souleyez 2.23.0__tar.gz → 2.31.0__tar.gz

{souleyez-2.23.0 → souleyez-2.31.0}/BETA_README.md

@@ -1,5 +1,11 @@
 # SoulEyez Beta Program
 
+[![CI](https://github.com/cyber-soul-security/souleyez/actions/workflows/python-ci.yml/badge.svg)](https://github.com/cyber-soul-security/souleyez/actions/workflows/python-ci.yml)
+[![codecov](https://codecov.io/gh/cyber-soul-security/souleyez/branch/main/graph/badge.svg)](https://codecov.io/gh/cyber-soul-security/souleyez)
+[![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
+[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+[![Security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
+
 Welcome to the SoulEyez beta! Thank you for helping us test and improve this penetration testing management platform.
 
 ---
@@ -21,7 +27,7 @@ Welcome to the SoulEyez beta! Thank you for helping us test and improve this pen
 
 > ⚠️ **Important**: Only use SoulEyez on systems you have explicit authorization to test.
 
-## Version: 2.23.0
+## Version: 2.31.0
 
 ### What's Included
 
@@ -59,6 +65,17 @@ Welcome to the SoulEyez beta! Thank you for helping us test and improve this pen
 - **Python**: 3.8 or newer
 - **Storage**: ~500MB for SoulEyez + tools
 
+> **🐉 Kali Linux Recommended**
+>
+> SoulEyez performs significantly better on **Kali Linux** than other distributions:
+> - All pentesting tools pre-installed and optimized
+> - Metasploit database and RPC already configured
+> - Security-focused kernel and networking stack
+> - No dependency hunting or version conflicts
+> - Wordlists, databases, and tool configs ready to go
+>
+> While Ubuntu and other Debian-based distros are supported, you may experience slower setup times and occasional tool compatibility issues.
+
 ### Known Issues
 
 - Very large scan outputs (>10MB) may slow the interface
@@ -248,4 +265,4 @@ Happy hacking! 🛡️
 
 ---
 
-**Version**: 2.23.0 | **Release Date**: January 2026 | **Maintainer**: CyberSoul Security
+**Version**: 2.31.0 | **Release Date**: January 2026 | **Maintainer**: CyberSoul Security

{souleyez-2.23.0/souleyez.egg-info → souleyez-2.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: souleyez
-Version: 2.23.0
+Version: 2.31.0
 Summary: AI-Powered Penetration Testing Platform with 40+ integrated tools
 Author-email: CyberSoul Security <contact@cybersoulsecurity.com>
 Maintainer-email: CyberSoul Security <contact@cybersoulsecurity.com>
@@ -51,6 +51,12 @@ Dynamic: license-file
 
 # SoulEyez Beta Program
 
+[![CI](https://github.com/cyber-soul-security/souleyez/actions/workflows/python-ci.yml/badge.svg)](https://github.com/cyber-soul-security/souleyez/actions/workflows/python-ci.yml)
+[![codecov](https://codecov.io/gh/cyber-soul-security/souleyez/branch/main/graph/badge.svg)](https://codecov.io/gh/cyber-soul-security/souleyez)
+[![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
+[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+[![Security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
+
 Welcome to the SoulEyez beta! Thank you for helping us test and improve this penetration testing management platform.
 
 ---
@@ -72,7 +78,7 @@ Welcome to the SoulEyez beta! Thank you for helping us test and improve this pen
 
 > ⚠️ **Important**: Only use SoulEyez on systems you have explicit authorization to test.
 
-## Version: 2.23.0
+## Version: 2.31.0
 
 ### What's Included
 
@@ -110,6 +116,17 @@ Welcome to the SoulEyez beta! Thank you for helping us test and improve this pen
 - **Python**: 3.8 or newer
 - **Storage**: ~500MB for SoulEyez + tools
 
+> **🐉 Kali Linux Recommended**
+>
+> SoulEyez performs significantly better on **Kali Linux** than other distributions:
+> - All pentesting tools pre-installed and optimized
+> - Metasploit database and RPC already configured
+> - Security-focused kernel and networking stack
+> - No dependency hunting or version conflicts
+> - Wordlists, databases, and tool configs ready to go
+>
+> While Ubuntu and other Debian-based distros are supported, you may experience slower setup times and occasional tool compatibility issues.
+
 ### Known Issues
 
 - Very large scan outputs (>10MB) may slow the interface
@@ -299,4 +316,4 @@ Happy hacking! 🛡️
 
 ---
 
-**Version**: 2.23.0 | **Release Date**: January 2026 | **Maintainer**: CyberSoul Security
+**Version**: 2.31.0 | **Release Date**: January 2026 | **Maintainer**: CyberSoul Security

{souleyez-2.23.0 → souleyez-2.31.0}/README.md

@@ -1,5 +1,11 @@
 # SoulEyez — AI-Powered Penetration Testing Platform
 
+[![CI](https://github.com/cyber-soul-security/souleyez/actions/workflows/python-ci.yml/badge.svg)](https://github.com/cyber-soul-security/souleyez/actions/workflows/python-ci.yml)
+[![codecov](https://codecov.io/gh/cyber-soul-security/souleyez/branch/main/graph/badge.svg)](https://codecov.io/gh/cyber-soul-security/souleyez)
+[![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/)
+[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+[![Security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
+
 **LEGAL NOTICE — Use Responsibly**
 Only use SoulEyez on systems you own or have explicit written permission to test.
 Unauthorized scanning or exploitation is illegal. The authors are not responsible for misuse.

{souleyez-2.23.0 → souleyez-2.31.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "souleyez"
-version = "2.23.0"
+version = "2.31.0"
 description = "AI-Powered Penetration Testing Platform with 40+ integrated tools"
 readme = "BETA_README.md"
 license = {text = "MIT"}
@@ -71,7 +71,7 @@ include = ["souleyez*"]
 exclude = ["tests*", "scripts*", "reports*", "venv*", "debian*"]
 
 [tool.setuptools.package-data]
-souleyez = ["docs/**/*.md", "data/wordlists/*.txt", "data/wordlists/*.md", "data/templates/*.json", "data/templates/*.md"]
+souleyez = ["docs/**/*.md", "data/wordlists/*.txt", "data/wordlists/*.md", "data/templates/*.json", "data/templates/*.md", "assets/*.png"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

souleyez-2.31.0/souleyez/__init__.py

@@ -0,0 +1 @@
+__version__ = '2.31.0'

souleyez-2.31.0/souleyez/assets/__init__.py

@@ -0,0 +1 @@
+# SoulEyez assets package

{souleyez-2.23.0 → souleyez-2.31.0}/souleyez/core/msf_sync_manager.py

@@ -29,15 +29,25 @@ logger = logging.getLogger(__name__)
 
 def get_msf_database_config() -> Optional[Dict[str, Any]]:
     """
-    Get MSF database configuration from ~/.msf4/database.yml
+    Get MSF database configuration from ~/.msf4/database.yml or system-wide config.
+
+    Checks user config first, then falls back to system-wide config (Kali Linux).
 
     Returns:
         Dictionary with database config or None if not found/parseable
     """
-    db_yml_path = Path.home() / ".msf4" / "database.yml"
-
-    if not db_yml_path.exists():
-        logger.debug(f"MSF database.yml not found at {db_yml_path}")
+    # Check user config first, then system-wide config (Kali uses system-wide)
+    user_db_path = Path.home() / ".msf4" / "database.yml"
+    system_db_path = Path('/usr/share/metasploit-framework/config/database.yml')
+
+    db_yml_path = None
+    if user_db_path.exists():
+        db_yml_path = user_db_path
+    elif system_db_path.exists():
+        db_yml_path = system_db_path
+
+    if not db_yml_path:
+        logger.debug("MSF database.yml not found in user or system config")
         return None
 
     try:

{souleyez-2.23.0 → souleyez-2.31.0}/souleyez/core/tool_chaining.py

@@ -15,6 +15,17 @@ CATEGORY_CTF = "ctf"           # Lab/learning scenarios - vulnerable by design
 CATEGORY_ENTERPRISE = "enterprise"  # Real-world enterprise testing
 CATEGORY_GENERAL = "general"   # Standard recon that applies everywhere
 
