Install the Console as an App

Install the Console as an App

The Web Console is a PWA, which is a web app your device can install. Add it once and it behaves like any other app: its own icon, its own window, no address bar, and it is one tap from your home screen.

Point it at an Agent running on a VPS and you are carrying a full pentest agent in your pocket.

First, get an HTTPS address

A phone will only install a site served over HTTPS. It is the one requirement, and it is there for a good reason: you should never send a password over plain HTTP either.

There is one exception. On a desktop, http://127.0.0.1:8765 counts as secure, so a console running on that same machine installs with no extra work. An SSH tunnel to a server looks like localhost too (ssh -L 8765:127.0.0.1:8765 you@your-server), so a desktop can install through one of those as well. A phone, though, needs a real HTTPS URL, and the quickest way to get one is a tunnel.

A tunnel dials out from the machine running the console and hands you a public HTTPS address, so you never open a port or touch a firewall. Two good options:

Cloudflare Tunnel

On the machine running the console:

cloudflared tunnel --url http://127.0.0.1:8765

It prints a https://<random>.trycloudflare.com address straight away. Open that on your phone and install from there. For something you will reuse, create a named tunnel and put Cloudflare Access in front of it, so a login is required before a request ever reaches your machine.

ngrok

ngrok http 8765

The terminal shows a https://<random>.ngrok-free.app forwarding address. Open it on your phone and install. ngrok can also add its own access control, so turn that on if the tunnel will be up for a while.

Understand what a tunnel does. Both of these publish a public HTTPS address that anyone who learns it can reach, with only your XHack password in front of the sign-in page. That is a reasonable trade for a throwaway VPS and a strong passphrase, and it is the practical way to get the app onto a phone. Prefer cloudflared or ngrok over pointing a personal domain at the box: a tunnel URL is disposable and easy to kill, while a domain ties the exposure to you and tends to outlive the engagement. Take the tunnel down when you are done, and use sign out everywhere in Settings if anything looks off. For sensitive work, skip the public tunnel and use the SSH tunnel above instead.

Full server setup, including running the console as a service, is in Run the Web Console on a Server.

iPhone and iPad

Safari is the one that can install apps on iOS. Chrome on an iPhone cannot, so use Safari here.

1. Open your console address in Safari.
2. Sign in, so it opens straight to your sessions next time.
3. Tap the Share button, the square with the arrow pointing up.
4. Scroll and tap Add to Home Screen.
5. Name it, then tap Add.

You now have the XHack wolf on your home screen, opening in its own full-screen window.

If Add to Home Screen is missing, you are almost certainly on HTTP or in a private window.

Android

1. Open your console address in Chrome.
2. Sign in.
3. Tap the three dots menu.
4. Tap Install app, or Add to Home screen depending on your Chrome version.
5. Confirm with Install.

Chrome often shows an Install prompt at the bottom of the screen on its own. Either route gets you the same app. Edge, Brave, Samsung Internet and other Chromium browsers all work the same way.

Windows

In Chrome or Edge:

1. Open your console address and sign in.
2. Look for the install icon in the address bar, a small monitor with a downward arrow.
3. Select it, then Install.

No icon? Use the three dots menu, then Apps, then Install this site as an app in Chrome, or Apps, then Install this site as an app in Edge.

The console is pinned to your Start menu and taskbar like any other program, and opens in a clean window.

macOS

Safari 17 and newer: open the console, then File, then Add to Dock.

Chrome or Edge: open the console, then the three dots menu, then Cast, Save and Share, then Install page as app. On some versions it is simply Install.

Linux

Chrome, Chromium and Edge all install web apps the same way as on Windows: the install icon in the address bar, or the three dots menu and Install. The app lands in your application launcher.

Using it on a phone

The layout adapts, it does not just shrink:

• The sessions list and the side panels open as full-screen drawers.
• Repeater, Cloud and Autonomous move into the sidebar footer, alongside links to your XHack dashboard and the status page.
• Tool cards, diffs and terminal output stay readable and scroll on their own.

Because turns run on the machine hosting the Agent rather than in your browser, you can start something, lock your phone, and open the app later to find the run still going and the transcript waiting.

Updating and removing it

The app updates itself when you open it. There is nothing to reinstall after an Agent upgrade.

To remove it, treat it like any app: press and hold the icon on a phone, or uninstall from your browser's apps list on a desktop. Removing the app does not touch anything on the machine running the Agent.

If it will not install

• No install option: you are on HTTP. Put an HTTPS address in front of it with a cloudflared or ngrok tunnel, as above.
• On iOS, no Add to Home Screen: you are not in Safari, or you are in a private tab.
• It opens in a browser tab instead of its own window: the shortcut was saved as a bookmark. Remove it and install it again with the steps above.
• It cannot reach the Agent: your tunnel or VPN is down. Open the same address in a normal browser tab to confirm.

Related

• The Web Console
• Run it on a server
• Turn it on from the desktop app