LLM-Augmented Offensive Security Platform
Enterprise-grade autonomous penetration testing. Multi-user Kali-based agent containers, 15 methodology profiles, Burp Suite Professional integration, and quantified LLM benchmarking.
The Suite
Offensive Sec Zero
The core platform. A multi-user, enterprise-hardened fork of Agent Zero running on a Kali Linux Docker base with 700+ pre-installed security tools. Features per-user isolated containers, Burp Suite Professional MCP integration (24 tools), HTTPS/Traefik authentication, and 15 LLM-driven methodology profiles covering OWASP, PTES, NIST, HackTricks, Active Directory, cloud, mobile, and binary exploitation. This is the AI agent that executes the pentests.
Meth Maker
Primarily writes concise skills.md files for specific cybersecurity services. Fetches authoritative sources — OWASP, PTES, NIST, HackTricks, PayloadsAllTheThings, Red Team Tactics, Hacker Recipes — from GitHub, compresses them at the text level to minimize LLM token usage without touching commands or payloads, applies override layers (global context + per-profile patches), and deploys them as Offensive Sec Zero-compatible profiles. Keeps AI system prompts sharp and current. 131 tests passing.
LLM Bench
LLM pentest performance benchmarking framework. Runs structured pentest prompts across a configurable LLM × Methodology × Target matrix and scores results on vulnerability discovery, exploitation success, tool accuracy, scope discipline, false-positive rate, and time-to-first-finding. Supports 20+ LLMs via OpenAI, Anthropic, and DigitalOcean Inference APIs. First result: Claude 4.5 Sonnet scored 73.1/100 against OWASP Juice Shop — 3 critical SQLi findings, 22 accounts extracted, 693-line report generated.
VulnForge
Terraform-automated VM deployment for VMware platforms. Rapidly provisions VMs to vSphere via Terraform, or to other VMware platforms, with pre-built definitions for intentionally vulnerable targets — Metasploitable 2/3, OWASP Broken Web Apps, VulnHub library (Stapler, Brainpan, SickOs, and more), plus Ubuntu 24.04 with Docker-hosted DVWA, Juice Shop, WebGoat, and Mutillidae. Provides the isolated target range that Offensive Sec Zero and LLM Bench test against.
How It Works
A two-phase model: tune the agent against safe vulnerable ranges, then deploy it against your real production assets.
Deploy a Safe Range
VulnForge provisions isolated, intentionally vulnerable target VMs via Terraform on vSphere or other VMware platforms — a controlled environment for tuning agent behavior without risk to production
Load a Methodology
Meth Maker compiles and compresses the right pentest framework (OWASP, PTES, HackTricks, etc.) into a token-efficient LLM profile
Run the Agent
Offensive Sec Zero's LLM agent executes the engagement autonomously using 700+ Kali tools and Burp Suite Professional
Benchmark & Select
LLM Bench scores each LLM × methodology combination across 6 objective criteria, surfacing the highest-performing prompts and model pairings
Once LLM Bench identifies the top-performing prompt + model combinations, point Offensive Sec Zero at the corporation's actual owned assets — internal apps, cloud environments, AD forests, external attack surface — for accelerated, LLM-assisted penetration testing at a velocity no manual team can match. The vulnerable ranges are R&D infrastructure; the corporate estate is the real engagement.
See It In Action
Live recordings of Offensive Sec Zero running against recent Hack The Box targets and modern vulnerable applications. Drop .mp4 files into /videos/ and update filenames below.
Jupiter — Linux AD Chain
OSZ autonomously enumerates Active Directory, finds kerberoastable accounts, and moves from low-priv user to Domain Admin via constrained delegation.
Sauna — Windows AS-REP Roasting
Agent identifies pre-auth disabled accounts, extracts AS-REP hashes, cracks offline with hashcat, and pivots through WinRM to SYSTEM.
Trick — DNS + SQL Injection Chain
Starting from zone transfer discovery, the agent maps internal subdomains, finds SQLi in a marketing portal, and extracts admin credentials.
Paper — Container Escape
OSZ identifies CVE-2022-0847 (Dirty Pipe) in a containerized app, exploits for root, then breaks out to host via exposed Docker socket.
Explore — Android ADB Exploitation
Agent discovers exposed ADB over TCP, achieves shell access, extracts sensitive data from application storage, and demonstrates lateral movement.
Juice Shop — Full Kill Chain
Comprehensive walkthrough from initial recon through XSS, SQL injection, privilege escalation, and finally achieving full application takeover.
Solutions
Enterprise Red Teams
Run continuous AI-augmented offensive testing at a pace no manual team can match
Security Consulting
Deliver faster, more consistent pentest reports with LLM-assisted analysis
Security Research
Benchmark LLM capabilities against real vulnerability classes with quantified scoring
Compliance & Audit
Automate control validation across NIST, OWASP, and cloud security frameworks
Built on Real Results
Applied for Google DeepMind / Google Cloud AI Startup Program
About
House of Stark AI was built by a cybersecurity professional with more than 25 years of consulting experience across Fortune 500 and healthcare organizations. That career has covered nearly every corner of the field — teaching pentest classes, web application penetration testing, covert red team operations, leading purple team programs, and deep defensive engineering. Every component of this platform — from the Kali-based agent containers to the methodology compiler to the benchmarking framework — was developed hands-on to solve a real problem: how to make offensive security testing faster, more consistent, and quantifiably better using LLM technology.
This isn't a wrapper around an API. It's a full-stack offensive security platform that integrates 700+ real pentesting tools, compiles authoritative methodology sources, runs autonomous engagements in isolated environments, and scores the results with objective metrics. Built for practitioners, by a practitioner.
Explore the code on GitHub.