Documentation

Configuration only — no additional packages installed.

Creates the default login user, redbsd, with the default password redbsd, and adds it to the wheel/operator/video groups for sudo and desktop access. Change this password after your first login. SSH access for this account is also enabled for remote deployment.

• Xorg — The X Window System display server that provides the graphical foundation for the desktop.
• D-Bus — Inter-process communication daemon used by desktop services and applications to talk to each other.
• Xfce — Lightweight desktop environment providing the windowing, panel, and session experience.
• Xfce4 Panel/Session/Settings/WM — Core Xfce components: the taskbar/panel, session manager, settings daemon, and window manager.
• Xfce4 Terminal — The default terminal emulator for the desktop.
• Xfce4 Appfinder — Application launcher and search utility for finding and starting installed programs.
• Xfce4 Notifyd — Desktop notification daemon that displays pop-up alerts from applications.
• Xfce4 Power Manager — Power, battery, and screen-blanking management applet.
• Thunar — The default graphical file manager.
• Thunar Archive Plugin — Adds 'create archive' / 'extract here' actions to Thunar's right-click menu.
• Firefox — The default graphical web browser.

• SDDM — Simple Desktop Display Manager — presents the graphical login screen and starts your desktop session.
• D-Bus — Inter-process communication daemon required by the login session and desktop services.
• Xorg — The X Window System display server used by the graphical login and desktop session.
• Xfce4 session/panel/WM/desktop/settings/terminal — Ensures a full Xfce session is available to launch immediately after logging in via SDDM.

• open-vm-tools — VMware Tools guest daemon, providing clipboard sharing, time sync, graceful shutdown, and shared folder support inside VMware.
• xf86-video-vmware — Xorg display driver for VMware's virtual SVGA adapter, enabling proper resolution and display performance.

Configuration only — no additional packages installed.

Configuration only — no additional packages installed.

Configuration only — no additional packages installed.

• ImageMagick — Image manipulation toolkit used to generate the RedBSD UEFI boot splash images.

Configuration only — no additional packages installed.

• aircrack-ng — Suite of tools for assessing Wi-Fi network security, including packet capture and WEP/WPA key cracking.
• nmap — Network discovery and port-scanning tool used for host and service enumeration.
• reaver — Brute-force attack tool targeting WPS PIN-enabled Wi-Fi access points.
• pixiewps — Offline WPS 'pixie dust' attack tool for recovering WPS PINs.
• kismet — Wireless network detector, sniffer, and intrusion detection system.
• bettercap — Network attack and monitoring framework for Wi-Fi, Bluetooth LE, and network MITM attacks.
• wifite2 — Automated wireless auditing tool that wraps aircrack-ng, reaver, and other Wi-Fi attack tools.

• Sliver (server & client) — Open-source, cross-platform adversary emulation and command-and-control (C2) framework.
• Havoc (notes) — Setup notes/links for Havoc, a modern post-exploitation C2 framework.
• Mythic (optional) — Setup notes/links for Mythic, a Dockerized multi-agent C2 platform (enabled via INCLUDE_MYTHIC).
• Covenant (notes) — Setup notes/links for Covenant, a .NET-based C2 framework.

• GoPhish — Open-source phishing simulation and campaign management framework.
• evilginx2 — Standalone man-in-the-middle phishing framework capable of bypassing 2FA.
• Social-Engineer Toolkit (SET) — Framework for executing social engineering attack vectors, including phishing and payload generation.

• PEASS-ng (linPEAS / winPEAS) — Privilege escalation enumeration scripts for Linux and Windows that highlight likely escalation vectors.
• pspy — Unprivileged Linux process monitoring tool, useful for spotting cron jobs and scheduled tasks run as other users.
• sudo_killer — Audits sudo configurations and the local environment for privilege escalation vectors.
• Linux Exploit Suggester — Suggests potential local kernel/privilege-escalation exploits based on the running kernel version.
• GTFOBins — Reference database of common Unix binaries that can be abused to bypass local security restrictions.
• checksec — Checks binaries and running processes for security hardening features such as NX, ASLR, RELRO, and PIE.

• proxychains-ng — Forces a program's TCP connections through one or more proxies (SOCKS/HTTP chains).
• chisel — Fast TCP/UDP tunnel over HTTP, useful for pivoting through firewalls.
• ligolo-ng — Tunneling and pivoting tool that creates a tun interface to route traffic into a target network.
• sshuttle — Transparent VPN-like proxy that tunnels traffic over an SSH connection.
• rpivot — Reverse SOCKS proxy for pivoting through restrictive outbound-only networks.
• socat — Versatile bidirectional data relay between sockets, files, pipes, and serial lines.
• redsocks — Transparently redirects TCP connections to a SOCKS or HTTP proxy.

