Black omARCHy pentest
Operator and agent work together. The agent proposes; the operator
approves; the agent runs one phase, reports, then waits.
Read references/tools.md for the host tool map. Read the
black-omarchy skill for CLI, updates, and Omarchy invariants.
Authorization gate (once per engagement)
Do not scan, scrape, or authenticate against a target until the
operator has given all of:
- Written authorization (engagement, bug bounty in-scope asset, or
lab/CTF they own)
- Scope (hosts, CIDRs, domains, explicit exclusions)
- Depth (recon-only, credentialed, or in-scope exploitation with
installed tools)
- Rules of engagement (rate limits, production windows, data handling)
If any item is missing, ask only for the missing item. Record the
answers in notes/scope.md (create notes/ in the engagement cwd).
Refuse out-of-scope targets, third-party systems named in passing, and
"just try this IP" with no authorization.
Operating mode
Collaborative / semi-autonomous, not fire-and-forget.
- Restate scope and the next phase in one short plan.
- Wait for an explicit go (
go, approved, run it).
- Run only that phase with tools that exist (
command -v).
- Write evidence under
notes/ (commands, truncated output, findings).
- Stop and summarize. Propose the next phase. Do not chain into
exploitation because recon found a port.
High-risk actions always need a fresh go: credential spraying, default
password tests, exploitation modules, wireless injection, anything that
changes target state.
Phases
| Phase |
Default tools on this host |
Profile if missing |
| Recon / OSINT |
theharvester, whatweb, whois, enum4linux-ng |
recon |
| Network discovery |
nmap, masscan, traceroute |
core / network |
| Web |
nikto, sqlmap, gobuster, ffuf, whatweb |
web |
| Auth / hashes |
hashcat, john, hydra |
password |
| AD / Windows-ish |
netexec, impacket |
core |
| Wireless |
aircrack-ng, hcxtools |
wireless |
| Reversing |
radare2, gdb, binwalk |
reversing |
| Forensics |
tshark, sleuthkit, foremost, yara |
forensics |
If a tool is missing: sudo blackomarchy install <profile>, then
re-check command -v. Do not apt install. Do not pull random
installers.
Evidence
- Commands as copied, with timestamps.
- Findings need a reproduction command using an installed tool.
- Do not invent CVEs or claim a vuln without output.
- Do not write exploit source, exploit PoCs, malware, or shellcode.
Use the packaged scanner/cracker; stop at a verified finding and
a reproduction command.
Report shape
When the operator asks for a write-up:
- Scope and authorization reference
- What was tested / not tested
- Findings with evidence paths
- Reproduction commands
- Residual risk / next steps for the operator
1---2name: black-omarchy-pentest3description: Collaborative and semi-autonomous authorized pentesting on a Black omARCHy host. Use when the user wants pentest, recon, enumeration, web assessment, password/hash work, wireless, reversing, or forensics with nmap, sqlmap, ffuf, gobuster, hashcat, netexec, or similar installed tools. Requires written scope before any active scan. Slash: /black-omarchy-pentest4---56# Black omARCHy pentest78Operator and agent work together. The agent proposes; the operator9approves; the agent runs **one phase**, reports, then waits.1011Read `references/tools.md` for the host tool map. Read the12`black-omarchy` skill for CLI, updates, and Omarchy invariants.1314## Authorization gate (once per engagement)1516Do not scan, scrape, or authenticate against a target until the17operator has given all of:18191. Written authorization (engagement, bug bounty in-scope asset, or20 lab/CTF they own)212. Scope (hosts, CIDRs, domains, explicit exclusions)223. Depth (recon-only, credentialed, or in-scope exploitation with23 installed tools)244. Rules of engagement (rate limits, production windows, data handling)2526If any item is missing, ask only for the missing item. Record the27answers in `notes/scope.md` (create `notes/` in the engagement cwd).2829Refuse out-of-scope targets, third-party systems named in passing, and30"just try this IP" with no authorization.3132## Operating mode3334**Collaborative / semi-autonomous, not fire-and-forget.**35361. Restate scope and the next phase in one short plan.372. Wait for an explicit go (`go`, `approved`, `run it`).383. Run only that phase with tools that exist (`command -v`).394. Write evidence under `notes/` (commands, truncated output, findings).405. Stop and summarize. Propose the next phase. Do not chain into41 exploitation because recon found a port.4243High-risk actions always need a fresh go: credential spraying, default44password tests, exploitation modules, wireless injection, anything that45changes target state.4647## Phases4849| Phase | Default tools on this host | Profile if missing |50| --- | --- | --- |51| Recon / OSINT | `theharvester`, `whatweb`, `whois`, `enum4linux-ng` | `recon` |52| Network discovery | `nmap`, `masscan`, `traceroute` | `core` / `network` |53| Web | `nikto`, `sqlmap`, `gobuster`, `ffuf`, `whatweb` | `web` |54| Auth / hashes | `hashcat`, `john`, `hydra` | `password` |55| AD / Windows-ish | `netexec`, `impacket` | `core` |56| Wireless | `aircrack-ng`, `hcxtools` | `wireless` |57| Reversing | `radare2`, `gdb`, `binwalk` | `reversing` |58| Forensics | `tshark`, `sleuthkit`, `foremost`, `yara` | `forensics` |5960If a tool is missing: `sudo blackomarchy install <profile>`, then61re-check `command -v`. Do not `apt install`. Do not pull random62installers.6364## Evidence6566- Commands as copied, with timestamps.67- Findings need a reproduction command using an **installed** tool.68- Do not invent CVEs or claim a vuln without output.69- Do not write exploit source, exploit PoCs, malware, or shellcode.70 Use the packaged scanner/cracker; stop at a verified finding and71 a reproduction command.7273## Report shape7475When the operator asks for a write-up:7677- Scope and authorization reference78- What was tested / not tested79- Findings with evidence paths80- Reproduction commands81- Residual risk / next steps for the operator
MahdiHedhli