The Metasploit GUI, mapped.

Hayduk is a free, open-source client for the Metasploit Framework and a browser-based Armitage alternative. Map hosts, services, modules, and live sessions in one tab.

Download Hayduk Watch it work

One Go binary for Linux, macOS, and Windows. No Java, Node, or Go runtime needed.

campaign alpha

Network map

msfrpcd connected

10.24.8.0/24 4 hosts

meridian-web

Linux Ubuntu 22.04

1 live session

10.24.8.21

22/tcpsshOpenSSH 8.9

443/tcphttpsnginx 1.24

Access

Session 1 meterpreter

Open session 1

Discovered
Live session
Login available
Pivot route

Illustrative campaign data. Select a host to inspect it.

The map is the workspace.

Hayduk is a browser-based Metasploit GUI built around the campaign, not a single console. It gives the engagement a surface, so the next move is visible instead of buried in a scrollback.

The network map groups hosts by subnet. Sessions, routes, and credentials appear where they belong. Every host, row, and module keeps its action menu.

Hayduk, an open-source Metasploit GUI, showing a campaign network map, host inspector, module library, and live Meterpreter console. — Hayduk's Metasploit GUI campaign overview. Interface shown with illustrative campaign data.

View the full campaign screenshot Watch the Hayduk demo

Discovered

Hosts and version-detected services arrive in the workspace as scans finish. Focus expands the map; Arrange resets the layout.

Live session

Meterpreter and shell sessions stay attached and visible. Choose one and its console opens without leaving the map.

Login available

Recovered credentials sit against the hosts and services they unlock, ready for a login workflow or a later review.

Pivot route

When a session reaches another network, the map draws the route and invites the next subnet onto the board.

Hayduk carries forward the graphical Metasploit workflow that Armitage established, as a separate implementation with a browser UI and one binary. If you are looking for an Armitage alternative, the map, module tree, and session controls will feel familiar; unlike the Java desktop client, Hayduk runs in a browser and needs no Java runtime. Metasploit itself is not bundled; Hayduk connects to it through go-msf.

A campaign, end to end.

The workflow follows the engagement, not a feature list. Find the network, learn what is running, choose a way in, stay in the session, and leave with something the client can open.

Discover the edge.

Give Hayduk an address or CIDR and choose a scanner from your Metasploit build. Hosts arrive in the active workspace as discovery finishes.

Discover hosts Ready

Targets10.24.8.0/24

Scannerauxiliary/scanner/discovery/arp_sweep

Workspacecampaign alpha

4 hosts added to the campaign

Read what's exposed.

Version detection runs db_nmap, fingerprints service names and versions, and imports them into the workspace. Clear it to fall back to a portscan module.

Services 8 found

Example services discovered in the campaign
Host	Port	Service	Version
meridian-web	22/tcp	ssh	OpenSSH 8.9
meridian-web	443/tcp	https	nginx 1.24
build-runner	8080/tcp	http	Jenkins 2.4
fileserver	445/tcp	smb	Samba 4.15

Version detection needs nmap and a connected database on the Metasploit host.

3

Choose a way in.

Browse the module catalogue by path. Ranks, options, and payloads sit in the same panel. Find attacks prefills a matching host and port; a right-click gets you there too.
Module library 10 modules

Filter modules
- auxiliary/scanner/discovery/arp_sweepauxiliary
- auxiliary/scanner/portscan/tcpauxiliary
- auxiliary/scanner/smb/smb_versionauxiliary
- auxiliary/scanner/http/http_versionauxiliary
- exploit/windows/smb/ms17_010_eternalblueexploit
- exploit/multi/http/log4shell_header_injectionexploit
- exploit/multi/handlerexploit
- post/multi/gather/ssh_credspost
- windows/x64/meterpreter/reverse_tcppayload
- x86/shikata_ga_naiencoder
No module matches that filter. Try a service, a platform, or a path.

Sample paths from a standard Metasploit install.
Stay in the session.

Meterpreter and shell consoles open in Interact. Work across workspaces, keep several sessions live, and upgrade a shell when the path is there.

Session 1 meridian-web Local demo

meterpreter >sysinfo

Computer : MERIDIAN-WEB

OS : Linux 5.15.0-105-generic x86_64

Architecture : x64

System Language : en_US

Domain : meridian

Logged On Users : 1

Meterpreter : x64/linux

Demo console command

Canned commands. Nothing here connects to a target.
Leave a record.

Export a self-contained HTML report for the active workspace: hosts, services, sessions, credentials, loot, and the event log. It opens on a laptop that has never run Hayduk.

campaign-alpha.html

Self-contained HTML

Hosts
4

Services
8

Sessions
2

Credentials
1

Includes the event log, loot, and every service record from the workspace.

Campaign data across this page is illustrative.

Shared while it runs. Portable when it's done.

Run Hayduk for a team on a trusted network, or export the workspace for someone who was not there. Both views come from the same campaign.

Work the same campaign.

Start the binary with a team flag and a reachable address. Operators open the same token URL, choose a name, and see the same hosts, sessions, and event log.

