Open-Source Licenses

Last updated: 2026

Lupus is built on free and open-source software — the Metasploit Framework, Nmap, Nuclei, Samba, the GNU userland and many others. We are grateful to their authors. This page lists those components and tells you how to obtain their source code.

Getting the source code (written offer)

For any component licensed under the GNU GPL, LGPL or AGPL, you may obtain the complete corresponding source code — including our modifications and the scripts used to build it — for a period of at least three (3) years:

• Online, at no charge, from dl.alpistesec.com/sources/corresponding/ — indexed per component: the upstream release (by SHA-256) plus our patches and the build recipe.
• Or by written request to legal@alpistesec.com.

This offer is valid for anyone who possesses a copy of the software.

What's included

Copyleft components include the GNU userland (bash, coreutils, findutils, grep, sed, tar, gawk, diffutils, make, wget, git, gnupg and more), Samba, Responder, Inetutils, GNU nano, libtalloc, Exploit-DB, tshark/Wireshark, sqlmap, wfuzz and dnsrecon, and Berkeley DB (libdb, AGPL-3.0), among others. The Metasploit Framework is under the permissive BSD-3-Clause license. Many other bundled tools use permissive licenses (MIT, BSD, Apache-2.0) that require attribution only.

Nmap

Nmap is distributed under its own Nmap Public Source License, separate from the GPL. See the license shipped with Nmap for its terms.

On your device

Every component installs its full license text on the device under $PREFIX/share/doc/<component>/copyright. This written offer is also on-device at $PREFIX/share/doc/lupus/OFFER.txt, alongside the full component list in OSS-NOTICES.txt.