Four interfaces, one library
Interactive shell, CLI runner, encrypted REST/WebSocket API and an MCP server — the same 468 modules behind each.
← Store · // rustsploit
Rustsploit
Modular offensive tooling for embedded and network targets, written in Rust and inspired by RouterSploit and Metasploit. One binary exposes the same module library through four interfaces, with built-in service and TLS fingerprinting.
from $499support & customisation
⚠ Authorized use only — liability noticeOffensive-security software for lawful, authorized testing only. You must hold explicit written authorization for any target. Provided as-is, without warranty.
// what it is
What it is
Rustsploit began as a Rust rewrite of RouterSploit and has grown into a broad offensive framework for routers, cameras, appliances and general network services. A single binary carries an ever-growing library of exploit, scanner and credential modules that register themselves natively.
The same module library is driven through four interfaces: an interactive shell, a one-shot command-line runner, a post-quantum-encrypted REST/WebSocket API, and a Model Context Protocol server — so it fits a manual session, a script, a service, or an AI-driven workflow equally well.
Service identification is built in: Recog fingerprinting names what is listening, and JARM/JA3 TLS fingerprinting characterises encrypted services before you ever send a module at them.
// capabilities
What it does
Self-registering modules
Exploits, scanners and credential modules register themselves natively, so the library grows without wiring.
Recog fingerprinting
Identifies services and devices from their banners before you choose a module.
JARM / JA3 TLS fingerprinting
Characterises encrypted services to tell appliances apart and spot what a port really runs.
Post-quantum-encrypted API
The REST/WebSocket control channel is encrypted with post-quantum primitives.
Embedded-first targets
Routers, cameras, appliances and network services — the devices other frameworks treat as an afterthought.
// under the hood
Specifications
- Language
- Rust
- Latest release
- v0.5.1
- Modules
- 468 self-registering native modules
- Interfaces
- Shell, CLI, REST/WebSocket API, MCP
- Source
- github.com/s-b-repo/rustsploit
- Intended use
- Authorized security assessments only
// what you pay for
Support, not a paywall
Rustsploit’s source is public. What you pay for is the engineer who built it.
- Installation & configuration help — stood up in your environment and tuned to your setup and rules of engagement.
- Bug fixes & improvements, prioritised for you — issues you hit move to the front of the queue.
- Customisation — new modules, integrations or behaviour built for your targets. You keep the source.
- A direct line to the engineer who wrote it — no support tier in between.
// the fine print
Terms & liability
Authorized, lawful use only. Offensive-security software published for legitimate testing, research and education. You alone are responsible for how you use it and must hold explicit written authorization for any system you target.
No liability. Provided as-is and without warranty; to the maximum extent permitted by law, Cyber Sec and Stephan Botes accept no liability for misuse.
What the fee buys. The engineer’s time — setup, fixes and customisation. The source is public, so you pay for the work, not for access.
Questions about scope, licensing or authorization? Get in touch first.