./hayduk --team --listen 192.168.1.10:8787

Use the interface address your operators can reach. Wildcard addresses are refused.

Team mode uses one shared token over plain HTTP. Operator names are labels, not verified identities. Use it on networks you trust, and treat the token URL like a password. Read the security policy.

Also on the board

Hail Mary Pace matching exploits across selected hosts and keep every launch in one event log.
Credentials and loot Review what the workspace holds, then use recovered credentials in login workflows.
Every session, one view The Sessions tab keeps live consoles visible across workspaces, even after you switch campaigns.

hayduk. Campaign report

Workspace campaign alpha. Generated 21 October 2026.

4Hosts

8Services

2Sessions

1Credential

Example report host rows
Host	Address	Access	Services
meridian-web	10.24.8.21	Session	22, 443
build-runner	10.24.8.42	Session	22, 8080
fileserver	10.24.8.56	Credentials	21, 445
atlas-dc	10.24.8.10	None	53, 88, 389

Self-contained HTML. No external requests. Event log included

A workspace export, ready to send. Illustrative campaign data.

Questions, answered.

Hayduk is a free, open-source Metasploit GUI for the browser. It turns a Metasploit Framework instance into a campaign map: hosts, services, modules, sessions, and reports in one tab.

If you are looking for a Metasploit web interface or an Armitage alternative, these are the questions operators ask first.

Detailed setup lives in the Hayduk README. For bugs and questions, open an issue on GitHub.

What is Hayduk?

Hayduk is a free, open-source Metasploit GUI that runs in the browser. It connects to a Metasploit Framework instance through msfrpcd and turns the campaign into one view: hosts, services, modules, live sessions, and a report you can hand over. It is MIT licensed and ships as a single Go binary.

Is Hayduk an Armitage alternative?

Yes. Hayduk follows the graphical Metasploit workflow that Armitage established: hosts on a map, modules in a tree, and sessions in reach. The practical difference is delivery. Armitage is a Java desktop application; Hayduk runs in the browser as one Go binary. It is a separate implementation and does not bundle Metasploit.

Does Hayduk include Metasploit Framework?

No. Hayduk is a client for Metasploit Framework, not a Metasploit distribution. It talks to the msfrpcd service on an instance you run; that instance performs the scanning, exploitation, and session work. If you need a disposable Metasploit setup, the repository includes a Docker lab with Metasploit and optional targets.

Does Hayduk run on Kali Linux, macOS, and Windows?

Yes. Release archives cover Linux (including Kali Linux and Ubuntu), macOS, and Windows. The release binary includes the browser UI, so no Java, Node.js, or Go runtime is required. You also need a reachable Metasploit Framework instance running msfrpcd; workspace features need Metasploit's database connected, and version detection needs nmap on the Metasploit host. See the Hayduk setup steps.

How does Hayduk connect to Metasploit?

Hayduk uses Metasploit's RPC service, msfrpcd. Start msfrpcd on the Metasploit host, then enter its host, port, user, password, and SSL setting in the connect dialog. A local default is 127.0.0.1, port 55553, user msf, with SSL off.

Can more than one operator share a campaign?

Yes, with team mode. Start Hayduk with --team on a reachable address and share the token URL; each operator picks a name and works on the same hosts, sessions, and event log. Team mode uses one shared token over plain HTTP, so keep it on a trusted network and treat the URL like a password. The security policy explains the trust model.

What can I export from Hayduk?

A self-contained HTML campaign report scoped to the active workspace. It includes hosts, services, sessions, credentials, loot, and the event log. The report opens offline, without Hayduk, Metasploit, or a network connection. See the example report.

Where can I try Hayduk safely?

Use Hayduk only on systems you own or have written permission to test. For a self-contained practice environment, the repository includes a Docker lab with Metasploit, a database, and optional vulnerable targets. It is the fastest way to walk through discovery, scanning, sessions, and the report.

One binary. Then your browser.

Hayduk is a Metasploit GUI, not a Metasploit distribution. It connects to the msfrpcd you already run, serves the UI itself, and opens a tab. No installer, no Java, no separate frontend.

Download the latest release Read the quickstart

Latest release v0.1.6. Free and open source under the MIT license.

Release binaries run on Linux (including Kali Linux and Ubuntu), macOS, and Windows. Go and Node are only needed to build from source.

Quickstart About two minutes

Start Metasploit RPC

msfrpcd -P 'yourpassword' -S -f -a 127.0.0.1 -p 55553

Keep this terminal open. -S disables SSL for a local connection.

Run Hayduk

./hayduk

On Kali Linux and Ubuntu, run it from the extracted folder. On Windows PowerShell, use .\hayduk.exe. The UI opens with a token in the URL.

Connect

Host: 127.0.0.1
Port: 55553
User: msf
Password: the one you set
SSL: off

Workspace features also need Metasploit's database connected.

No Metasploit yet? Use the lab.

The repository includes a disposable Docker lab with a database and optional vulnerable targets. Connect with the same host and port.

Read the lab steps

scripts/msf/up.sh --with-vulnbox