Pentesting from a phone with no PC
No PC is required. But "runs on your phone" hides a choice that matters more than it sounds: where the engine — Metasploit, Nmap, Nuclei and the database — actually executes. There are two answers, and picking the wrong one is the most common way people end up disappointed.
Local mode: the engine runs on the phone
The app bundles the whole stack and launches it on the device itself. One install of roughly 2 GB, and after that the phone is self-contained: no server, no network dependency, nothing else to maintain. You are carrying the toolkit, not a remote control for it.
The cost is the phone's own limits. A long Nuclei run or a wide Nmap sweep is bounded by a phone CPU, phone thermals and phone battery, and Android's background-execution rules apply to a scan the same way they apply to anything else. For focused work — a handful of hosts, a specific module, a session you are driving by hand — this is the right mode and the simplest one.
Remote mode: the engine runs on your own Linux box
The same engine runs on a machine you control — a VPS, a lab box, a server — and the phone becomes a thin console driving it over an encrypted gRPC link. The heavy work happens on hardware that is not in your pocket, so scan size and run time stop being a battery question.
The thing to be clear about: the remote agent is your own tool-runner, not the target you are testing. Targets are set separately inside each module. People occasionally read "remote" as "the thing being attacked" and configure it backwards.
The link is not casual: mutual TLS, a bearer token, and an enrollment step that pins the agent on first connection. Several devices can enrol against one agent, each getting its own certificate and token — which is also how a team shares one workspace. Setup is in the guide.
Which to pick
- On site, no infrastructure, focused scope: local. It works with no network beyond the one you are testing.
- Long scans, big ranges, or work that must survive your phone locking: remote.
- Scan types that need privileges you do not have on a stock phone — Nmap SYN and UDP scans, Responder: remote, on a box where you are root. See running without root.
- Several people on one engagement: remote, pointed at a shared agent.
It is a deployment choice, not a paid tier — both modes are available on the free tier, and you can switch between them.
A detail that matters on site
If the phone is on the Wi-Fi you are assessing, you usually do not want the app's own traffic — licence checks, AI calls — riding that same network. Lupus can send its own traffic over mobile data while staying on the audited Wi-Fi for the test itself, so the engagement does not move and your tooling is not visible in the target's logs as a side effect of running.
For lawful, authorized testing only.