Before any scan, create a named context. Everything that follows (hosts, vulns, mission
history) stays attached to that workspace.
workspace create dvwa-low-2026
workspace use dvwa-low-2026
workspace list
scope add 127.0.0.1
host add 127.0.0.1 --note "DVWA local test target"
scope and host document the authorized perimeter. The agent and certain
commands rely on this data to avoid off-target drift.
Manual module cycle
search --type scanner --protocol http security
use scanner/http/security_headers_detect
show options
set rhost 127.0.0.1
set rport 80
set ssl false
run
back
show options : required options and common values.
check : prerequisite validation without full action (if the module
supports it).
back : leave the current module without closing the console.
reload : reload the module after code changes (development).
After adding custom modules or marketplace sync: sync now.
Command reference by category
The help command with no argument displays the categories defined in the framework
(help_command.py). For details on a command:
help <name>. This section reproduces and comments on each category for day-to-day
pentesting.
Core Commands (console core)
clear
Clear the display before a client demo.
exit
Quit the console (background sessions: check jobs).
banner
Display the banner; useful for report screenshots.
agent
Autonomous campaign or sub-commands doctor, explain,
replay (agent campaign replay).
status
Framework state, current workspace, counters.
interpreter
Switch to integrated interactive Python shell (advanced debug).
Module Management
search [filters]
Inventory modules by keyword, CVE, type, protocol.
show options|info|payloads
Options, metadata, compatible payloads.
set <opt> <val>
Configure the target (rhost, rport, targeturi).
run
Execute the loaded module.
back
Return to global console context.
check
Lightweight vulnerability test before full run.
reload
Reload source module after editing.
Example typical session:
use auxiliary/scanner/portscan/tcp
show options
set rhosts 127.0.0.1
set ports 1-1000
set threads 50
run
Workspace & Data (mission data)
sync
Module indexing (sync now) after repository update.
host
add, list, services : asset mapping.
vuln
Track confirmed vulnerabilities linked to hosts.
history
Session command traceability (audit evidence, the relevant documentation).
portal
Local web portal access for visualization (if enabled).
attack catalog
attack show scanner/http/security_headers_detect
attack export --format navigator --output /tmp/layer.json
doctor
lab list
Jobs & Background
jobs -k <id>
Stop a job; useful in case of incident.
Collaboration
collab_connect
Join a shared session.
collab_chat
Team messaging during red team.
collab_disconnect
Leave collab session.
collab_share_module
Share custom module with the team.
collab_sync_module
Sync remote module.
collab_edit_module
Collaborative editing.
collab_sync_edit
Sync edits in progress.
irc
Integrated IRC channel (legacy / team).
Advanced Features
browser_server
Server for browser_exploits modules.
demo
Built-in demonstrations.
guardian
Monitoring / guardrails (depending on configuration).
scope
Explicit authorized perimeter (add, list).
market
Community module marketplace.
plugin
Console extensions.
reset
Reset selected states (use with caution).
sound
Audible event feedback (optional).
Standalone tool: kittyrelay
Not invocable in the console; separate binary/script for P2P relay:
kittyrelay --host 0.0.0.0 --port 9000
# Console side:
use listeners/multi/p2p_relay
set role operator
set relay_host <hub-ip>
set relay_token <token>
run
help kittyrelay in the console displays the details.