My supervisor teaches a penetration-testing unit where the lab sessions are the whole point: students write real exploit code against authorized targets. The catch is that the LLM assistants students reach for (ChatGPT, Claude, Copilot) will, quite reasonably, refuse a lot of that. "Write a reverse shell," "craft this SQL injection payload," "build a port scanner": even in a sandboxed, authorized, for-credit lab, students spend half their time fighting refusals instead of learning.

So his ask was simple: give the students a coding assistant that helps with the actual coursework, inside an authorized, access-controlled environment. I built PentestAssist.

What it is

A self-hosted chat assistant running an uncensored, cybersecurity-tuned coding model, WhiteRabbitNeo-V3-7B (a Qwen2.5-Coder-7B base), on a single lab GPU. It behaves like a normal coding copilot, except it doesn't bail out when the task is offensive-security coursework. Access is gated behind a login; it's for enrolled students working on authorized lab targets, not the open internet.

The stack

• Model serving: ms-swift with vLLM (OpenAI-compatible, token streaming), plus flash-attn, Torch 2.9, CUDA 12.8; the model runs fp8-quantized so a 7B fits comfortably on the lab card.
• Backend: Django + DRF with JWT auth (HS256, shared with Hasura), and an async streaming view that proxies the model's tokens straight to the browser.
• Data: Postgres + Hasura GraphQL for chat history, with row-level permissions keyed to each student's user id.
• Frontend: Next.js + Chakra UI, a streaming chat window plus an admin panel for managing accounts.
• Ops: PM2 plus a Cloudflare Tunnel, so the whole thing runs off a box in the lab without opening any ports.

It's the same shape as the rest of my self-hosted stack (Django + Postgres + Hasura + Next.js), with a vLLM model server bolted on the side.

Try it

It's live at pentestllm.larryhh.com. Accounts are handed out individually. If you're a student in the unit (or just want to take a look), leave me a message or email me and I'll set you up with one.