Every tool listed below is pre-installed during cloud-init provisioning. No manual installation is needed after deployment.
| Tool | Install Method | Example Command | Used By Suite |
|---|
| nikto | apt | nikto -h https://TARGET -maxtime 120s | web-app-attacks |
| sqlmap | apt | sqlmap --batch -u "https://TARGET/dvwa/vulnerabilities/sqli/?id=1" | web-app-attacks, api-attacks |
| nuclei | ghlatest | nuclei -u https://TARGET -severity medium,high,critical | web-app-attacks |
| dalfox | ghlatest | dalfox url "https://TARGET/search?q=test" --silence | web-app-attacks |
| ffuf | ghlatest | ffuf -u https://TARGET/FUZZ -w wordlist.txt -mc all -fc 404 | api-attacks |
| gobuster | ghlatest | gobuster dir -u https://TARGET -w /opt/SecLists/Discovery/Web-Content/common.txt | reconnaissance |
| feroxbuster | ghlatest | feroxbuster -u https://TARGET -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt | reconnaissance |
| dirb | apt | dirb https://TARGET /usr/share/dirb/wordlists/common.txt | reconnaissance |
| whatweb | apt | whatweb https://TARGET | reconnaissance |
| wfuzz | pip | wfuzz -c -z file,wordlist.txt -e urlencode,double_urlencode "https://TARGET/FUZZ" | waf-encoding-evasion |
| Tool | Install Method | Example Command | Used By Suite |
|---|
| gotestwaf | go install | cd /opt/gotestwaf && gotestwaf --url https://TARGET --noEmailReport --includePayloads=false | waf-encoding-evasion |
| waf-bypass | git clone + pip | waf-bypass --host TARGET:443 --timeout 10 --threads 10 | waf-encoding-evasion |
GoTestWAF (by Wallarm) is an industry-standard WAF assessment framework that multiplies payloads across multiple encoders (URL, Base64, JSUnicode) and placement zones (body, header, URL param, cookie). waf-bypass (by Nemesida) sends payloads with Base64, HTML-ENTITY, and UTF-16 encoding across ARGS, BODY, COOKIE, and HEADER zones.
| Tool | Install Method | Example Command | Used By Suite |
|---|
| nmap | apt | nmap -sV -sC -p 80,443 TARGET_IP | reconnaissance |
| masscan | apt | masscan TARGET_IP -p 1-1000 --rate=1000 | reconnaissance |
| tshark | apt | tshark -i eth0 -c 100 -f "host TARGET_IP" | — |
| hping3 | apt | hping3 -S -p 443 -c 10 TARGET_IP | reconnaissance |
| tcpdump | apt | tcpdump -i eth0 -c 50 host TARGET_IP | — |
| netcat | apt | nc -zv TARGET_IP 80 443 | reconnaissance |
| ngrep | apt | ngrep -q -d eth0 "HTTP" host TARGET_IP | — |
| iperf3 | apt | iperf3 -c TARGET_IP -p 5201 -t 10 | traffic-generation |
| mtr | apt | mtr --report TARGET_IP | reconnaissance |
| Tool | Install Method | Example Command | Used By Suite |
|---|
| sslscan | apt | sslscan TARGET:443 | ssl-scanning |
| sslyze | uv | sslyze TARGET:443 | ssl-scanning |
| testssl.sh | git clone | /opt/testssl.sh/testssl.sh TARGET:443 | ssl-scanning |
| Tool | Install Method | Example Command | Used By Suite |
|---|
| mitmproxy | uv | mitmproxy --mode reverse:https://TARGET -p 8080 | — |
| socat | apt | socat TCP-LISTEN:8080,fork TCP:TARGET:443 | — |
| Tool | Install Method | Example Command | Used By Suite |
|---|
| playwright | npm + uv | playwright open https://TARGET | bot-simulation, javascript-exploits |
| puppeteer | npm | node -e "const b=await require('puppeteer').launch(); ..." | bot-simulation |
| puppeteer-extra-plugin-stealth | npm | Used as Puppeteer plugin for stealth browsing | bot-simulation |
Playwright installs its own Chromium binary via playwright install chromium. Puppeteer uses the same system Chromium where possible.
