Skip to content

README.md

Latest commit

 

History

History
95 lines (65 loc) · 2.89 KB

README.md

File metadata and controls

95 lines (65 loc) · 2.89 KB
Raw

ToolForger

Automated tool installer for external and web application security assessments. Installs dependencies, creates a Python virtual environment, and deploys a full offensive toolchain in one run.

What It Does

ToolForger runs in two phases:

  1. System dependencies — installs OS-level packages (nmap, chromium, ffuf, feroxbuster, plocate, unzip, aquatone)
  2. Virtual environment setup — creates a named Python venv and generates an activation script that installs all Python/Go tools inside it

After running, you get a single activate_and_install_<venv>.sh script. Source it, and your assessment environment is ready.

Installed Tools

Tool Purpose
trevorspray Password spraying (O365, ADFS, etc.)
feroxbuster Recursive directory and content discovery
SecLists Wordlists for fuzzing, passwords, discovery
ffuf Web fuzzer
nmap Network scanning
chromium Headless browser for aquatone/screenshotting
aquatone Visual recon — screenshots of web assets
nuclei Template-based vulnerability scanning
bbot Attack surface enumeration and OSINT
linkedin2username Generate username lists from LinkedIn
Fast-Google-Dorks-Scan Automated Google dorking
s3recon S3 bucket discovery (includes wordlist)
trufflehog Secret detection in Git repos
Sub0 Subdomain enumeration

Prerequisites

  • Debian/Ubuntu-based Linux (tested on Kali, Ubuntu)
  • sudo access
  • Python 3 with pip and venv
  • Internet connectivity for package downloads

Usage

git clone https://github.com/OffsecPierogi/ToolForger.git
cd ToolForger

python3 ToolForger.py

You'll be prompted to name your virtual environment. The script will:

  1. Install system packages via apt
  2. Download standalone binaries (aquatone, feroxbuster)
  3. Create your named venv
  4. Generate activate_and_install_<venv>.sh

Then activate and install the remaining tools:

./activate_and_install_<venv>.sh
source <venv>/bin/activate

Note: bbot may not be globally callable until you log out and back in for PATH changes to take effect.

File Structure

ToolForger/
├── README.md
└── ToolForger.py

Notes

  • Some tools are installed globally (nmap, ffuf, chromium) while others live inside the venv (trevorspray, nuclei, bbot)
  • The generated activation script is a one-time install — after first run, just source <venv>/bin/activate
  • Tool versions are pinned where download URLs are used (aquatone 1.7.0, nuclei 3.3.8, trufflehog 3.88.6) — update the script if newer versions are needed

Disclaimer

This tool is intended for authorized security assessments and educational purposes only. Always obtain proper authorization before using these tools against any target environment.