own2pwn

We build transparent, auditable tools that let AI agents do real offensive-security work — and that keep humans in full control, with complete visibility, while they do it. Everything we publish here is open source.

🌐 Website — own2pwn.fr
💻 Code — github.com/own2pwn-fr
✉️ Contact — contact@own2pwn.fr

⭐ Featured

`burpwn` — Burp, for AI agents

github.com/own2pwn-fr/burpwn · Rust · AGPL-3.0 · early-stage (v0.1.0)

A transparent intercepting proxy fused with a rootless Linux sandbox, so any AI agent can orchestrate a web pentest — no Burp GUI, no manual proxy wiring.

burpwn exec -- <cmd>

runs <cmd> inside a user + network namespace whose entire HTTP / HTTPS (MITM-decrypted) / DNS / TCP traffic is captured and made queryable — from the CLI or over MCP — so an agent can launch tooling, then inspect, search and reason over every request and response it generated.

Crucially, the agent's own LLM traffic is never captured: the model's API calls stay out of the recorded session, so the agent reasons over the target's traffic, not its own.

It's early (v0.1.0) and moving fast, but it already works end to end.

`own2pwn-fr/burpwn-usage` — instruction-tuning dataset

huggingface.co/datasets/own2pwn-fr/burpwn-usage · AGPL-3.0

2,584 instruction-tuning examples — CLI invocations and MCP tool-call traces — for finetuning open models in the 4B–70B range to drive burpwn. Ships with LLaMA-Factory recipes so you can go from a base model to a burpwn-fluent agent.

🔭 What's coming

More burpwn capabilities and a wider tool / MCP surface for agents.
Finetuned agent checkpoints trained on burpwn-usage.
More open datasets and tooling around agent-driven web security.

⚖️ Responsible use

Our tools are for authorized security testing only — your own systems, or targets you have explicit written permission to test. Use them lawfully and ethically.

Maintained by own2pwn · contact@own2pwn.fr