DeepExploit

🎯 The Problem It Solves

Most offensive tools follow static playbooks. DeepExploit asks a different question: can an RL agent LEARN to chain exploits by trial-and-error in a simulated network? The answer is yes — with caveats. It trains a deep Q-network against Metasploit modules to discover multi-step attack paths, treating pentesting as a sequential decision problem. It is NOT a production tool; it is a research platform for studying how RL maps to real attack graphs.

🔧 How It Works

DeepExploit models pentesting as a Markov Decision Process. The state is the current compromise (owned hosts, open services), the actions are Metasploit modules (exploit/windows/smb/ms17_010_eternalblue, etc.), and the reward is reaching a goal host. A DQN agent explores this space over thousands of episodes, learning which module-sequence gets from a low-priv foothold to Domain Admin. You train it in your simulated lab environment (Metasploit + vulnerable VMs), then deploy the learned policy against a new target. The project is built on ChainerRL and requires a working Metasploit installation.

🚀 Installation & Quick Start

git clone https://github.com/13o-bbr-bbq/DeepExploit.git
cd DeepExploit
pip install -r requirements.txt
# Metasploit must be installed and msfrpcd running
msfrpcd -P yourpassword -S -f