Privilege escalation reasoning engine
Parse enumeration output. Get ranked attack playbooks.
Feed Whirlpool any LinPEAS, WinPEAS, or manual enumeration output and get back a prioritized exploitation playbook with exact commands, confidence ratings, and multi-step attack chains.
Identifies LinPEAS .sh, WinPEAS .exe/.bat/.beta, and manual command output automatically. No --type flag needed.
329 GTFOBins, 86 LOLBAS, 42 kernel exploits, 9 potato attacks. Everything runs locally -- no API calls, no internet required.
Four-dimension weighted scoring: reliability (40%), safety (30%), simplicity (20%), stealth (10%). Five ranking profiles shift the weights.
Detects 12 multi-step paths: cron PATH hijack, Docker escape, NFS SUID planting, wildcard injection, LD_PRELOAD, and more.
Purpose-built parsers reject grep artifacts, version patterns, and false-positive words. Tested against 22 real-world samples with zero failures.
Rich terminal output with Catppuccin Mocha theme, Markdown reports for documentation, and structured JSON for tool integration.
Surface the top 5 highest-probability techniques instantly. One flag: --quick-wins
Import parsers, analyzer, ranker, and chain detector directly. Build Whirlpool into your own tooling and automation pipelines.
Whirlpool parses enumeration data, matches findings against knowledge bases, and ranks exploitation paths by probability of success.
Whirlpool analyzing LinPEAS output -- ranked techniques with exact exploitation commands.
Parse enumeration output into structured data, match findings against offline knowledge bases, and rank exploitation paths with composite scoring. Commands are output as text -- never executed.
Strip ANSI codes, detect format variants (LinPEAS .sh, WinPEAS .exe/.bat/beta), and extract structured data: SUID binaries, capabilities, sudo rights, services, privileges, and more.
Match parsed findings against gtfobins.json, kernel_exploits.json, potato_matrix.json, and lolbas.json. Analyze credentials, network services, writable files, groups, tokens, DLL hijacking, UAC, and AD/Kerberos.
Composite scoring across reliability, safety, simplicity, and stealth. Five profiles (default, oscp, ctf, stealth, safe) shift dimension weights.
Detect 12 multi-step attack paths that single-finding scanners miss: cron PATH hijack, Docker socket abuse, NFS SUID planting, wildcard injection, LD_PRELOAD, writable /etc/passwd.
Four bundled knowledge bases covering Linux and Windows privilege escalation techniques. No internet connection required.
Each exploitation path is scored across four dimensions. Profiles shift the weights to match OSCP exams, CTF speed runs, red team stealth, or safe testing.
| Component | Default | OSCP | CTF | Stealth | Safe |
|---|---|---|---|---|---|
| Reliability | 40% | 50% | 50% | 25% | 30% |
| Safety | 30% | 25% | 10% | 25% | 50% |
| Simplicity | 20% | 20% | 35% | 10% | 15% |
| Stealth | 10% | 5% | 5% | 40% | 5% |
One command to install, one command to run. No Docker, no build step, no configuration files. Python 3.9+ is the only requirement.
pipx is the recommended install method -- it creates an isolated environment and keeps your system Python clean. Install pipx if you don't have it yet.
Point Whirlpool at any enumeration output file. It auto-detects the format, parses the findings, matches them against offline knowledge bases, and outputs a ranked exploitation playbook.
Use --profile oscp for exam scenarios, --profile ctf for speed, --profile stealth for red team ops, or --profile safe when system stability matters.
Export to Markdown for reports, JSON for tool integration, or use the default terminal output with Catppuccin Mocha theming.