pentest toolkit

CTF · labs · engagements

Four tools that fit together: run the enum, work out what to do with what it finds, look up any command, and keep the syntax off your shoulders — plus the two build scripts that keep the generated pages current. Built for CTF boxes, lab machines and authorised engagements — and it flags the techniques that certification exams put out of bounds. Everything runs offline in the browser or the shell, no data leaves the machine.

Box playbook

playbook.html

The command centre. Switchable tracks (recon, web, Linux, Windows, AD, AD certs & delegation, pivoting, container escape, buffer overflow, passwords, AV evasion), a scan planner that reads pasted or dropped nmap output and lists per-service commands, a reverse-shell generator, a hash identifier, an exploit suggester, a proof checklist, per-box credentials, notes and an attempt log, a block-based findings editor, evidence capture with screenshots, and a write-up generator (markdown, HTML and print/PDF) in lab or exam shape. Set your IP once and every command fills in. Press / or Ctrl-K to search everything.

Arsenal reference

arsenal.html

Over a thousand commands from the Orange Cyberdefense arsenal, searchable and colour-coded by engagement phase. Fills in the same target variables as the playbook, and the playbook deep-links into it pre-filtered.

Cheat sheet

cheatsheet.html

The quick reference, grouped by port and by phase, laid out to print on a couple of pages. The markdown source is cheatsheet.md if you would rather read it in your notes app.

shell

Enum runner

enum.sh

First-pass enumeration script. Scans, then fires the right per-service tools, printing and logging every command so it doubles as syntax practice. Its scan file drops straight into the playbook’s planner. ./enum.sh <ip>

Arsenal refresh

build-arsenal.sh

Rebuilds the arsenal reference from a pinned upstream commit, so the page is reproducible. ./build-arsenal.sh --latest moves the pin forward.

Authorised testing only — systems you own, a lab you are registered with, or an engagement with a signed scope.
Some entries (sqlmap, automated exploitation, Metasploit beyond the permitted box) are out of bounds on certification exams such as the OSCP; the tools flag these where relevant.
Your work is saved in this browser only. Clearing site data deletes it — use export box in the playbook to keep a copy.