navig-pentest 🛡️

The authorized-only offensive-security toolkit: passive recon (RDAP/whois, DNS, crt.sh subdomains, HTTP fingerprint) plus gated active recon (port scan, subdomain probe, template checks) behind a written-authorization engagement gate. Wired into navig pentest (+ navig-warroom / warroom-osint conveniences).

Works on its own — its own CLI, no navig required · v0.1.0 · not on PyPI yet (install from source below)

On its own (no navig needed)

pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-pentest"
warroom-osint --help   # no navig needed

With navig

pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-pentest"
navig pentest --help

The authorized-only offensive-security toolkit for NAVIG — a Swiss-army-knife over the Kali Linux / GitHub toolchain. Passive reconnaissance is free and safe; active reconnaissance is gated behind a written-authorization engagement.

# passive (free — public records)
navig pentest whois example.com · dns · subdomains · fingerprint · osint
navig pentest subfinder example.com · amass --passive · harvester · dnsx · sherlock <user>
navig pentest surface example.com          # subdomains → DNS, one pass
navig pentest urls example.com             # gau + waybackurls
navig pentest wordlist --find              # locate installed wordlists

# active (GATED — needs an authorized engagement)
navig pentest ports acme.com --top 1000 --tool nmap   # connect · nmap · naabu · masscan · rustscan
navig pentest probe · nuclei · enum4linux acme.com
navig pentest fuzz https://acme.com/FUZZ --tool ffuf · crawl · sqlmap · wpscan · nikto
navig pentest hydra acme.com ssh --users u.txt --passwords p.txt   # loud — scope first
navig pentest surface acme.com --live     # add live probing (gated)

# local (no network gate)
navig pentest hashcat hashes.txt --mode 0 · john hashes.txt
navig pentest exif file.jpg · binwalk firmware.bin · hashid <hash>

# the Swiss-army-knife core — any detected engine, through the gate
navig pentest run ffuf --target https://acme.com -u https://acme.com/FUZZ -w list.txt
navig pentest tools                 # the 40-tool catalog with install guidance
navig pentest doctor                # health, grouped by category

# scope
navig pentest engage --name "Q3: Acme" --target acme.com \
  --authorization signed-scope.pdf --assets "acme.com,203.0.113.0/24"
navig pentest scope acme.com

The toolchain

The plugin detects, never bundles ~40 best-of-breed Kali/GitHub engines across eight categories — recon & OSINT (subfinder, amass, theHarvester, sherlock, dnsx, gau, …), scanning (nmap, naabu, masscan, rustscan, enum4linux, …), web/fuzzing (ffuf, gobuster, feroxbuster, dirsearch, httpx, katana), vulnerability (nuclei, nikto, wpscan, sqlmap, searchsploit), passwords (hydra, john, hashcat, cewl), exploitation (metasploit, beef-xss), wireless (aircrack-ng, wifite, reaver) and forensics (exiftool, binwalk, hashid, steghide).

navig pentest tools lists the catalog with per-tool install guidance; navig pentest run <tool> --target <host> [flags…] runs any of them through the gate. Interactive consoles (msfconsole, wifite) are detected and pointed to, never auto-launched.

The gate

No active collection, scanning, probing or brute-forcing against a target without standing written authorization for that target. Every active engine — whether reached through a curated command or pentest run — goes through the same gate: an authorized engagement must cover the target (exact / subdomain / wildcard / CIDR) and today must be inside its window. Passive lookups and local-only tools (hash cracking, forensics) need no network gate.

engage refuses to create an engagement without an --authorization reference. The store (~/.navig/pentest/engagements.json, override NAVIG_PENTEST_ENGAGEMENTS) is the same shape the war-room-space start-engagement skill writes, so the space and this plugin agree on one source of truth.

Standalone

Runs on its own (navig-pentest …, navig-warroom …, warroom-osint <domain>) with no navig installed — and inside navig as navig pentest …. Passive recon is pure Python stdlib; every external engine is detected on PATH and install-guided, never bundled.

War Room integration

The Telegram War Room surface (/osint · /wr · /kali) dispatches to the kali-warroom host, where this plugin provides warroom-osint (passive sweep) and navig-warroom (status · tool-health · list-cases).

Legal/ethical line — deliberately NOT built: raw breach-dump/combolist sources, stresser/booter (DoS) services, credential-stuffing, or anything that requires bypassing access controls. Capability is never the test — authorization and legality are.