Look, I love nmap. We all love nmap. But the moment you fire nmap -sS 10.0.0.0/8 on an internal engagement, three things happen simultaneously: the SOC gets 47 alerts, the blue team opens an incident, and your red team engagement goes from "stealth assessment" to "everyone knows you're here." Congratulations, you played yourself.
The Problem Nobody Talks About
Every red teamer has this dirty secret: the recon phase is where most engagements get burned. Not the exploitation. Not the lateral movement. The discovery.
Think about it. You're dropped into a corporate network with a laptop and a scope of "everything RFC 1918." You need to map 200,000 hosts. Your options are:
Option A: Run nmap. Get caught in 4 minutes. Spend the next 2 hours explaining to the CISO why their $400K SIEM investment just paid for itself.
Option B: Do it manually, one host at a time, with ping and prayers. Finish in approximately 2026. Maybe 2027 if you take lunch breaks.
Option C: Use HostVigil. Map 20,000 hosts over a few hours. Zero alerts. ML learns what's normal. Dashboard tells you where the crown jewels are.
I built Option C because I was tired of Option A ruining my weekends.
What HostVigil Actually Is
HostVigil is a self-learning stealth reconnaissance platform. That's a lot of buzzwords, so let me break it down:
- Self-learning: It has an actual ML engine (IsolationForest + GradientBoosting) that learns what's normal on YOUR network and alerts when something isn't. Not generic signatures. YOUR baseline.
- Stealth: 14 evasion techniques. Randomized timing. Adaptive throttling. Decoy packets. Honeypot detection. If your IDS catches it, I'll buy you coffee.
- Reconnaissance: 11 discovery techniques, TCP/UDP scanning, TLS inspection, OS fingerprinting, service enumeration, Active Directory integration, credential spraying (1 attempt/host/hour — because we're not animals).
- Platform: Web dashboard with network graphs, MITRE ATT&CK mapping, attack path analysis, and one-click export to Cobalt Strike/Metasploit/Sliver.
You start the daemon. You go home. You come back in 3 days to a fully mapped network with exploitable paths highlighted. That's it. That's the product.
The Competition (And Why I'm Not Worried)
Let's talk about what else exists and why I still built this thing.
Nmap / Masscan / RustScan
The OGs. Incredible tools. I use nmap inside HostVigil. But they're point-in-time scanners. You run them, you get results, the results are immediately stale. There's no learning. No continuous monitoring. No "hey, port 4444 just opened on the DC at 3AM on a Sunday" alert.
Also, they're loud. Like, "construction worker with a jackhammer" loud. Masscan can scan the entire internet in 6 minutes, which is cool until you realize it sounds like a DDoS to every network device between you and the target.
HostVigil's edge: Continuous. Silent. Learns. Alerts on changes.
Nessus / Qualys / Tenable
Enterprise vulnerability scanners. They're fantastic at what they do — if what you want is a 47-page PDF that nobody reads and a bill that makes your CFO cry.
They're designed for compliance, not offense. They authenticate, they check patches, they generate reports. They don't think about stealth because they're supposed to be running. Your purple team scheduled them on Tuesday at 2 PM. Everyone knows.
HostVigil's edge: Built for red team. Not compliance. Stealth is requirement #1, not an afterthought.
BloodHound
Absolute legend for AD enumeration. But it needs credentials, it needs SharpHound on a host, and it only covers Active Directory. It doesn't scan ports. It doesn't find your exposed Redis. It doesn't notice the new host that appeared overnight.
HostVigil's edge: Full network scope + AD integration. Uses HostVigil's AD module for the same LDAP-based discovery, but also scans everything else — the Linux boxes, the IoT trash, the forgotten Docker host running as root on port 2375.
Reconnaissance Frameworks (Recon-ng, SpiderFoot, theHarvester)
External recon tools. Different planet. They're querying Shodan and scraping LinkedIn while you're already inside the network. HostVigil doesn't do OSINT — it does internal recon. Complementary, not competitive.
