PAGES
← all tools
◆ General Utilities & Libraries

arsenal-ng

v1.5 open-source

arsenal-ng is a pentest command launcher written in Go with fuzzy search across 248 tools and 2,940 commands for Linux and macOS.

source ↗ rss ↗ What is a cyber toolchain? last repo push Jul 6, 2026

Summary

arsenal-ng is an open-source command-line launcher, written in Go, that gives penetration testers a searchable cheatsheet of pentest tool syntax right in the terminal. It runs as a single binary installed via go install, the Kali Linux APT repositories, or built from source, and works on Linux and macOS, with Windows supported only through WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host.. It is aimed at pentesters and red teamers who need to recall exact command syntax mid-engagement rather than search documentation, offering fuzzy search, argument placeholders, and global variables across a bundled library of 247 tools and roughly 2,926 commands. Its README describes it as a rewrite of Orange Cyberdefense's arsenal, built for simplicity and speed. With 4 contributors, 30 commits and 27 releases in the past year, and a last release 46 days ago, it is under active maintenance.

arsenal-ng is a pentest command launcher written in Go with fuzzy search across 248 tools and 2,940 commands for Linux and macOS.

How arsenal-ng helps

What was the exact syntax for that scan mode I used six months ago and can't remember now?

fuzzy-searches the bundled library of 247 tools and roughly 2,926 commands and surfaces the matching command line so it can be recalled without leaving the terminal

Which tool covers a task I need mid-engagement but I can't recall the tool's name either?

searches across the whole cheatsheet library by tool and command text, not just exact names, so a partial or approximate memory still turns up the right entry

How do I fill in a found command's target, port or wordlist without retyping the whole thing?

drops the command into the terminal buffer with its arguments marked as placeholders so only the changing values need to be typed

Which tools and commands are actually available in this installed copy?

lists every bundled tool alongside how many commands it carries, so coverage can be checked before relying on it during an engagement

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities

Built from arsenal-ng's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • arsenal-ng covers 1 of the 2 secrets and credential hygiene capabilities we track.

What arsenal-ng offers you

  • Command-line interface2
All capabilities 8 capabilities
Global variable management shipped Supports setting, listing, and removing global variables for use across sessions and cyber tools. 3 other sources

example

  • List all currently set variables variables
  • Remove a global variable unset ip
  • Set a global variable for session set ip=10.10.10.10
Built-in pentest cheatsheet library shipped Provides a built-in library of cheatsheets covering pentest tools and their commands, usable as a quick reference during engagements. 1 release · 1 other source · first seen Jul 2026

Also counts toward: Command-line interface

release

  • Adds new pentest tools to the built-in cheatsheet library, bringing the total to 242 tools and 2,872 commands. v1.5 · Jul 2026 · source · release history

docs

  • Terminal UI pentest command launcher with fuzzy search, argument placeholders, and global variables across 248 cyber tools.
WordPress operations shipped Provides wp-cli integration for performing WordPress command-line interface operations. 1 release · first seen Mar 2026

Also counts toward: Command-line interface

release

  • Adds wp-cli tool integration for WordPress command-line interface operations. v1.3 · Mar 2026 · source · release history
Access control bypass shipped Includes the 403bypasser tool for testing and bypassing HTTP 403 Forbidden access-control restrictions. 1 release · first seen Dec 2025

release

  • Adds 403bypasser tool for testing and bypassing HTTP 403 Forbidden access-control restrictions. v0.4 · Dec 2025 · source · release history
Secret detection shipped Provides integration with PassDetective to detect hardcoded credentials and secrets in source code. 1 release · first seen Dec 2025

Shared capability: Secret scanning

release

  • Adds PassDetective integration for detecting hardcoded credentials and secrets in source code. v0.4 · Dec 2025 · source · release history
Local binary execution shipped Supports running locally built binaries within the cyber tooling environment. 1 other source

example

  • Run locally built binary ./bin/arsenal-ng
Tool inspection shipped Allows users to list currently set variables and show all available tools with their command counts. 1 other source

example

  • Show all tools with command counts tools
TUI launcher shipped Provides a terminal user interface command launcher for launching the cyber tool environment. 1 other source

example

  • Launch the TUI command launcher arsenal-ng

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for arsenal-ng, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail arsenal-ng puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

4 entries

  1. July 20261
  3. March 20261
  5. January 20261
  7. December 20251

    4 entries

    1. v1.5 Jul 6, 2026 · issue 008

      arsenal-ng v1.5 expands its built-in cheatsheet library, growing to 242 tools and 2,872 commands.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.5 https://github.com/halilkirazkaya/arsenal-ng.git
# already have the repo? check out this version:
$ git checkout v1.5
    2. v1.3 Mar 27, 2026 · release notes

      arsenal-ng v1.3 adds wp-cli tool support to the arsenal.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.3 https://github.com/halilkirazkaya/arsenal-ng.git
# already have the repo? check out this version:
$ git checkout v1.3
      • Adds wp-cli tool integration for WordPress command-line interface operations.

      1 detail in Everything

    3. v0.7 Jan 4, 2026 · release notes

      arsenal-ng v0.7 adds SprayHound to its curated command reference toolkit.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.7 https://github.com/halilkirazkaya/arsenal-ng.git
# already have the repo? check out this version:
$ git checkout v0.7
      • Adds SprayHound to the command cheatsheet collection for password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password. workflows.

      1 detail in Everything

    4. v0.4 Dec 30, 2025 · release notes

      arsenal-ng v0.4 adds PassDetective credential scanner and 403bypasser HTTP access-control bypass tool.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.4 https://github.com/halilkirazkaya/arsenal-ng.git
# already have the repo? check out this version:
$ git checkout v0.4
      • Adds PassDetective integration for detecting hardcoded credentials and secrets in source code.
      • Adds 403bypasser tool for testing and bypassing HTTP 403 Forbidden access-control restrictions.

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in halilkirazkaya/arsenal-ng, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 5 +5 vs prior 12 months
    2. Maintainers 2 +2 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 2.1 days first maintainer reply 11 hours
    6. Open backlog 0 of 2 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 2
    4. Commits / month 5
    5. Stars 704
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Articles

    1 article · updated Nov 4, 2026

    Where arsenal-ng turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.

    Tutorials & guides 1

    • Arsenal-NG: A Terminal Cheat-Sheet Launcher for Faster Penetration Testing Hacking Articles
      Overview Arsenal-NG is an interactive, terminal-based launcher that turns a sprawling collection of offensive-security tools into a single searchable command cheat-sheet.
      2 more quotes
      Table of Contents: Introduction Installing Arsenal-NG Launching the Interface Browsing the Command Library Listing Every Available Tool Reading the Tools Table Inspecting a Single Tool Selecting a Command with a Live…
      Arsenal-NG attacks this problem head-on by acting as a fast, keyboard-driven front end that remembers the commands, so you do not have to.

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback