dotfiles-Offense

RoleStable

The offensive role layer for authorized engagements — stacked on whatever OS-native layer the box already runs. The red twin of dotfiles-Defense.

Highlights

  • engagement scaffolding
  • scope-first workflow
  • NetExec / BloodHound CE
  • installs nothing by default

How it fits

The Role layer — Operator role — offensive or defensive — stacked on top of an OS layer. It builds on Core, which is vendored into its core/ directory. See the three-layer model for how the layers compose.

Getting started

git clone https://github.com/dotgibson/dotfiles-Debian ~/dotfiles-Debian
~/dotfiles-Debian/bootstrap.sh  # the OS-native layer first (it covers Kali)
git clone https://github.com/dotgibson/dotfiles-Offense ~/dotfiles-Offense
cd ~/dotfiles-Offense
./bootstrap.sh                  # symlinks + a report of which tools you have
./bootstrap.sh --install        # opt-in: the offensive tool stack

Distro-agnostic and report-only by default. Flags: --install (opt into the tool install), --links-only, --no-check.

What actually bites

  • A role layer, not an OS one — It adds an offensive stage to the zsh loader (… os offensive local) at band 85 — after the OS layer so paths/clipboard resolve first, before local so a machine override still wins. It owns no package manager, clipboard or paths; that is the OS repo’s job. It used to own an apt OS layer too, which now lives in dotfiles-Debian.
  • Engagement data never lives in the repo — Everything goes under ~/engagements (outside any git tree); the paranoid .gitignore is only a backstop. mkengagement writes scope/scope.txt first — installing a tool is not permission to point it at anything.
  • The naming changes that bite — CrackMapExec is gone — it is nxc (NetExec) now, the single highest-leverage tool in the kit. BloodHound is Community Edition; the bhce helper drives nxc’s --bloodhound module for a CE-ready collection.
  • Two routes for --install, and they differ — On Kali it apt-installs install/offensive-packages.txt. On any other Debian-family box it installs a smaller portable subset via pipx and go — the rest of that list is Kali-packaged. Anywhere else it refuses and says why, rather than guessing at a package manager.
  • WSL2 is NAT’d — A listener / reverse shell / C2 in Kali is not LAN-reachable until you set networkingMode=mirrored in the Windows-side %UserProfile%\.wslconfig (Win11 22H2+) — not /etc/wsl.conf. That config now ships in dotfiles-Debian.

Read next

View dotfiles-Offense on GitHub ↗