Documentation

Bring Your Own Key (BYOK)

Connect your own AI provider key so your chats and the Agent run on the model you choose — while staying inside XHack's engine. A step-by-step guide.

Getting Started

Get up and running with XHack in minutes — sign up, get verified, open your workspace, and run your first AI-powered security task. No command line, all in your browser.

Platform Overview

Your first 30 minutes on XHack — sign in, register an asset, run a scan, invite your team, and connect a notification channel.

AI Skills

Import reusable expertise packs and switch them on to focus the AI on a specific discipline — offensive AD, cloud, web, recon and more. A step-by-step guide.

Installation

Install the XHack desktop Agent in a few clicks — download, run the installer, sign in. It's a normal desktop app, no command line required.

SOC Dashboard

Step-by-step playbook for SOC operations on XHack — adding log sources, writing rules, working alerts, managing incidents, and using suppressions.

Auto Browsing

XHack's autonomous browsing engine navigates, interacts with, and extracts data from websites without manual intervention.

Identity Verification (Researchers)

Complete guide to identity verification for researcher and individual accounts — what to upload, how the four-step wizard works, how long review takes, and what to do if you are rejected.

Image Reading (OCR)

Drop a screenshot, scan, or PDF into XHack and the AI reads the text out of it and works with it right away — no retyping. A step-by-step guide.

Vulnerability Assessment

Hands-on playbook for VA — register an asset, run a scan, read findings, generate reports, and stay within plan quotas.

AI Probe

Step-by-step playbook for AI Probe — register an LLM target, run a scan, read findings, escalate vulnerabilities, and use the AI bypass generator.

Autonomous Pentesting

XHack autonomously discovers vulnerabilities, writes exploits, and generates professional reports — all powered by AI.

Identity Verification (Companies)

Complete guide to identity and business verification for company accounts — the owner's ID, registered entity details, KYB documents, and how workspace verification passes to the team you invite.

Apple Silicon Macs

A native arm64 build is now available as a direct .dmg download for Apple Silicon. The x86_64 build still runs through Rosetta 2 for Intel Macs and the script installer.

GitGuard

Hands-on guide to GitGuard — connect a GitHub account, monitor repos, run manual scans, read findings, and act on PR comments.

SOC Operations

Leverage XHack AI for Security Operations Center tasks including threat hunting, incident response, and log analysis.

Attack Chains

Use Attack Chains to correlate alerts across MITRE ATT&CK kill chain stages — create chains, read confidence scores, and respond.

Unrestricted AI

XHack AI operates without artificial limitations — providing full access to offensive security capabilities for authorized professionals.

Detection Rules

Step-by-step playbook for writing, testing, and managing detection rules — custom, threshold, and Sigma — plus log sources and suppressions.

Prompting Guide

Master the art of prompting XHack AI for effective security testing. Learn how to write clear, specific requests for bug hunts, reconnaissance, vulnerability testing, and more.

Capabilities & Use Cases

What you CAN use XHack AI for. Legitimate security testing, bug bounty hunting, and threat detection.

Threat Intelligence

How to use the IOC database, look up indicators, sync threat feeds, and pivot from alerts into threat actor research.

Asset Management

How to register, verify, and manage every domain, IP, API, and application your organization protects.

legal

Restrictions & Prohibited Activities

What you CANNOT use XHack AI for. Important legal and ethical boundaries.

legal

Privacy & Data Policy

XHack AI privacy - Agent uses xhack-ai model with local storage, Platform stores chats for session management

Settings & Administration

How to manage your organization, invite members, create roles, generate API keys, connect integrations, and configure billing.

Sub-Agents

Launch several XHack sub-agents that work in parallel on recon, scanning, and exploitation, then watch and steer each one live from the Agents panel.

HTTP Repeater

Replay and edit raw HTTP requests inside XHack, a built-in Burp-style tool for testing IDOR, auth bypass, and parameter injection by hand.

Background Tasks

Run long scans, fuzzers, and listeners in the background in XHack, watching each one stream live in its own terminal tab while you keep chatting.

Permission Modes

Control how much the XHack Agent does on its own, approve each action, auto-approve edits, go fully hands-off, or stay read-only, per chat.

Project Memory

XHack keeps a per-project memory of your targets, scope, and decisions, reading and updating it automatically so it remembers your engagement across sessions.

Plugins

Install and manage XHack plugins, bundles of Skills you enable from the Skills & Plugins panel, safe by design and always disabled until you turn them on.

Mobile App Testing

Analyze Android APKs and iOS IPAs in XHack, drive live devices over ADB, and instrument apps with Frida, static and dynamic mobile testing, no command line.

Findings & Reports

Confirmed issues collect in the XHack Vulnerabilities panel as full findings you can search, revisit, and export as JSON, Markdown, HTML, or a branded PDF report.

Web Console

Drive the full XHack Agent from a browser on any device. The same engine as the desktop app, streamed live, with turns that keep running after you close the tab.

Turn On the Web Console

Start the browser interface from the XHack desktop app. Settings, Web Access, create a user, press Start. No terminal, about thirty seconds.

Run the Web Console on a Server

Host the XHack Agent on a VPS and use it from your phone or laptop. Create your login, start the console, keep it running, and reach it safely over a tunnel.

Install the Console as an App

Add the XHack Web Console to your iPhone, Android phone, Windows PC or Mac. It gets an app icon and its own window, and drives your VPS-hosted Agent like a native app.