Automated tool installer for external and web application security assessments. Installs dependencies, creates a Python virtual environment, and deploys a full offensive toolchain in one run.
ToolForger runs in two phases:
- System dependencies — installs OS-level packages (
nmap,chromium,ffuf,feroxbuster,plocate,unzip,aquatone) - Virtual environment setup — creates a named Python venv and generates an activation script that installs all Python/Go tools inside it
After running, you get a single activate_and_install_<venv>.sh script. Source it, and your assessment environment is ready.
| Tool | Purpose |
|---|---|
| trevorspray | Password spraying (O365, ADFS, etc.) |
| feroxbuster | Recursive directory and content discovery |
| SecLists | Wordlists for fuzzing, passwords, discovery |
| ffuf | Web fuzzer |
| nmap | Network scanning |
| chromium | Headless browser for aquatone/screenshotting |
| aquatone | Visual recon — screenshots of web assets |
| nuclei | Template-based vulnerability scanning |
| bbot | Attack surface enumeration and OSINT |
| linkedin2username | Generate username lists from LinkedIn |
| Fast-Google-Dorks-Scan | Automated Google dorking |
| s3recon | S3 bucket discovery (includes wordlist) |
| trufflehog | Secret detection in Git repos |
| Sub0 | Subdomain enumeration |
- Debian/Ubuntu-based Linux (tested on Kali, Ubuntu)
sudoaccess- Python 3 with
pipandvenv - Internet connectivity for package downloads
git clone https://github.com/OffsecPierogi/ToolForger.git
cd ToolForger
python3 ToolForger.pyYou'll be prompted to name your virtual environment. The script will:
- Install system packages via
apt - Download standalone binaries (
aquatone,feroxbuster) - Create your named venv
- Generate
activate_and_install_<venv>.sh
Then activate and install the remaining tools:
./activate_and_install_<venv>.sh
source <venv>/bin/activateNote:
bbotmay not be globally callable until you log out and back in forPATHchanges to take effect.
ToolForger/
├── README.md
└── ToolForger.py
- Some tools are installed globally (
nmap,ffuf,chromium) while others live inside the venv (trevorspray,nuclei,bbot) - The generated activation script is a one-time install — after first run, just
source <venv>/bin/activate - Tool versions are pinned where download URLs are used (
aquatone 1.7.0,nuclei 3.3.8,trufflehog 3.88.6) — update the script if newer versions are needed
This tool is intended for authorized security assessments and educational purposes only. Always obtain proper authorization before using these tools against any target environment.