v0.1.3

Changelog

• 1211fcb CLI: refuse wildcard team binds, advertise loopback instead
• 7f4a9b1 Docs: demo recording and team-mode bind instructions
• 4cdfe13 Engine: atomic snapshot/subscription handshake for sockets
• 766dcf6 Engine: hail mary attacks the port the scan found
• 362e7c3 Engine: workspace.set clears, serializes, and reports errors
• 1c98d9e Repo: bump version to 0.1.3
• 1a315f3 UI: context menu entry point, table views, login port prefill
• 0f1223c UI: fix topology fit, route CIDR, module tree and open-service bugs

v0.1.2

Bugfix release. No features, no breaking changes.

Engine

• Stale monitor events could delete a live session. Session IDs are per-link counters, so after a reconnect a close buffered on the dead link deleted the replacement link's session with the reused ID. All monitor events now carry and check the monitor's identity.
• Chunked route output lost earlier chunks. console.read drains only what printed since the last read, so large route tables lost every chunk but the last and logged those rows as removals. Reads now concatenate before parsing.
• Hail Mary targeted closed services. The attack matcher ignored the service state, so closed ports still drew exploit launches. Only open or stateless services match now.

UI

• A module or payload options error enabled Launch. Both option loads now hold the button and show the error instead of submitting an empty option set; payloads that require LHOST can no longer be sent with no way to enter it.

CLI

• Team mode accepted unreachable binds. localhost and scoped IPv6 loopback such as ::1%lo passed validation while staying unreachable to remote operators. Hostnames are resolved and all-loopback binds are rejected, scoped IPv6 included.

Full changelog

v0.1.1...v0.1.2

hayduk 0.1.1

Bug-fix release. Every fix ships with a test that failed on 0.1.0 first; go test -race, the UI suite (134 tests), and the integration suite against a live msfrpcd are all green.

Fixed:

• crash when a command raced a disconnect: gomsf was handed a nil client; commands now answer not_connected
• stale sessions and jobs stayed on screen (and actionable) after a disconnect
• concurrent db refreshes could commit out of order: a stalled sweep reverted newer hosts and re-broadcast them; refreshes now serialize
• monitor errors from unrelated blips piled up into a forced reconnect; a healthy db refresh resets the streak
• failed Hail Mary launches skipped the pacing delay
• connection leak: with eight requests stuck in the engine, a dead link only stopped the keepalive goroutine; it now closes the connection and cancels the stuck commands
• static files had no cache headers and no gzip
• the ws client discarded hello messages, so team mode and the version display never started
• the payload list request omitted the module type, so the list always failed to load
• the launch button was enabled before payload settings loaded, so those launches failed
• the selected host survived a workspace switch and could aim later actions at a host from the old workspace
• collapsed module tree branches still rendered all rows (thousands with a full index)
• Escape closed almost no dialogs

Also:

• embedded UI cut from 8.8 MiB to 400 KB: latin-only fonts, subset Phosphor icons (scripts/subset-icons.sh regenerates), and a guard test that fails if a referenced icon goes missing
• topology host cards restyled, left accent line removed; screenshot retaken against the current lab
• version bumped to 0.1.1

Assisted by: GLM 5.3

hayduk v0.1.0

First tagged release of hayduk: a graphical attack management console for Metasploit, the lineage of Armitage rebuilt as a single Go binary with a browser UI.

• Live network topology grouped by subnet, access states, pivot routes
• Campaign workflows: host discovery, service scans, login attacks with recovered credentials, Find attacks, Hail Mary
• Session interaction with live meterpreter/shell streaming and upgrade
• Module launcher with reliability ranks, option editing, payloads
• Credentials, loot and an attributed event log
• Self-contained HTML report export
• Token-auth team mode for several operators on one campaign

Build from source (Go 1.26+ and Node):

make && ./bin/hayduk

For authorized security testing only. Read SECURITY.md for the trust model, especially before using team mode. The disposable Metasploit lab under scripts/msf spins up targets for local, authorized testing.