Arsenal is a Bash script that automatically installs and configures the most important Bug Bounty & penetration testing tools on Debian/Ubuntu Linux — saving you hours of manual setup on every new machine.

This toolkit is intended for authorized security testing and bug bounty hunting only. Only use these tools against systems you have explicit permission to test. The author is not responsible for any misuse or damage caused.

All dependencies are handled automatically by the script.

If you prefer to install Go manually before running the script:

sudo apt-get remove -y golang-go
sudo rm -rf /usr/local/go
wget https://go.dev/dl/go1.26.2.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.26.2.linux-amd64.tar.gz

# Add to /etc/profile or ~/.bashrc:
export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin
export PATH=$PATH:$GOPATH/bin

source /etc/profile

git clone https://github.com/Micro0x00/Arsenal.git
cd Arsenal
sudo chmod +x arsenal.sh
sudo ./arsenal.sh

After installation, reload your PATH:

source /etc/profile.d/go.sh

# 1. Passive subdomain discovery
subfinder -d target.com -o subs.txt

# 2. Generate permutations and resolve
alterx -l subs.txt | dnsx -silent >> subs.txt

# 3. Probe live hosts
cat subs.txt | httpx -silent -o live.txt

# 4. Port scan
naabu -l live.txt -o ports.txt

# 5. Crawl
katana -l live.txt -o urls.txt

# 6. Vulnerability scan
nuclei -l live.txt -o vulns.txt

~/Arsenal/
├── arsenal.sh          # Main installer
├── dontgo403/          # Built from source
├── knock/              # knockpy
├── XSStrike/           # Optional
├── ParamSpider/        # Optional
├── Arjun/              # Optional
├── jwt_tool/           # Optional
├── Gf-Patterns/        # gf patterns → auto-copied to ~/.gf
└── ...

Go binaries → ~/go/bin and /usr/local/bin

• Upgraded Go 1.22.3 → 1.26.2 with automatic upgrade on outdated installs
• Upgraded Nuclei v2 → v3 (breaking import path change)
• Upgraded ffuf v1 → v2
• Added: naabu, tlsx, alterx, cvemap, anew, unfurl
• Added: automatic gf-patterns setup
• Fixed: dontgo403 re-installing on every run
• Fixed: go get replaced with go mod tidy (deprecated in modern Go)
• Fixed: pip3 updated for Ubuntu 24.04 compatibility (--break-system-packages)
• Fixed: Go PATH now persisted via /etc/profile.d/go.sh
• Refactored with helper functions — no more repeated code blocks
• Added color-coded output and install summary

• Initial public release