arsenal-ng is a Go-based TUI command launcher that lets authorized pentesters fuzzy-search and prefill nearly 3,000 categorized tool commands directly into the terminal buffer.
| Tool | halilkirazkaya/arsenal-ng — a fast, single-binary Go TUI command launcher with 2,940 commands across 248 tools |
| Category | CLI command launcher / cheatsheet manager |
| Primary Use | Fuzzy-searching a YAML-backed library of nmap, ffuf, gobuster and similar command templates and writing them into the terminal buffer for editing during authorized assessments |
| Safe Use | Productivity tooling for penetration testers working inside explicitly authorized engagements, lab environments, and training platforms; it executes nothing itself |
| Telemetry Note | arsenal-ng makes no network connections and phones nothing home — defenders will not observe it directly; the commands it prefills are ordinary operator-issued invocations visible in shell history and process logs |
Anyone who has spent a season on authorized engagements knows the real bottleneck is rarely the tooling — it is recall. arsenal-ng, a rewrite of the classic Orange-Cyberdefense/arsenal launcher in Go 1.24, attacks exactly that problem: it is a terminal-native, fuzzy-searchable library of 2,940 command templates covering 248 tools, shipped as a single dependency-free binary that opens in milliseconds. The project has gathered over 700 stars, an MIT license, and perhaps most tellingly, a place in Kali Linux's official apt repositories — a strong signal of community vetting for a launcher whose entire value is its curated cheatsheet corpus.
Architecturally, arsenal-ng is deliberately boring in the best way. It is built on Bubble Tea, the charmbracelet TUI framework that has quietly become the standard substrate for Go terminal applications, which explains the snappy navigation, paginated tables, and modal help screens visible throughout the README's GIFs. Cheatsheets live as simple YAML files under internal/loader/cheat-files/, each declaring a tool name, a tags array, and a list of actions with a title, optional desc, and a command template. That file-based approach means the corpus is trivially auditable — you can read every command the launcher will ever suggest before you run anything.
The interaction model is the interesting part. Rather than executing commands itself, arsenal-ng writes the selected template into the terminal input buffer via the TIOCSTI ioctl, leaving the command sitting on your prompt for inspection and editing before you press Enter. That design choice matters from a safety perspective: the tool is a memory aid, not an automation agent, and nothing fires without an explicit human keystroke. It also explains the platform matrix — Linux and macOS are fully supported, Windows works only through WSL, because the prefill mechanism depends on Unix terminal semantics.
The TIOCSTI dependency carries genuine operational nuance worth flagging. Modern Linux kernels (6.2+) disable the ioctl by default precisely because injecting keystrokes into another process's terminal is a technique attackers also use. The README offers two remediation paths and is refreshingly candid about their trade-offs: either re-enable legacy TIOCSTI system-wide via dev.tty.legacy_tiocsti=1 in sysctl, which weakens a kernel hardening control, or grant the binary CAP_SYS_ADMIN with setcap — which the author bluntly notes is virtually equivalent to root. Hardening-minded operators on hardened assessment VMs should weigh whether either is acceptable; on macOS it works out of the box with no configuration at all.
The templating system is where daily workflow value concentrates. Command templates use {{arg}} placeholders for required inputs and {{arg|default}} for pre-filled editable defaults — for example {{port|443}} or {{output|scan.log}}. On top of that sits a session-scoped variable system: typing set ip=10.10.10.10, set domain=corp.local, or set user=administrator in the search box stores key-value pairs that automatically pre-fill any matching placeholder across every cheatsheet. The special commands unset, variables, tools, and help manage the session state, and variables persist until exit — a small feature that eliminates a surprising amount of retyping across a long engagement.
Search is multi-word and fuzzy across tool names, titles, tags, descriptions, and the raw command strings themselves, which means you can find a technique by flag rather than by tool — typing a remembered option surfaces every template that uses it. Results are syntax-highlighted, with commands color-coded for readability and tags rendered in consistent hash-derived colors for fast visual triage. A dedicated tools view paginates the full 248-tool inventory with per-tool command counts, doubling as a coverage map of what the bundled corpus actually addresses: the README's examples lean on nmap, ffuf, and gobuster, consistent with the bugbounty, recon, and red-team tags in the repo topics.
Keyboard ergonomics follow the vim-adjacent conventions operators expect: ↑/↓ or Ctrl+P/Ctrl+N for navigation, PgUp/PgDown for page jumps, ? for a comprehensive help overlay, and Esc/Ctrl+C to bail out. The argument-input view uses Tab and Shift+Tab to move between placeholder fields before Enter commits the rendered command to the terminal. The fact that a ? help screen is treated as a first-class feature — with its own demo GIF — tells you the author has actually sat in the chair and used this under time pressure.
Installation is refreshingly frictionless, with three supported paths. On Kali it is simply sudo apt install arsenal-ng; elsewhere, go install -v github.com/halilkirazkaya/arsenal-ng/cmd/arsenal-ng@latest works with Go 1.24.0+ on the condition that $(go env GOPATH)/bin is on your $PATH. Building from source is a standard git clone followed by make build, producing ./bin/arsenal-ng. An optional alias like alias a='arsenal-ng' in ~/.zshrc or ~/.bashrc reduces the launcher to a single keystroke, which is exactly the invocation cost a recall tool needs to hit zero friction.
Extending the corpus is intentionally low-barrier: drop a new YAML file into internal/loader/cheat-files/, follow the documented schema, rebuild, and submit a PR — the README explicitly frames cheatsheet additions as the easiest contribution path, alongside bug reports and documentation improvements. There is a mild design wrinkle here worth noting: because cheatsheets compile into the binary rather than loading from a user config directory at runtime, personal or client-specific templates require a rebuild or forking the tree. For teams that maintain engagement-specific command sets, that pushes toward maintaining a private fork, which at least keeps the corpus under version control.
It is worth being precise about what arsenal-ng is not: it contains no exploitation logic, no payloads, and no network behavior of its own. Every template is a plain command string a human reviews, edits, and executes manually — the tool's entire attack surface on a system is the TIOCSTI prefill, and its entire telemetry footprint on a network is zero. From a defensive standpoint, you will never detect arsenal-ng itself; what you observe is the ordinary audit trail of an authorized operator's commands in shell history and process accounting. For professionals who want faster recall with a human firmly in the loop, it is a clean, well-scoped addition to the Kali toolchain, and its honest treatment of the TIOCSTI security trade-off is the kind of README candor more tool authors should emulate.
halilkirazkaya/arsenal-ng.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.