# Black Omarchy Pentest

> Collaborative and semi-autonomous authorized pentesting on a Black omARCHy host. Use when the user wants pentest, recon, enumeration, web assessment, password/hash work, wireless, reversing, or forensics with nmap, sqlmap, ffuf, gobuster, hashcat, netexec, or similar installed tools. Requires written scope before any active scan. Slash: /black-omarchy-pentest

- Skill: `mahdihedhli/black-omarchy-pentest` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add mahdihedhli/black-omarchy-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mahdihedhli/black-omarchy-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: MahdiHedhli (https://skillmd.com/u/mahdihedhli)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mahdihedhli/black-omarchy-pentest

---


# Black omARCHy pentest

Operator and agent work together. The agent proposes; the operator
approves; the agent runs **one phase**, reports, then waits.

Read `references/tools.md` for the host tool map. Read the
`black-omarchy` skill for CLI, updates, and Omarchy invariants.

## Authorization gate (once per engagement)

Do not scan, scrape, or authenticate against a target until the
operator has given all of:

1. Written authorization (engagement, bug bounty in-scope asset, or
   lab/CTF they own)
2. Scope (hosts, CIDRs, domains, explicit exclusions)
3. Depth (recon-only, credentialed, or in-scope exploitation with
   installed tools)
4. Rules of engagement (rate limits, production windows, data handling)

If any item is missing, ask only for the missing item. Record the
answers in `notes/scope.md` (create `notes/` in the engagement cwd).

Refuse out-of-scope targets, third-party systems named in passing, and
"just try this IP" with no authorization.

## Operating mode

**Collaborative / semi-autonomous, not fire-and-forget.**

1. Restate scope and the next phase in one short plan.
2. Wait for an explicit go (`go`, `approved`, `run it`).
3. Run only that phase with tools that exist (`command -v`).
4. Write evidence under `notes/` (commands, truncated output, findings).
5. Stop and summarize. Propose the next phase. Do not chain into
   exploitation because recon found a port.

High-risk actions always need a fresh go: credential spraying, default
password tests, exploitation modules, wireless injection, anything that
changes target state.

## Phases

| Phase | Default tools on this host | Profile if missing |
| --- | --- | --- |
| Recon / OSINT | `theharvester`, `whatweb`, `whois`, `enum4linux-ng` | `recon` |
| Network discovery | `nmap`, `masscan`, `traceroute` | `core` / `network` |
| Web | `nikto`, `sqlmap`, `gobuster`, `ffuf`, `whatweb` | `web` |
| Auth / hashes | `hashcat`, `john`, `hydra` | `password` |
| AD / Windows-ish | `netexec`, `impacket` | `core` |
| Wireless | `aircrack-ng`, `hcxtools` | `wireless` |
| Reversing | `radare2`, `gdb`, `binwalk` | `reversing` |
| Forensics | `tshark`, `sleuthkit`, `foremost`, `yara` | `forensics` |

If a tool is missing: `sudo blackomarchy install <profile>`, then
re-check `command -v`. Do not `apt install`. Do not pull random
installers.

## Evidence

- Commands as copied, with timestamps.
- Findings need a reproduction command using an **installed** tool.
- Do not invent CVEs or claim a vuln without output.
- Do not write exploit source, exploit PoCs, malware, or shellcode.
  Use the packaged scanner/cracker; stop at a verified finding and
  a reproduction command.

## Report shape

When the operator asks for a write-up:

- Scope and authorization reference
- What was tested / not tested
- Findings with evidence paths
- Reproduction commands
- Residual risk / next steps for the operator