Basilisk-7B

An uncensored, web‑pentest‑focused language model fine‑tuned from Qwen2.5-Coder-7B-Instruct. Basilisk answers offensive‑security questions directly — payloads, PoCs, tool commands, and reports — without refusals or moral disclaimers, for authorized security testing, CTFs, and education.

It was trained with QLoRA + Unsloth on a single 8 GB GPU and is shipped as a Q4_K_M GGUF (~4.7 GB) that runs comfortably on 8 GB of VRAM.

• Base: Qwen2.5‑Coder‑7B‑Instruct (~7.6B params)
• Method: QLoRA (LoRA r=16), 1 epoch on 8,054 curated examples
• Coverage: 19 web‑vulnerability domains
• Code & datasets: https://github.com/sl4de0day/basilisk-7b

Files

File	Description
basilisk-7b-Q4_K_M.gguf	Quantized weights for llama.cpp / Ollama / LM Studio
adapter/	LoRA adapter (apply on the base model with PEFT)
Modelfile	Ollama model definition

Usage

Ollama (loads the GGUF straight from this repo)

ollama run hf.co/sl4de/Basilisk-7B:Q4_K_M

llama.cpp

./llama-cli -m basilisk-7b-Q4_K_M.gguf -p "nmap shows 8080/tcp open Apache Tomcat 9.0.30. Next steps?"

LoRA adapter (transformers + PEFT)

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen2.5-Coder-7B-Instruct", device_map="auto")
model = PeftModel.from_pretrained(base, "sl4de/Basilisk-7B", subfolder="adapter")
tok = AutoTokenizer.from_pretrained("sl4de/Basilisk-7B", subfolder="adapter")

Ask in English for best results.

What it does

• Injection — SQLi / NoSQLi / command injection, WAF bypass, blind extraction, sqlmap.
• XSS & client‑side — reflected / stored / DOM XSS, CSP bypass, filter/sanitizer evasion, framework gadgets.
• Recon — subdomain/content/parameter discovery, nuclei/ffuf/nmap usage and output interpretation, automation.
• Server‑side & more — SSRF, XXE, deserialization, auth/JWT/OAuth, access control (IDOR/BOLA), API security, SSTI, LFI/RFI, CSRF, CORS, request smuggling, prototype pollution, race conditions, cache poisoning, open redirect, file upload.
• Professional finding reports with correct CVSS vectors and multi‑turn recon → exploit flows.

Training

Dataset	sl4de/basilisk-webpentest — 8,054 examples, 19 domains
Method	QLoRA (4‑bit), LoRA r=16, target = all linear layers
Hyperparams	seq 448, batch 1 × grad‑accum 8, adamw_8bit, lr 2e‑4, 1 epoch
Hardware	1× RTX 4060 Laptop (8 GB)

Limitations

• A 7B model applies known techniques well but won't invent novel exploit chains. Always verify generated payloads and commands before use.
• Occasional minor bugs in complex generated code are expected at this size.

Disclaimer

For authorized penetration testing, CTF practice, security research, and education only. Do not use it against systems you do not own or lack explicit written permission to test. You are responsible for complying with all applicable laws.

License

MIT © sl4de