METATRON - New AI Tool Enhances Penetration Testing on Linux
Basically, METATRON is a new tool that helps find security weaknesses in systems using AI.
A new open-source tool called METATRON is revolutionizing penetration testing. Designed for Linux, it uses AI to assess vulnerabilities offline. This ensures sensitive data remains secure, making it ideal for professionals.
What Is METATRON?
METATRON is an open-source penetration testing framework designed for security professionals. It operates fully offline, utilizing a locally hosted large language model (LLM) for vulnerability assessments. This approach eliminates the need for cloud connectivity and third-party services, making it a secure option for sensitive environments.
Key Features
Built for Parrot OS and other Debian-based Linux distributions, METATRON combines various automated reconnaissance tools. It includes:
- nmap for port scanning
- nikto for web server vulnerability detection
- whois and dig for DNS data
- whatweb for technology fingerprinting
- curl for HTTP header inspection
These tools work together to gather comprehensive data about the target system. Once the reconnaissance is complete, the results are analyzed by METATRON's AI model, named metatron-qwen. This model is a fine-tuned version of the huihui_ai/qwen3.5-abliterated:9b base model, specifically customized for penetration testing.
How It Works
The AI model can autonomously request additional tool executions during the analysis. This feature, known as the agentic loop, allows for a more dynamic and thorough assessment process. Additionally, METATRON integrates DuckDuckGo-based web searches and CVE lookups, enabling real-time cross-referencing of discovered services against known vulnerabilities without needing API credentials.
Data Management
METATRON uses a structured five-table MariaDB schema to store scan data. This includes:
- A central history table
- Tables for discovered vulnerabilities with severity ratings
- Records of attempted exploits and their outcomes
- A summary table with raw scan output and AI analysis
Users can manage their data directly from the command line interface (CLI), allowing for easy editing and exporting of reports in PDF or HTML formats. This feature is particularly beneficial for penetration testers needing to document their findings.
Security and Compliance
One of METATRON's standout features is its zero-exfiltration guarantee. All AI inference occurs on-device, ensuring that sensitive data, such as internal IP ranges and vulnerabilities, never leaves the tester's machine. This makes METATRON a suitable choice for engagements with strict data handling requirements.
Getting Started
METATRON is available on GitHub under the MIT License. It requires a minimum of 8.4 GB RAM for the 9b model variant. Security researchers and professionals can leverage this tool to enhance their penetration testing capabilities while ensuring data security and compliance.