pentest-builder

An offline, interactive command builder built from offensive-security notes — pick a command, fill in the target / wordlist / LHOST, get a ready-to-paste line.

pentest-builder turns hand-picked pentest notes (PJPT / PNPT / OSCP / TryHackMe) plus curated snippets from public references into a single, searchable command library you drive from a terminal menu. Instead of grepping scattered cheat sheets, you browse by category, and the tool fills in the bits that change and prints the assembled command.

It's a study and reference aid for authorised engagements — it only assembles commands; it doesn't find or exploit anything itself.

Features

• One unified library (~650 commands) — curated notes plus imports from GTFOBins, LOLAD, WADComs, LOFLCAB and an nmap cheat sheet, organised by category, tactic and protocol so alternatives for the same job sit together.
• Fill-in-the-blanks building — placeholders like {TARGET}, {LHOST} and {WORDLIST} are filled from session defaults you set once and reuse.
• Reference vs buildable — simple commands are printed in full to copy; only multi-value ones are numbered and prompt you for the values.
• Context-aware — each command shows its OS, whether it's destructive, and whether the tool it needs is actually on your PATH.
• Guarded run mode — starts in build-only (prints, never executes); an optional run mode executes non-destructive commands only, after a per-command confirmation.
• Offline, no required dependencies — pure Python 3; PyYAML is optional (a JSON copy of the library ships as a fallback).
• Companion Obsidian wiki — the same library projects into a linked, searchable Obsidian vault (one note per command, category maps, per-tool pages, a Bases view) with generate_wiki.py. See Obsidian wiki below.

Quick start

python3 pentest-builder.py      # Linux / macOS
python  pentest-builder.py      # Windows

No install step. It opens in safe build-only mode.

Using it

Key	Does
number	pick a buildable command (fills its values, prints the result)
· lines	reference commands — just read or copy the $ line, nothing to pick
type any text	filter the list live (/text also works)
Enter	on a long list, reveal the remaining entries
r	toggle run mode (asks to confirm; destructive commands never auto-run)
b / q	back / quit

Safety and scope

Build-only by default. Run mode never auto-runs anything flagged destructive and skips commands that don't match your OS. This is a reference tool for authorised testing and learning only — you are responsible for having permission to run anything it assembles.

Obsidian wiki (generate_wiki.py)

The same commands.yaml also powers an Obsidian vault. Where pentest-builder.py is the terminal runner, generate_wiki.py is the browse-and-cross-link view: it projects the library into one linked note per command, with category maps, a page per tool, and a Bases database view for filtering by OS, service, tool or destructiveness.

pip install pyyaml        # required for this tool
python generate_wiki.py

It asks whether to run interactively; the menu covers rebuild, add a command, remove a command, register a tool, and check (lint). Flags work too: --yes (silent rebuild), --add, --remove, --check.

• Deterministic & idempotent — the wiki is a pure projection of commands.yaml. Re-running with no change writes nothing; add or remove a command and only the affected pages, tool pages and counts change.
• Safe by default — it shows what it will add / update / remove and asks before writing, and only edits commands.yaml through the guided add/remove flows.
• Zero setup — it reads commands.yaml from the repo root (or raw/commands.yaml if you use that layout), writes the vault to wiki/, and keeps its own tool registry and category blurbs in a wiki_config.yaml it creates on first run.
• Self-describing vault — on first run it also drops a CLAUDE.md (the wiki's spec/guide: schema, page format, LLM-retrieval guidance) beside the project if one isn't already there, and never overwrites an existing one. wiki/, wiki_config.yaml and CLAUDE.md are all generated, and all git-ignored by default — their committed source lives in the script (the _DEFAULT_META and _CLAUDE_MD templates) and in commands.yaml. Regenerate them any time. To change a blurb or the spec, edit the template in the script and commit that; to make the vault browsable on GitHub, drop wiki/ from .gitignore.

More detail

Full documentation for the builder — the two modes, placeholders and session defaults, adding your own commands, and how the imported sources were selected, normalised, and can be refreshed — lives in MANUAL.md.

License

Released under the GNU General Public License v3.0 — see LICENSE.

This project bundles command data derived from other public projects, two of which (GTFOBins and WADComs) are themselves GPL-3.0. That copyleft is why the whole project is GPL-3.0, and a permissive license would not be compatible.

Credits & sources

Imported commands are derived from the public projects below — reworded, turned into {PLACEHOLDER} templates, filtered, and re-categorised into this tool's schema (each imported entry carries a source: tag). Please respect each source's terms.

Source	License	Link
GTFOBins	GPL-3.0	https://gtfobins.github.io/
WADComs	GPL-3.0	https://wadcoms.github.io/
LOFLCAB	GPL-3.0	https://lofl-project.github.io/
LOLAD	no stated license (see note)	https://lolad-project.github.io/
StationX Nmap Cheat Sheet	proprietary article (see note)	https://www.stationx.net/nmap-cheat-sheet/

• LOLAD publishes no explicit license; only short, factual AD command examples were used, reworded and placeholdered.
• The StationX nmap sheet is a copyrighted article, not open source — only the factual nmap commands were used as a reference, none of its prose. See MANUAL.md for exactly how each source was selected and normalised.