
Graphical attack management console for Metasploit: the lineage of Armitage as a single Go binary with a browser UI. Live network topology, campaign workflows, Hail Mary, sessions, report export, and team mode.
Hayduk is a graphical attack management console for Metasploit: the lineage of Armitage, rebuilt as a single Go binary with a browser UI. It drives msfrpcd through go-msf.
For authorized security testing only.

Build (needs Go 1.26+ and Node):
make # builds the UI, embeds it, compiles bin/hayduk
./bin/hayduk
The console opens in your browser. Point it at a running msfrpcd:
msfrpcd -P yourpassword -S -f -a 127.0.0.1
or spin the disposable docker lab used by the integration tests:
scripts/msf/up.sh # msfrpcd on 127.0.0.1:55553, user msf / testpass123
scripts/msf/up.sh --with-vulnbox # plus disposable target boxes to scan and attack
scripts/msf/down.sh
The screenshot above is Hayduk live against that lab: six discovered hosts, real OS fingerprints and services.
./bin/hayduk --team --listen 0.0.0.0:8787
Team mode requires an explicit non-loopback bind. Every operator opens the printed token link, picks a name, and that name rides on their commands and lands next to their actions in the shared event log. Authentication is the one-time token URL; treat the link like a password and only run team mode on networks you trust.
make test # go test ./... + ui tests
make integration # against the docker stack above
Terminal 1: cd ui && npm run dev Terminal 2: make dev Open the URL that Hayduk prints. The UI hot-reloads through the dev proxy.
Protocol types are generated: make gen after touching
internal/protocol/protocol.go; make gen-check catches drift.
Design lineage: Armitage by Raphael Mudge.
License: MIT