, and the matching ATT&CK technique. A wall of scanner text collapses into a short, meaningful list you can act on.
Credentials get their own home. Everything you recover lands in a Credential Store, with cracking wired in, so you stop scrolling back through old output asking what that password was. And all of it feeds a report engine that exports HTML, CSV, Markdown or JSON, with PDF on top if you need it.
The breadth is really the point. HAWK drives more than seventy tools across those phases, from the obvious ones like nmap, masscan, netexec, sqlmap, nuclei and hydra to the Active Directory crowd like BloodHound, certipy, kerbrute and the impacket family, plus pivoting with ligolo and chisel. It doesn't try to be clever about any of them. Each tool keeps doing exactly what it's good at; HAWK just gives them a shared home, a consistent way to launch, and one place for their results to land.
Three things stayed non-negotiable while I built it. It runs offline, with no cloud and no telemetry, because your recon data shouldn't be wandering off the machine and because I want to know exactly what my own tool is doing. It wraps the tools instead of reinventing them, so when Burp is the right call it hands off to Burp rather than pretending to be it. And it's portable: the whole thing lives in one folder you can drop onto a Kali box, run, and clean up by deleting a directory.
How you actually use it
In practice a session looks like this. You create a target and start at the top of the chain. You run your recon and port scans, and the Target Intel panel is already filling in as results come back. You move into enumeration, pull apart the services that looked interesting, and the findings stack up, each one scored and categorized for you. The moment you recover a credential it goes into the store, and if it needs cracking you kick that off from the same place.
From there the chain follows the shape of a real engagement. Vulnerability analysis, then exploitation if the scope calls for it, then the post-exploitation and Active Directory work where a lot of the genuinely interesting findings live, then lateral movement. You're making every decision along the way; HAWK is just making sure nothing you find ends up on the floor. By the time you reach the reporting phase, most of the report already exists, because it's been assembling itself from your findings and credentials the entire time. You export it in whatever format the engagement needs and move on.
Here's a concrete slice of it. Say a port scan turns up SMB on a host. You jump to enumeration, run the SMB tooling from that phase, and HAWK files what comes back as findings instead of leaving it in a terminal you'll close by accident. One of those findings hands you a set of credentials, and they go straight into the store. Two phases later, when you're deciding whether those creds get you lateral movement, they're right there, labeled with where you found them, instead of being a line you have to go hunting for in yesterday's output. None of that is magic. It's just the bookkeeping done for you, so your attention stays on the part that actually needs a human.
What you get out of it
What you actually keep at the end is this. A clean set of findings, scored and mapped to the standards, instead of a folder full of raw tool dumps you have to re-read. A record of every credential you touched and exactly where each one came from. And a report you didn't have to reconstruct at midnight, because it grew alongside the work instead of being bolted on at the end.
Underneath all of that is the part I care about most: a repeatable method. The kill chain quietly pushes you to be thorough and consistent from one engagement to the next. When you're still learning, that structure is worth as much as any single feature, because it turns "did I remember to check that" into something the tool keeps track of for you.
There's a quieter benefit too. Because the methodology is baked into the layout, a tired day doesn't cost you coverage. You don't skip a phase because you forgot it existed at 2am; it's sitting right there in the chain, waiting for you. For someone building the habit of doing this properly, that nudge toward consistency has probably done more for me than any single tool in the box.
Where it's going
Right now HAWK is focused on network, host and Active Directory work, which is where I started. The next thing I want to do is give web application testing the same structured treatment, and after that I'm genuinely curious about pointing the same lens at AI and LLM systems, which are turning into their own attack surface fast. That's a direction, not a dated roadmap. I build this in my spare time, so it moves when it moves.
One serious note, and where to find it
HAWK is an offensive tool, so this part isn't boilerplate. It's for authorized testing only: engagements you've been hired for, labs you own, or systems you have explicit written permission to touch. If you don't have that permission, don't use it. That responsibility is yours, full stop.
HAWK is open source under the Apache 2.0 license, and the code is on GitHub at https://github.com/serafinilorenzo87-png/hawk. It was built and tested on Kali Linux. If you try it, break it, or think something's missing, I'd honestly like to hear about it.