Custom Scripts (the "I'll just write a bash loop" crowd)
We've all been there. for ip in $(seq 1 254); do ping -c 1 192.168.1.$ip; done. It works. It's also completely unmaintainable, has no state tracking, no ML, no dashboard, no export, and you lose everything when you close the terminal.
HostVigil's edge: 38,000 lines of code that remembers everything, learns from it, and presents it beautifully. Your bash loop could never.
The Architecture (For the Nerds)
Discovery (11 techniques) → Scanner (TCP/UDP/TLS/OS) → ML Engine → Dashboard
↑ |
└────────────── Continuous daemon loop ──────────────────┘
Everything runs in a single Python process. SQLite database (WAL mode — concurrent reads/writes). No Redis. No Postgres. No Kafka. No Kubernetes. No microservices. No "let me just spin up a 12-container Docker stack."
8 dependencies. That's it. Flask, scapy, scikit-learn, paramiko, numpy, pyyaml, APScheduler, psutil. Plus ldap3 for AD. No bloat. No telemetry. No phone-home.
You can run it on a $5 VPS, a Raspberry Pi, or a compromised host you just landed on. It doesn't care.
What Makes the ML Actually Useful
Most "ML-powered security tools" are just regex with a marketing department. HostVigil's ML actually does something:
- Temporal Baseline: Learns what's normal per hour-of-week. Port 22 open on Monday 9AM? Normal. Port 4444 open on Saturday 3AM? Anomaly score through the roof.
- Service Correlation: Builds a co-occurrence matrix. Webserver + SSH + HTTPS = probably a normal server. Webserver + port 6667 (IRC) + port 4444 = probably compromised.
- Network Drift: Takes periodic snapshots. If 30% of the network changes overnight, something happened. You want to know.
- Feedback Loop: Mark anomalies as true/false positive from the dashboard. The model retrains. It gets better. It stops bothering you about the same boring stuff.
- Cold Start: Rules work from day one. ML kicks in after 50 data points. You don't sit around waiting for "the AI to learn" — you get value immediately.
The Stealth Philosophy
Here's the thing about stealth: it's not one technique. It's a philosophy that permeates every line of code.
- Scan timing isn't fixed — it's randomized with configurable jitter.
- If the network pushes back (RST flood), HostVigil backs off automatically.
- Probes are mixed with decoy packets from configurable fake source IPs.
- Packets are fragmented to slip past DPI.
- TTL values are randomized so you don't look like you're sitting at hop 1.
- Honeypots are detected and skipped.
- The dashboard binds to 127.0.0.1. It never touches the network.
- Logging is file-only. Zero console output.
- There's a literal self-destruct command (
python run.py wipe --secure).
You know what the noisy tools don't have? A self-destruct button. Because they never assumed they'd need one.
Who Is This For?
- Red teamers who are tired of getting caught during recon
- Pentesters who want continuous visibility across multi-week engagements
- Internal security teams running purple team exercises
- Bug bounty hunters working internal scopes
Who is this NOT for? Script kiddies who want to "hack their school network." This is a professional tool for authorized assessments. The legal disclaimer isn't decoration.
Try It
git clone https://github.com/bidhata/HostVigil.git
cd HostVigil
pip install -r requirements.txt
python run.py daemon
Or if you're fancy:
pip install hostvigil
hostvigil daemon
Or if you're really fancy:
docker-compose up -d
Dashboard at localhost:5000. Default creds: admin/hostvigil. Change them immediately or I'll judge you.
The Bottom Line
The security industry has a weird fetish for noisy tools. We celebrate scanners that can hit a million hosts per second while completely ignoring that every single one of those probes just appeared on someone's SIEM dashboard.
HostVigil takes the opposite approach. Slow is smooth. Smooth is fast. And invisible is undefeatable.
Your blue team's $2M security stack is designed to catch scanners. It's not designed to catch a daemon that sends one probe every 30 seconds with randomized TTL and fragmented packets from rotating decoy sources.
That's not a bug in their detection. That's a fundamental limitation of signature-based defense against adaptive offense.
And that's why I built HostVigil.
Open source. MIT license. Stars appreciated. PRs welcome (maintain stealth principles or I'll close them so fast your head spins).