Pentest Tools

A collection of shell scripts for penetration testing on Kali Linux. Designed to reduce typing, enforce consistency, and automate common tasks during engagements.

WARNING: These tools are designed for use in disposable VMs during authorized penetration testing engagements, particularly hardware, OT, and maritime assessments where you're constantly changing networks and interfaces. They auto-elevate to root, modify network interfaces, configure passwordless sudo, and bind services on all interfaces. Do not install on a machine you care about or use outside of an isolated test environment.

Install

./install.sh

Installs scripts to /usr/local/bin, configures shell history, prompt, aliases, sudoers, and installs dependencies (fzf). Works with both bash and zsh.

Tools

Network Configuration

Command	Description
setif <interface>	Set default interface for all tools (stored in ~/.pentest-iface)
setif	Show current default interface
getip [-i iface]	Get an IP address via DHCP
setip <ip/cidr> [gateway] [-i iface]	Set IP address and optional gateway (replaces existing)
addip <ip/cidr> [gateway] [-i iface]	Add additional IP without removing existing ones
removeip [ip] [-i iface]	Remove a specific IP (CIDR optional) or all IPs if none specified
setmac <mac|random|reset|show>	Set, randomize, or reset MAC address
setdns <ip> [ip2]	Set DNS server(s) and verify with test query
setgw <gateway> [-i iface]	Set default gateway
setroute <dest> <via_gw> [-i iface]	Add a static route
iface	Show all interfaces with IPs and state
iface up|down [interface]	Bring interface up or down
iface silent [interface]	Up + promisc, no ARP/IPv6/multicast (passive sniffing)
iface status [interface]	Show interface state and mode
vlan [list] [-i iface]	Show VLANs on current interface
vlan add <id> [ip/cidr] [gw]	Create VLAN sub-interface, optionally set IP and gateway
vlan del <id>	Remove VLAN sub-interface
togglenm [on|off|status]	Toggle NetworkManager on/off

All network tools read ~/.pentest-iface for the default interface (set via setif), accept -i to override, auto-elevate to root, and warn if NetworkManager is running.

Scanning & Recon

Command	Description
arpscan <subnet> [-i iface]	ARP scan, saves .raw and .ips files
scan <target> [profile] [-i iface] [--no-ping]	Nmap with profiles: discover, safe, default, high, allports, udp
recon <ip/cidr> [gateway] [-p profile]	Combined setip + arpscan + nmap

File Transfer

Command	Description
transfer <file> [-p port] [--win|--linux|--smb]	Print LOTL file transfer commands for the target
smbserve [dir] [-a] [-n name]	SMB file server for Windows targets (prints copy commands)
serve [port]	HTTP server in current directory (default: 8000)

Credential Management

Command	Description
loot pass user:pass:host	Log credentials (host optional, colons in passwords ok)
loot hash user:hash:host	Log hashes (host optional)
loot note <free text>	Log a finding (everything after note is the note)
loot show [host] | grep | export | count	Search and display loot
nxc-session set -u user -p pass	Store NetExec credentials
nxc-session <proto> <target> [flags]	Run NetExec with stored creds

File & Text Tools

Command	Description
f <term>	Case-insensitive file search from current directory
sgrep <pattern> [file/dir]	strings | grep for binary analysis
extractips [file ...]	Extract sorted unique IPv4 addresses from any file or stdin
save <command> [args]	Run command and tee to auto-named log file

Firewall

Command	Description
blockport <ports|alias>	Block outbound ports (80, 80,443, 100-110, ot)
blockport list	Show current blocked port rules
blockport clear [ports|alias]	Remove port rules (all or specific)
blockhost <ip|subnet>	Block all outbound traffic to host or subnet
blockhost list	Show current blocked host rules
blockhost clear [ip|subnet]	Remove host rules (all or specific)

Port aliases: ot (102,502,2222,4840,9600,20000,44818,47808), web (80,443), dns (53)

System

Command	Description
status	Show interfaces, IPs, routes, DNS, listening services, active connections
nosudo <command>	Add auto-sudo alias (no more typing sudo)
nosudo list|remove	Manage auto-sudo aliases
vmshare [mount|unmount|list|status]	Mount VMware shared folders to /mnt/hgfs
pt-help	Quick reference for all tools

Shell Enhancements

Installed automatically by install.sh:

• Per-terminal history - Each terminal gets its own history file in ~/.shell_histories/, plus a global history. histall shows the current terminal's full history; histall <pattern> searches across all terminals. Works in both bash and zsh.
• Custom prompt - Shows date, time, IP and interface: ┌──(11-03-2026 14:35 192.168.1.10@eth1)-[~/recon]
• Typo aliases - Common typos corrected (namp->nmap, sduo->sudo, etc.)
• Auto-sudo aliases - nmap, iptables, arp-scan, responder, etc. run with sudo automatically
• fzf - Ctrl-R for fuzzy history search, Ctrl-T for file finder, Alt-C for fuzzy cd
• mkcd - mkcd dirname creates a directory and cd's into it
• NOPASSWD sudo - Common pentest tools configured for passwordless sudo