+# Managed hosting platforms - skip CGI enumeration (pointless on these)
+# These are detected from server headers/banners and product names
+MANAGED_HOSTING_PLATFORMS = {
+    'squarespace', 'wix', 'shopify', 'webflow', 'weebly',
+    'wordpress.com', 'ghost.io', 'medium', 'tumblr', 'blogger',
+    'netlify', 'vercel', 'github.io', 'pages.dev', 'cloudflare',
+    'heroku', 'railway', 'render.com', 'fly.io',
+    'aws cloudfront', 'akamai', 'fastly', 'cloudflare',
+    'azure', 'google cloud', 'firebase',
+}
+
 # Category display icons
 CATEGORY_ICONS = {
     CATEGORY_CTF: "🎯",
@@ -140,6 +151,75 @@ def classify_os_device(os_string: str, services: list) -> dict:
     return {'os_family': 'unknown', 'device_type': 'unknown', 'vendor': None}
 
 
+def is_managed_hosting(services: List[Dict[str, Any]], http_fingerprint: Dict[str, Any] = None) -> bool:
+    """
+    Detect if target is a managed hosting platform.
+
+    These platforms don't have CGI directories, so tools like nikto
+    should skip CGI enumeration to avoid long, pointless scans.
+
+    Args:
+        services: List of service dicts from nmap parser
+        http_fingerprint: Optional fingerprint data from http_fingerprint plugin
+
+    Returns:
+        True if managed hosting detected, False otherwise
+    """
+    # Check fingerprint data first (most reliable, comes from actual HTTP headers)
+    if http_fingerprint:
+        managed = http_fingerprint.get('managed_hosting')
+        if managed:
+            return True
+
+    # Fall back to checking services data (less reliable, from nmap banners)
+    for service in services:
+        # Check product field
+        product = (service.get('product') or '').lower()
+        raw_version = (service.get('raw_version') or '').lower()
+        service_name = (service.get('service') or '').lower()
+
+        # Combine all fields for matching
+        combined = f"{product} {raw_version} {service_name}"
+
+        # Check against known managed hosting platforms
+        for platform in MANAGED_HOSTING_PLATFORMS:
+            if platform in combined:
+                return True
+
+    return False
+
+
+def get_managed_hosting_platform(services: List[Dict[str, Any]], http_fingerprint: Dict[str, Any] = None) -> Optional[str]:
+    """
+    Get the name of the managed hosting platform if detected.
+
+    Args:
+        services: List of service dicts from nmap parser
+        http_fingerprint: Optional fingerprint data from http_fingerprint plugin
+
+    Returns:
+        Platform name or None
+    """
+    # Check fingerprint data first
+    if http_fingerprint:
+        managed = http_fingerprint.get('managed_hosting')
+        if managed:
+            return managed
+
+    # Fall back to services check
+    for service in services:
+        product = (service.get('product') or '').lower()
+        raw_version = (service.get('raw_version') or '').lower()
+        service_name = (service.get('service') or '').lower()
+        combined = f"{product} {raw_version} {service_name}"
+
+        for platform in MANAGED_HOSTING_PLATFORMS:
+            if platform in combined:
+                return platform.title()
+
+    return None
+
+
 # Technology to Nuclei tags mapping
 # Maps detected products/technologies to relevant nuclei template tags
 TECH_TO_NUCLEI_TAGS = {
@@ -511,6 +591,23 @@ class ChainRule:
                     if svc_port in group.get('ports', []):
                         port = str(svc_port)
                         break
+        elif 'has:services' in self.trigger_condition:
+            # For has:services condition, extract port from the services array
+            # Prioritize HTTP services for web tools (gobuster, nuclei, etc.)
+            services = context.get('services', [])
+            http_ports = {80, 443, 8080, 8443, 8000, 8888, 3000, 5000}
+
+            # First pass: look for HTTP service by name or common HTTP ports
+            for svc in services:
+                svc_name = svc.get('service_name', '').lower()
+                svc_port = svc.get('port')
+                if svc_name == 'http' or svc_name == 'https' or svc_port in http_ports:
+                    port = str(svc_port)
+                    break
+
+            # Second pass: if no HTTP service, use the first service's port
+            if not port and services:
+                port = str(services[0].get('port', ''))
 
