Offensive and defensive tools

Choose offensive mode

On the desk, set the mode to Offensive and confirm one target, the scope, your name, and the authorisation statement. In the terminal, pass --mode offensive together with --target, --scope, --by, and the exact statement. --model sentinel-offensive selects the same Sentinel route. --thinking asks that route to take longer. The names you see stay Oluso Sentinel.

oluso chat --mode offensive --target app.example --scope "the login service" --by "Ada" --statement "I am authorised to test this target and I accept responsibility for this engagement."
oluso chat --mode offensive --thinking --target app.example --scope "the login service" --by "Ada" --statement "I am authorised to test this target and I accept responsibility for this engagement."

What the sandbox can run

Defensive checks are available while you review or scan: ripgrep, semgrep, bandit, trivy, radare2, binwalk, and gdb. Offensive mode, after the statement and only against that one host, can also run nmap, nikto, sqlmap, gobuster, ffuf, netcat, curl, wget, python3 (requests, scapy, and pwntools), john, and hashcat on CPU. The agent calls them through security_tool, not a free-form shell. Remote shells are refused. The full pin list is in deploy/sandbox/TOOLS.md.

Browser

The browser tool drives headless Chromium inside the same sandbox. It can open a page on the authorised target, click, fill, or save a screenshot, and it returns the status, title, and visible text. That is how Oluso does computer use for a web app. It does not open any other host.