HackGraph

Interactive attack-path explorer for offensive security.

hackgraph.github.io

Start from a foothold and expand one technique at a time toward Domain Admin, SYSTEM or root. It runs entirely in the browser.

Run locally

There is no build step and nothing to install. The repository is the site, so serve the directory with whatever you already have and open http://localhost:5173:

python3 -m http.server 5173

Node is only needed for the checks:

node --test # content lint, adapter tests, engine tests
node tools/gen-reference.mjs # rebuild the reference pages after a content change
node tools/check-refs.mjs # check every reference URL still resolves

Contributing

Maps are plain data in src/data/. Adding a technique means editing those files and nothing else. A whole new map also needs an entry in META in tools/gen-reference.mjs, so it gets a reference page; the app itself picks it up on its own.

Before opening a PR run node --test, and node tools/gen-reference.mjs if you touched content.

Acknowledgements

The mindmap format was inspired by the Orange Cyberdefense mindmaps. The techniques lean on these projects, cited throughout:

• HackTricks
• The Hacker Recipes
• PayloadsAllTheThings
• BloodHound and SpecterOps research
• GTFOBins and LOLBAS

Every technique also links its own primary sources and credits the tools it uses.

License

MIT. For authorized security testing, CTFs, and learning.