orange-cyberdefense/arsenal

Arsenal is a command-line tool built by and for security professionals who do penetration testing, which is the practice of legally testing computer systems for vulnerabilities. Penetration testing involves running many specialized tools, each with its own flags and options that are difficult to memorize. Arsenal acts as a searchable catalog and launcher for those commands so testers can find the right command, fill in their specific details, and send it directly to their terminal. The core mechanic is a fuzzy search interface where you type part of a tool name or category and Arsenal shows matching commands. When you select one, it is typed into your terminal as if you had typed it yourself, which means it works with any shell and the command appears in your shell history. You can also set global variables inside Arsenal so that repeated values, like a target IP address, are automatically filled in across any command that uses that value. Arsenal includes a library of cheatsheets covering a wide range of security tools, organized by category. These include tools for scanning networks, testing web applications, cracking passwords, exploiting database services, and working with Windows Active Directory environments. The cheatsheets are written in Markdown or reStructuredText, and you can add your own by placing files in a designated folder. The project also includes visual mindmaps for common Active Directory attack paths and Exchange server testing. The tool supports running inside tmux, a terminal multiplexer. In tmux mode, Arsenal can split your terminal window and send the selected command directly to a second pane, so you do not have to leave the Arsenal interface to run a command. Installation is available through pip, the Python package manager, or manually by cloning the repository. Arch Linux users can also install it from the AUR package repository. The project is written in Python and was created by Guillaume Muh and mayfly at Orange Cyberdefense.