| Tool | Install Method | Example Command | Used By Suite |
|---|
| subfinder | ghlatest | subfinder -d example.com -silent | reconnaissance |
| httpx | ghlatest | `echo TARGET | httpx -status-code -title` |
| amass | ghlatest | amass enum -passive -d example.com | reconnaissance |
| dnsrecon | uv | dnsrecon -d example.com -t std | reconnaissance |
| fierce | uv | fierce --domain example.com | reconnaissance |
| whois | apt | whois example.com | reconnaissance |
| dnsutils (dig, nslookup) | apt | dig TARGET +short | reconnaissance |
| Tool | Install Method | Example Command | Used By Suite |
|---|
| hydra | apt | hydra -l admin -P /opt/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt TARGET https-post-form "/dvwa/login.php:..." | web-app-attacks |
| medusa | apt | medusa -h TARGET -u admin -P passwords.txt -M http | web-app-attacks |
| ncrack | apt | ncrack -vv --user admin -P passwords.txt TARGET:443 | web-app-attacks |
| Tool | Install Method | Example Command | Used By Suite |
|---|
| scapy | pip | python3 -c "from scapy.all import *; sr1(IP(dst='TARGET')/TCP(dport=443,flags='S'))" | reconnaissance |
| impacket | pip | python3 -m impacket.smbclient TARGET | reconnaissance |
| arjun | pip | arjun -u https://TARGET/endpoint | api-attacks |
| pwntools | pip | python3 -c "from pwn import *; r=remote('TARGET',443)" | — |
| hashid | pip | hashid 'HASH_VALUE' | — |
| theHarvester | uv | theHarvester -d example.com -b all | reconnaissance |
| Tool | Install Method | Location | Used By Suite |
|---|
| recon-ng | git clone | /opt/recon-ng/ | reconnaissance |
| spiderfoot | git clone | /opt/spiderfoot/ | reconnaissance |
| SecLists | git clone | /opt/SecLists/ | web-app-attacks, api-attacks, reconnaissance |
| PayloadsAllTheThings | git clone | /opt/PayloadsAllTheThings/ | waf-encoding-evasion |
| waf-bypass payloads | git clone | /opt/waf-bypass/ | waf-encoding-evasion |
SecLists provides wordlists used by multiple tools including ffuf, gobuster, feroxbuster, dirb, and hydra. PayloadsAllTheThings provides curated multi-encoding attack payloads organized by attack class (XSS, SQLi, XXE) with hex, octal, Unicode, HTML entity, double URL encoding, and JSFuck variants.
These tools are only installed when tool_tier = "full":
| Tool | Install Method | Example Command | Used By Suite |
|---|
| ZAP (OWASP Zed Attack Proxy) | ghlatest | zap-cli quick-scan -s all -r https://TARGET | web-app-attacks |
| Metasploit Framework | installer script | msfconsole -q -x "use auxiliary/scanner/http/http_version; set RHOSTS TARGET; run; exit" | reconnaissance |
| Method | Description |
|---|
| apt | Installed from Ubuntu 24.04 APT repositories via apt-get install |
| ghlatest | Latest binary downloaded from GitHub Releases using ghlatest.sh and install-release.sh |
| uv | Installed as a Python tool using the uv package manager |
| pip | Installed as a Python package using pip install into the system Python |
| npm | Installed as a global Node.js package using npm install -g |
| go install | Compiled from source using go install and installed to /usr/local/bin |
| git clone | Repository cloned to /opt/ directory |
| git clone + pip | Repository cloned and Python dependencies installed |
| installer script | Vendor-provided installer script executed during cloud-init |