         # Calculate subnet for {subnet} placeholder (e.g., 10.0.0.88 → 10.0.0.0/24)
         subnet = ''
@@ -575,6 +672,25 @@ class ChainRule:
                 new_args.append(arg)
             args = new_args
 
+        # For Nikto: Skip CGI enumeration on managed hosting platforms
+        # This prevents long, pointless scans on Squarespace, Wix, etc.
+        if self.target_tool == 'nikto':
+            services = context.get('services', [])
+            http_fingerprint = context.get('http_fingerprint', {})
+            if is_managed_hosting(services, http_fingerprint):
+                # Add -C none to skip CGI dirs (pointless on managed hosting)
+                if '-C' not in str(args):
+                    args.extend(['-C', 'none'])
+                # Add -Tuning x6 to skip remote file inclusion tests
+                if '-Tuning' not in str(args):
+                    args.extend(['-Tuning', 'x6'])
+                # Log which platform was detected
+                platform = get_managed_hosting_platform(services, http_fingerprint)
+                if platform:
+                    from souleyez.log_config import get_logger
+                    logger = get_logger(__name__)
+                    logger.info(f"[FINGERPRINT] Managed hosting detected ({platform}) - nikto using optimized scan config")
+
         # For SQLMap with POST injections, add --data if we have POST data
         if self.target_tool == 'sqlmap' and post_data and '--data' not in str(args):
             # Insert --data after -u argument
@@ -642,32 +758,42 @@ class ToolChaining:
 
         # Web service discovered → run web scanners
         self.rules.extend([
-            # Modern vulnerability scanner (Nuclei) - PRIORITY
-            # Uses {nuclei_tags} placeholder to auto-detect tech and run relevant templates
+            # HTTP Fingerprinting - runs FIRST to detect WAF/CDN/managed hosting
+            # This enables smarter tool configuration for downstream scanners
             ChainRule(
                 trigger_tool='nmap',
                 trigger_condition='service:http',
+                target_tool='http_fingerprint',
+                priority=11,  # Highest priority - runs before all other web tools
+                args_template=[],
+                description='Web server detected, fingerprinting for WAF/CDN/platform detection'
+            ),
+            # Nikto triggered by http_fingerprint (uses fingerprint data for smart config)
+            ChainRule(
+                trigger_tool='http_fingerprint',
+                trigger_condition='has:services',
+                target_tool='nikto',
+                priority=8,
+                args_template=['-nointeractive', '-timeout', '10'],
+                description='Fingerprinting complete, scanning for server misconfigurations with Nikto'
+            ),
+            # Nuclei triggered by http_fingerprint
+            ChainRule(
+                trigger_tool='http_fingerprint',
+                trigger_condition='has:services',
                 target_tool='nuclei',
                 priority=9,
                 args_template=['-tags', '{nuclei_tags}', '-severity', 'critical,high', '-rate-limit', '50', '-c', '10', '-timeout', '10'],
-                description='Web server detected (HTTP/HTTPS), scanning with Nuclei'
+                description='Fingerprinting complete, scanning with Nuclei'
             ),
+            # Gobuster triggered by http_fingerprint
             ChainRule(
-                trigger_tool='nmap',
-                trigger_condition='service:http',
+                trigger_tool='http_fingerprint',
+                trigger_condition='has:services',
                 target_tool='gobuster',
                 priority=7,
                 args_template=['dir', '-u', 'http://{target}:{port}', '-w', 'data/wordlists/web_dirs_common.txt', '-x', 'js,json,php,asp,aspx,html,txt,bak,old,zip', '--no-error', '--timeout', '30s', '-t', '5', '--delay', '20ms'],
-                description='Web server detected (HTTP/HTTPS), discovering directories and files'
-            ),
-            # Nikto - web server vulnerability scanner (complements nuclei)
-            ChainRule(
-                trigger_tool='nmap',
-                trigger_condition='service:http',
-                target_tool='nikto',
-                priority=8,
-                args_template=['-nointeractive', '-timeout', '10'],
-                description='Web server detected, scanning for server misconfigurations with Nikto'
+                description='Fingerprinting complete, discovering directories and files'
             ),
             # Dalfox - XSS scanner triggered after gobuster finds pages
             ChainRule(
@@ -746,17 +872,8 @@ class ToolChaining:
                 args_template=['-a', '{target}'],
                 description='SMB service detected, enumerating shares and users (runs after CrackMapExec)'
             ),
-            # DISABLED: smbmap has upstream pickling bug with impacket (affects all versions)
-            # Use crackmapexec/netexec --shares instead (rule #10 above)
-            ChainRule(
-                trigger_tool='nmap',
-                trigger_condition='service:smb',
-                target_tool='smbmap',
-                priority=7,
-                enabled=False,  # Disabled due to impacket pickling bug
-                args_template=['-H', '{target}'],
-                description='SMB service detected, mapping shares (DISABLED - use netexec)'
-            ),
+            # NOTE: smbmap removed - has upstream impacket pickling bug on Python 3.13+
+            # Use crackmapexec/netexec --shares instead (enum4linux rule above)
         ])
 
