Documentation

Bring Your Own Key (BYOK)

Connect your own AI provider key so your chats and the Agent run on the model you choose — while staying inside XHack's engine. A step-by-step guide.

Getting Started

Get up and running with XHack in minutes — sign up, get verified, open your workspace, and run your first AI-powered security task. No command line, all in your browser.

Platform Overview

Your first 30 minutes on XHack — sign in, register an asset, run a scan, invite your team, and connect a notification channel.

AI Skills

Import reusable expertise packs and switch them on to focus the AI on a specific discipline — offensive AD, cloud, web, recon and more. A step-by-step guide.

Installation

Install the XHack desktop Agent in a few clicks — download, run the installer, sign in. It's a normal desktop app, no command line required.

SOC Dashboard

Step-by-step playbook for SOC operations on XHack — adding log sources, writing rules, working alerts, managing incidents, and using suppressions.

Auto Browsing

XHack's autonomous browsing engine navigates, interacts with, and extracts data from websites without manual intervention.

Identity Verification (Researchers)

Complete guide to identity verification for researcher and individual accounts — what to upload, how the four-step wizard works, how long review takes, and what to do if you are rejected.

Image Reading (OCR)

Drop a screenshot, scan, or PDF into XHack and the AI reads the text out of it and works with it right away — no retyping. A step-by-step guide.

Vulnerability Assessment

Hands-on playbook for VA — register an asset, run a scan, read findings, generate reports, and stay within plan quotas.

AI Probe

Step-by-step playbook for AI Probe — register an LLM target, run a scan, read findings, escalate vulnerabilities, and use the AI bypass generator.

Autonomous Pentesting

XHack autonomously discovers vulnerabilities, writes exploits, and generates professional reports — all powered by AI.

Identity Verification (Companies)

Complete guide to identity and business verification for company accounts — the owner's ID, registered entity details, KYB documents, and how workspace verification passes to the team you invite.

GitGuard

Hands-on guide to GitGuard — connect a GitHub account, monitor repos, run manual scans, read findings, and act on PR comments.

SOC Operations

Leverage XHack AI for Security Operations Center tasks including threat hunting, incident response, and log analysis.

Attack Chains

Use Attack Chains to correlate alerts across MITRE ATT&CK kill chain stages — create chains, read confidence scores, and respond.

Unrestricted AI

XHack AI operates without artificial limitations — providing full access to offensive security capabilities for authorized professionals.

Detection Rules

Step-by-step playbook for writing, testing, and managing detection rules — custom, threshold, and Sigma — plus log sources and suppressions.

Prompting Guide

Master the art of prompting XHack AI for effective security testing. Learn how to write clear, specific requests for bug hunts, reconnaissance, vulnerability testing, and more.

Capabilities & Use Cases

What you CAN use XHack AI for. Legitimate security testing, bug bounty hunting, and threat detection.

Threat Intelligence

How to use the IOC database, look up indicators, sync threat feeds, and pivot from alerts into threat actor research.

Asset Management

How to register, verify, and manage every domain, IP, API, and application your organization protects.

legal

Restrictions & Prohibited Activities

What you CANNOT use XHack AI for. Important legal and ethical boundaries.

legal

Privacy & Data Policy

XHack AI privacy - Agent uses xhack-ai model with local storage, Platform stores chats for session management

Settings & Administration

How to manage your organization, invite members, create roles, generate API keys, connect integrations, and configure billing.