offsec

Category dispatcher — offensive toolkit front door (urlrecon / payloadforge / mailforge / wifiaudit / pentree / …)

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install offsec

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- offsec

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

offsec --help                # subcommand catalogue + flags
offsec --full                # extended help across every subcommand
offsec --about               # machine-readable attribution (JSON)
offsec --version             # version string

What it does

offsec is the first of six category dispatchers for the cli.johlem.net suite. It wraps the offensive half of the suite (13 tools: urlrecon, webharvest, payloadforge, lexharvest, credsweep, regexlab, b64chain, hashcrackref, mailforge, wifiaudit, vlanrecon, esptools, pentree) behind a single ~1 MB front-door binary without merging the underlying tools — every tool stays separately installable, separately signify-signed, and separately versioned. Four subcommands: `list` (shows the category, installed-status flagged with ✓), `doctor` (per-tool install diagnostic + catalogue-source disclosure, exit 1 when anything is missing), `search` (fuzzy-find by name / tagline / tag), `install` (delegates to jcli for one tool, several tools, or --all missing). Any unrecognised subcommand is treated as a tool name and forwarded via clap external_subcommand — `offsec urlrecon --headers https://target` exec`s the urlrecon binary with the rest of the argv and propagates its exit code unchanged, so CI pipelines pinned to `urlrecon → exit 1 on findings` keep working when invoked through the dispatcher. Catalogue resolves in order: $OFFSEC_CATALOGUE (env) → $XDG_DATA_HOME/cli-johlem/catalogue.json (live copy jcli refreshes) → vendored compile-time snapshot. Sister dispatchers queued next: blueteam, opsec, grc, recon, util. Offline-only. 3 unit + 14 integration tests green; zero compiler warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.