Arsenal-NG: The Go-Powered Command Launcher Every Pentester Should Know

There's a class of problem in security that sounds trivial until you're in the middle of an assessment at 2am: you know the tool you need, you know roughly what it does, but you can't remember the exact flag syntax. Arsenal-NG solves this with 2,872+ commands, fuzzy search, and a terminal UI that drops the right command directly into your shell.

What Arsenal-NG Is

Arsenal-NG is a Go rewrite of the original Arsenal project — a command launcher for cybersecurity professionals. It's not a framework, not a scanner, and not a C2. It's a searchable cheat sheet that lives in your terminal and outputs ready-to-run commands.

The core workflow:

1. Type a keyword (tool name, technique, protocol) in the fuzzy search
2. Browse results with syntax highlighting and tag filtering
3. Select a command — argument placeholders are pre-filled with sensible defaults
4. The command lands in your terminal input buffer, ready to edit and run

242+ tools, 2,872+ commands, zero external dependencies, instant startup. It's written in Go with the Bubble Tea TUI framework, runs on Linux and macOS natively (Windows via WSL), and ships as a single binary.

Why This Matters for Security Teams

The surface-level value is obvious: faster command recall. The deeper value is consistency under pressure. When an analyst is triaging an active incident or a pentester is mid-assessment, cognitive load is high. Tools that reduce the "what was that flag again?" friction keep people in flow and reduce the chance of a typo that corrupts evidence or misses a finding.

For team leads, Arsenal-NG's YAML-based cheat sheet format means you can add your org's custom tooling and share it across the team as a versioned artifact. Your internal pentest playbook becomes searchable and executable from the same interface as the public commands.

What CISOs Should Know About This Tool

Arsenal-NG will show up in your red team's toolkit. Here's what that means:

• It's not an attack tool — it's a command reference. The actual attack capability comes from the tools it references (nmap, sqlmap, Metasploit, etc.).
• It normalises red team workflow — standardised command sets mean more consistent testing coverage and more comparable results between assessments.
• The YAML cheat sheets are auditable — if you want to know what commands your red team has in rotation, this is a single file to review.
• