// Arsenal.jsx — operator tooling arsenal
// Animated marquees of real offensive-security tools, grouped by category.
// Tool names are accurate references to widely-used open-source pentest tooling.
const ARSENAL_CATEGORIES = [
{
id: 'recon',
label: 'Recon & OSINT',
desc: 'Asset discovery, subdomain enum, exposure mining',
color: '#828fff',
tools: [
{ n: 'Nmap', k: 'port + service' },
{ n: 'Amass', k: 'subdomain graph' },
{ n: 'Subfinder', k: 'passive enum' },
{ n: 'httpx', k: 'web probing' },
{ n: 'Shodan', k: 'internet census' },
{ n: 'Censys', k: 'cert intel' },
{ n: 'theHarvester', k: 'osint email' },
{ n: 'ffuf', k: 'fuzz · brute' },
{ n: 'gowitness', k: 'screenshot' },
{ n: 'waybackurls', k: 'history' },
{ n: 'dnsx', k: 'dns enum' },
{ n: 'gs-recon', k: 'in-house · ledger', custom: true },
],
},
{
id: 'web',
label: 'Web & API',
desc: 'Manual web testing, GraphQL, API abuse, fuzzing',
color: '#828fff',
tools: [
{ n: 'Burp Suite Pro', k: 'proxy + extender' },
{ n: 'Caido', k: 'modern proxy' },
{ n: 'OWASP ZAP', k: 'open proxy' },
{ n: 'sqlmap', k: 'injection' },
{ n: 'Nuclei', k: 'template engine' },
{ n: 'dalfox', k: 'xss scanner' },
{ n: 'GraphQL Voyager',k: 'schema map' },
{ n: 'Postman', k: 'api replay' },
{ n: 'gobuster', k: 'directory brute' },
{ n: 'jwt_tool', k: 'token attack' },
{ n: 'turbo-intruder', k: 'race-cond' },
{ n: 'gs-fuzz', k: 'in-house · schema-aware', custom: true },
],
},
{
id: 'ad',
label: 'Active Directory & Identity',
desc: 'Kerberos, ADCS, lateral movement, credential attacks',
color: '#828fff',
tools: [
{ n: 'BloodHound', k: 'attack-path graph' },
{ n: 'NetExec', k: 'protocol exec' },
{ n: 'Impacket', k: 'smb · kerberos' },
{ n: 'Rubeus', k: 'kerberos toolkit' },
{ n: 'Certipy', k: 'adcs esc' },
{ n: 'Kerbrute', k: 'username · spray' },
{ n: 'mimikatz', k: 'lsass · dpapi' },
{ n: 'ldapdomaindump', k: 'ldap recon' },
{ n: 'Coercer', k: 'auth coercion' },
{ n: 'PowerView', k: 'ad recon' },
{ n: 'SharpHound', k: 'collector' },
{ n: 'gs-graph', k: 'in-house · adcs scoring', custom: true },
],
},
{
id: 'c2',
label: 'Exploitation & C2',
desc: 'Command and control, post-exploitation, payloads',
color: '#828fff',
tools: [
{ n: 'Metasploit', k: 'framework' },
{ n: 'Sliver', k: 'open c2' },
{ n: 'Mythic', k: 'multi-agent c2' },
{ n: 'Havoc', k: 'modern c2' },
{ n: 'Cobalt Strike', k: 'commercial' },
{ n: 'NimPlant', k: 'lightweight implant' },
{ n: 'donut', k: 'shellcode gen' },
{ n: 'PEzor', k: 'pe loader' },
{ n: 'Inceptor', k: 'evasion' },
{ n: 'ScareCrow', k: 'edr bypass' },
{ n: 'gs-implant', k: 'in-house · BOFs', custom: true },
],
},
{
id: 'mobile',
label: 'Mobile & Reversing',
desc: 'iOS, Android, binary analysis, runtime hooking',
color: '#828fff',
tools: [
{ n: 'Frida', k: 'runtime hook' },
{ n: 'Objection', k: 'mobile toolkit' },
{ n: 'MobSF', k: 'mobile sast' },
{ n: 'apktool', k: 'apk decompile' },
{ n: 'jadx', k: 'dex → java' },
{ n: 'Ghidra', k: 'reverse engineering' },
{ n: 'IDA Pro', k: 'disassembler' },
{ n: 'radare2', k: 'open re' },
{ n: 'drozer', k: 'android ipc' },
{ n: 'class-dump',k: 'objc inspect' },
],
},
{
id: 'cloud',
label: 'Cloud & Kubernetes',
desc: 'AWS, Azure, GCP, Kubernetes',
color: '#828fff',
tools: [
{ n: 'Pacu', k: 'aws exploit' },
{ n: 'ScoutSuite', k: 'multi-cloud audit' },
{ n: 'Prowler', k: 'cis benchmark' },
{ n: 'PMapper', k: 'iam graph' },
{ n: 'CloudFox', k: 'aws recon' },
{ n: 'kube-hunter', k: 'k8s discovery' },
{ n: 'peirates', k: 'k8s privesc' },
{ n: 'kubeaudit', k: 'cluster review' },
{ n: 'ROADtools', k: 'entra id' },
{ n: 'AzureHound', k: 'azure path' },
{ n: 'gs-trustgraph',k: 'in-house · cross-account', custom: true },
],
},
];
const Arsenal = () => {
const [hovered, setHovered] = React.useState(null);
return (
The arsenal
Community and commercial tools, plus the ones we built ourselves.
The tools we use