• radare2 — Reverse engineering framework for disassembly, debugging, and binary analysis.
• rizin — Reverse engineering framework forked from radare2, focused on usability and stability.
• GDB + GEF — The GNU Debugger enhanced with GEF (GDB Enhanced Features) for exploit development.
• pwntools — Python library for rapid exploit development and CTF challenges.
• ROPgadget — Searches binaries for ROP gadgets used to build return-oriented-programming exploit chains.
• checksec — Checks binaries and running processes for security hardening features such as NX, ASLR, RELRO, and PIE.
• Ghidra — NSA-developed software reverse engineering suite with an interactive decompiler.

• SecLists — Large curated collection of wordlists for usernames, passwords, URLs, and fuzzing payloads.
• rockyou.txt — Classic leaked password list widely used as a baseline for password cracking.
• crunch — Generates custom wordlists from defined character sets and patterns.
• cupp — Common User Passwords Profiler — generates targeted password guesses from personal information about a target.
• cewl — Crawls websites to build custom wordlists from page content.
• hashcat — GPU/CPU-accelerated password hash cracking tool.
• John the Ripper — Password cracking tool supporting a wide range of hash and cipher formats.

• kubectl — Command-line tool for interacting with and managing Kubernetes clusters.
• trivy — Vulnerability and misconfiguration scanner for containers, filesystems, and infrastructure-as-code.
• AWS CLI — Command-line interface for managing and querying Amazon Web Services resources.
• pacu — AWS exploitation framework for offensive security testing of AWS environments.
• ScoutSuite — Multi-cloud security auditing tool that assesses AWS, Azure, and GCP configurations.
• Prowler — Security best-practice and compliance scanner for AWS, Azure, and GCP.
• Azure CLI — Command-line interface for managing and querying Microsoft Azure resources.
• cloudfox — Cloud reconnaissance tool that helps identify exploitable attack paths in cloud environments.
• Helm — Package manager for Kubernetes, used for templating and deploying applications.

• CherryTree — Hierarchical note-taking application, commonly used for engagement notes and evidence.
• pwndoc — Web-based penetration test report generation and management platform.
• pandoc — Universal document converter, e.g. Markdown to PDF, Word, or HTML.
• wkhtmltopdf — Renders HTML pages to PDF, useful for generating reports.

• impacket — Python library and toolset for crafting and manipulating network protocols such as SMB and Kerberos.
• kerbrute — Fast tool for Kerberos pre-authentication username enumeration and password spraying.
• pypykatz — Python implementation of Mimikatz for extracting credentials and secrets from memory/files.
• evil-winrm — Interactive WinRM shell for remote command execution against Windows hosts.
• adidnsdump — Dumps Active Directory-integrated DNS zone records via LDAP.
• enum4linux-ng — Enumerates SMB/Active Directory hosts for users, groups, shares, and password policies.
• NetExec — Network service exploitation and enumeration tool (successor to CrackMapExec).
• BloodHound (Python) — Python-based data collector for BloodHound, used to map Active Directory attack paths.

• recon-ng — Modular web reconnaissance framework for open-source intelligence gathering.
• Sherlock — Searches for the presence of a given username across many social media platforms.
• h8mail — Email OSINT and breach-data hunting tool.
• PhoneInfoga — Phone number information gathering and OSINT tool.
• SpiderFoot — Automated OSINT reconnaissance tool that aggregates data from a large number of sources.
• theHarvester — Gathers emails, subdomains, hosts, and employee names from public sources.
• Holehe — Checks whether an email address is registered on numerous websites.
• Photon — Fast web crawler designed for OSINT, extracting URLs, emails, and secrets from sites.

Configuration only — no additional packages installed.

Adds desktop entries/launchers for: Wireshark, Burp Suite, OWASP ZAP, Ghidra, CherryTree, Maltego, GoPhish, BloodHound CE, SpiderFoot, pwndoc, Sliver C2.

• llama.cpp (llama-server) — Lightweight C/C++ inference engine for running large language models locally, including an OpenAI-compatible API server.
• Qwen3-1.7B GGUF model — Small open-weight language model in GGUF format, used as a starter model for local inference.
• CMake — Cross-platform build-system generator used to build llama.cpp.
• Ninja — Small, fast build system used to build llama.cpp.