---
license: mit
base_model: Qwen/Qwen2.5-Coder-7B-Instruct
library_name: transformers
pipeline_tag: text-generation
language:
- en
tags:
- cybersecurity
- penetration-testing
- security
- offensive-security
- gguf
- unsloth
- qwen2
---

# Basilisk-7B

An **uncensored, web‑pentest‑focused** language model fine‑tuned from [`Qwen2.5-Coder-7B-Instruct`](https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct).
Basilisk answers offensive‑security questions directly — payloads, PoCs, tool commands, and reports — without refusals or moral disclaimers, for **authorized security testing, CTFs, and education**.

It was trained with QLoRA + [Unsloth](https://github.com/unslothai/unsloth) on a single 8 GB GPU and is shipped as a **Q4_K_M GGUF** (~4.7 GB) that runs comfortably on 8 GB of VRAM.

- **Base:** Qwen2.5‑Coder‑7B‑Instruct (~7.6B params)
- **Method:** QLoRA (LoRA r=16), 1 epoch on 8,054 curated examples
- **Coverage:** 19 web‑vulnerability domains
- **Code & datasets:** https://github.com/sl4de0day/basilisk-7b

## Files

| File | Description |
|---|---|
| `basilisk-7b-Q4_K_M.gguf` | Quantized weights for llama.cpp / Ollama / LM Studio |
| `adapter/` | LoRA adapter (apply on the base model with PEFT) |
| `Modelfile` | Ollama model definition |

## Usage

### Ollama (loads the GGUF straight from this repo)

```bash
ollama run hf.co/sl4de/Basilisk-7B:Q4_K_M
```

### llama.cpp

```bash
./llama-cli -m basilisk-7b-Q4_K_M.gguf -p "nmap shows 8080/tcp open Apache Tomcat 9.0.30. Next steps?"
```

### LoRA adapter (transformers + PEFT)

```python
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen2.5-Coder-7B-Instruct", device_map="auto")
model = PeftModel.from_pretrained(base, "sl4de/Basilisk-7B", subfolder="adapter")
tok = AutoTokenizer.from_pretrained("sl4de/Basilisk-7B", subfolder="adapter")
```

Ask in English for best results.

## What it does

- **Injection** — SQLi / NoSQLi / command injection, WAF bypass, blind extraction, `sqlmap`.
- **XSS & client‑side** — reflected / stored / DOM XSS, CSP bypass, filter/sanitizer evasion, framework gadgets.
- **Recon** — subdomain/content/parameter discovery, `nuclei`/`ffuf`/`nmap` usage and output interpretation, automation.
- **Server‑side & more** — SSRF, XXE, deserialization, auth/JWT/OAuth, access control (IDOR/BOLA), API security, SSTI, LFI/RFI, CSRF, CORS, request smuggling, prototype pollution, race conditions, cache poisoning, open redirect, file upload.
- Professional **finding reports** with correct CVSS vectors and multi‑turn recon → exploit flows.

## Training

| | |
|---|---|
| Dataset | [sl4de/basilisk-webpentest](https://huggingface.co/datasets/sl4de/basilisk-webpentest) — 8,054 examples, 19 domains |
| Method | QLoRA (4‑bit), LoRA r=16, target = all linear layers |
| Hyperparams | seq 448, batch 1 × grad‑accum 8, `adamw_8bit`, lr 2e‑4, 1 epoch |
| Hardware | 1× RTX 4060 Laptop (8 GB) |

## Limitations

- A 7B model applies known techniques well but won't invent novel exploit chains. **Always verify generated payloads and commands before use.**
- Occasional minor bugs in complex generated code are expected at this size.

## Disclaimer

For **authorized** penetration testing, CTF practice, security research, and education **only**. Do not use it against systems you do not own or lack explicit written permission to test. You are responsible for complying with all applicable laws.

## License

MIT © sl4de