         # Active Directory attacks - smart chaining workflow
@@ -1642,6 +1759,20 @@ class ToolChaining:
             )
         )
 
+        # Database Admin → SQLMap (gentler settings for phpMyAdmin/Adminer)
+        # These panels are slow and easily overwhelmed - use single thread and basic tests
+        self.rules.append(
+            ChainRule(
+                trigger_tool='gobuster',
+                trigger_condition='category:database_admin',
+                target_tool='sqlmap',
+                priority=6,  # Lower priority than CVE/exploit scans
+                args_template=['-u', '{target}', '--batch', '--forms', '--threads=1', '--time-sec=10',
+                              '--level=1', '--risk=1', '--technique=BEU', '--timeout=30'],
+                description='Database admin panel detected, testing login form for SQL injection (low intensity)'
+            )
+        )
+
         # WordPress → WPScan enumeration
         self.rules.append(
             ChainRule(
@@ -4900,6 +5031,7 @@ class ToolChaining:
                     label=f"Auto-retry: gobuster (wildcard {exclude_length}b)",
                     engagement_id=engagement_id,
                     parent_id=job.get('id'),
+                    reason=f"Auto-triggered by gobuster: Wildcard response detected, retrying with --exclude-length {exclude_length}",
                     metadata={'retry_attempt': 1, 'retry_parent_job_id': job.get('id')}
                 )
 
@@ -4999,7 +5131,8 @@ class ToolChaining:
                                 args=sqlmap_args,
                                 label=f"Auto-chain: SQLMap testing {endpoint_url}",
                                 engagement_id=engagement_id,
-                                parent_id=job.get('id')
+                                parent_id=job.get('id'),
+                                reason=f"Auto-triggered by ffuf: Database/dynamic endpoint detected ({status_code} response)"
                             )
 
                             job_ids.append(sqlmap_job_id)
@@ -5027,6 +5160,7 @@ class ToolChaining:
                                 label=f"Auto-chain: ffuf recursive {endpoint_url}",
                                 engagement_id=engagement_id,
                                 parent_id=job.get('id'),
+                                reason=f"Auto-triggered by ffuf: {status_code} response suggests deeper path, fuzzing recursively",
                                 metadata={'ffuf_depth': current_depth + 1}
                             )
 
@@ -5250,7 +5384,8 @@ class ToolChaining:
                         args=['-m', '18200', '-a', '0', 'data/wordlists/top100.txt'],
                         label='CRACK_ASREP',
                         engagement_id=engagement_id,
-                        parent_id=job.get('id')
+                        parent_id=job.get('id'),
+                        reason="Auto-triggered by impacket-getnpusers: AS-REP hash extracted, attempting to crack"
                     )
 
                     job_ids.append(job_id)
@@ -5295,7 +5430,8 @@ class ToolChaining:
                         args=['-m', '1000', '-a', '0', 'data/wordlists/top100.txt'],
                         label='CRACK_NTLM',
                         engagement_id=engagement_id,
-                        parent_id=job.get('id')
+                        parent_id=job.get('id'),
+                        reason="Auto-triggered by impacket-secretsdump: NTLM hash extracted, attempting to crack"
                     )
 
                     job_ids.append(job_id)
@@ -5335,7 +5471,8 @@ class ToolChaining:
                             args=[cred_str],
                             label='EXTRACT_CREDS',
                             engagement_id=engagement_id,
-                            parent_id=job.get('id')
+                            parent_id=job.get('id'),
+                            reason="Auto-triggered by hydra: Valid credentials found, attempting to extract domain secrets"
                         )
 
