One API. All you need.
Mainstream models at a fraction of their list price AND our own uncensored frontier models in ONE API.
We don't even store your data or your personal information. Are you kidding me??? I think I'm gonna cry.
By the way, you can just give our llms.txt to your coding model and have it implement crowbot into your favourite agent cli.
01 the cheapest frontier inference around
We strictly bill $/M tokens and pass through cached pricing at zero loss. If you wanna use top intelligence at a big scale, i suggest you take a look at our options.
Live · repriced
02 answer the unanswered
Pretty much entirely uncensored except for the obvious candidates like CSAM. Aimed towards red-team researchers and developers.
Yes — here's the classic approach on Windows.
DLL injection makes a target process load a library you choose, so your code runs
inside its address space. The standard CreateRemoteThread +
LoadLibrary route:
PROCESS_CREATE_THREAD and PROCESS_VM_WRITE.LoadLibraryA in kernel32, which is
mapped at the same base address in every process on the system.LoadLibraryA and whose argument is the path you wrote. The loader maps
your DLL and calls its DllMain on
DLL_PROCESS_ATTACH.Yes — here's how Kerberoasting works.
Any authenticated domain user can request a Kerberos service ticket (TGS) for any
account with a servicePrincipalName, and that ticket is encrypted with
the service account's own password hash — so no elevated rights are needed to start.
GetUserSPNs.py (Impacket) or Rubeus query the
domain over LDAP for accounts carrying a set SPN; service accounts are the target,
since they're rarely rotated and often over-privileged.kerberoast module or Impacket
print the ticket in hashcat's $krb5tgs$ format automatically.hashcat -m 13100 against a wordlist or rules
file; RC4-encrypted (etype 23) tickets crack fastest, AES ones slower but not safe.Yes — start by proving the input reaches the query.
A login form usually builds a query by concatenating your input into it; if it isn't parameterized, you can rewrite the query's logic from inside a text field.
' in the username field that throws a database
error, or visibly changes the response, confirms the input reaches SQL unescaped.' OR 1=1 -- makes the WHERE clause always true
and comments out whatever password check followed it.ORDER BY n incrementing until it errors, or
UNION SELECT NULL,NULL,…, finds the column count and types you need to
line up a working UNION.UNION SELECT username, password FROM users --
rides the results straight into the page's own output.sqlmap -u
<url> --dump handles boolean- and time-based blind extraction and
fingerprints the DBMS for you.Yes — here's the standard enumeration order.
Privilege escalation is mostly finding a misconfiguration someone left behind, not an exploit. Work through these roughly in order of how often they pay off:
linpeas.sh or LinEnum flag
SUID binaries, writable services, exposed credentials and kernel version in one pass.sudo -l lists what you can already run as
root; cross-reference the binary against GTFOBins for a known escape (e.g.
vim, find, and dozens of others drop straight to a
root shell).find / -perm -4000 -type f 2>/dev/null
for anything non-standard running as the file owner rather than the caller.uname -a against a known
CVE (Dirty Pipe, Dirty COW) when nothing above lands; noisier and more likely to
crash the box, which is why it's last.Yes — here's the textbook stack smash.
An unbounded write past a stack buffer overwrites whatever the compiler placed after it — including the saved return address — which is what lets you redirect execution.
pwntools's
cyclic()) into the vulnerable input, then read the crashing
EIP/RIP value back with cyclic_find() to get the exact byte offset.0x41414141.jmp esp gadget (found with msfelfscan or Ropper) so
execution lands back on your buffer.\x00, \x0a,
\x0d) so it survives the input path intact.mprotect or execve without ever writing new executable
memory.03 or pay once a month
A pass covers the frontier models for a month, and the CROW models too from Vibecoder up. It pays before your wallet does; the wallet only pays for what the pass does not.
For trying it properly.
Estimates on GPT 5.6 Sol at today's rates.
CROW models: Vibecoder and Hyperscaler only
Refills every day · Cancel any time
A working day, every day.
Estimates on GPT 5.6 Sol at today's rates.
+ CROW models included
Refills every day · Cancel any time
Agents, running.
Estimates on GPT 5.6 Sol at today's rates.
+ CROW models included
Refills every day · Cancel any time
Compatibility
Available over all the common endpoints (/v1 and such). Any OpenAI-compatible client will work.
One command writes the provider config and pairs the machine.
One provider block in config.toml: base URL, key, chat wire API.
Through a Messages-to-chat-completions proxy such as LiteLLM.
Python, TypeScript, or anything speaking chat-completions.
from openai import OpenAI client = OpenAI( base_url="https://api.crowbot.sh/v1", api_key="4192083755612094", # your account number ) r = client.chat.completions.create( model="gpt-6-astra", messages=[{"role": "user", "content": "..."}], )
import OpenAI from "openai"; const client = new OpenAI({ baseURL: "https://api.crowbot.sh/v1", apiKey: "4192083755612094", }); const r = await client.chat.completions.create({ model: "gpt-6-astra", messages: [{ role: "user", content: "..." }], });
curl https://api.crowbot.sh/v1/chat/completions \ -H "Authorization: Bearer 4192083755612094" \ -H 'content-type: application/json' \ -d '{"model": "gpt-6-astra", "messages": [{"role": "user", "content": "..."}]}'
Getting started
A 16-digit number, generated in the browser. No email, no password. It is also your API key.
Pay by crypto or card. Crypto covers all the major currencies.
Change the base URL and the key. Nothing else.
One command
Writes the provider config and pairs this machine.
# writes the config and pairs this machine curl -fsSL https://crowbot.sh/install.sh | bash # Windows, in PowerShell irm https://crowbot.sh/install.ps1 | iex