                         job_ids.append(job_id)
@@ -5727,18 +5864,25 @@ class ToolChaining:
                             # Auto mode: enqueue immediately
                             print(f"  🔗 Chaining {cmd['tool']} for {cmd_target}: {cmd['reason']}")
                             # enqueue_job will acquire _lock again (nested lock is safe - same thread)
-                            job_id = enqueue_job(
-                                tool=cmd['tool'],
-                                target=cmd_target,
-                                args=resolved_args,
-                                label=source_tool,
-                                engagement_id=engagement_id,
-                                parent_id=parent_job_id,
-                                reason=cmd.get('reason', f"Auto-chain from {source_tool}"),
-                                metadata=cmd.get('metadata'),  # Pass through deduplication metadata
-                                rule_id=cmd.get('rule_id')  # Pass rule ID for tracking
-                            )
-                            job_ids.append(job_id)
+                            try:
+                                job_id = enqueue_job(
+                                    tool=cmd['tool'],
+                                    target=cmd_target,
+                                    args=resolved_args,
+                                    label=source_tool,
+                                    engagement_id=engagement_id,
+                                    parent_id=parent_job_id,
+                                    reason=cmd.get('reason', f"Auto-chain from {source_tool}"),
+                                    metadata=cmd.get('metadata'),  # Pass through deduplication metadata
+                                    rule_id=cmd.get('rule_id')  # Pass rule ID for tracking
+                                )
+                                job_ids.append(job_id)
+                            except Exception as scope_err:
+                                # Handle scope violations gracefully - skip out-of-scope targets
+                                if 'ScopeViolationError' in type(scope_err).__name__ or 'out of scope' in str(scope_err).lower():
+                                    print(f"  ⚠️  Skipped (out of scope): {cmd_target}")
+                                else:
+                                    raise  # Re-raise unexpected errors
 
                 # Lock released here - next iteration gets fresh lock
 

{souleyez-2.23.0 → souleyez-2.31.0}/souleyez/docs/README.md

@@ -1,7 +1,7 @@
 # SoulEyez Documentation
 
-**Version:** 2.23.0
-**Last Updated:** January 7, 2026
+**Version:** 2.31.0
+**Last Updated:** January 9, 2026
 **Organization:** CyberSoul Security
 
 Welcome to the SoulEyez documentation! This documentation covers architecture, development, user guides, and operational information for the SoulEyez penetration testing platform.

{souleyez-2.23.0 → souleyez-2.31.0}/souleyez/docs/user-guide/configuration.md

@@ -748,4 +748,4 @@ rm ~/.souleyez/config.json && souleyez --version
 
 ---
 
-**Last Updated:** 2026-01-04 | **Version:** 2.6.0
+**Last Updated:** 2026-01-09 | **Version:** 2.27.1

{souleyez-2.23.0 → souleyez-2.31.0}/souleyez/docs/user-guide/installation.md

@@ -22,6 +22,17 @@ This guide walks you through installing souleyez on your system. The process tak
 - **RAM Usage**: Running multiple heavy tools (Metasploit, SQLMap, Hashcat) simultaneously requires additional RAM
 - **Disk I/O**: SSD recommended for database operations and log processing
 
+> **🐉 Kali Linux Recommended**
+>
+> SoulEyez performs significantly better on **Kali Linux** than other distributions:
+> - All pentesting tools pre-installed and optimized
+> - Metasploit database and RPC already configured
+> - Security-focused kernel and networking stack
+> - No dependency hunting or version conflicts
+> - Wordlists, databases, and tool configs ready to go
+>
+> While Ubuntu and other Debian-based distros are supported, you may experience slower setup times and occasional tool compatibility issues.
+
 ### Software Requirements
 
 - **Operating System**: Linux (Kali Linux recommended, any Debian-based distro supported)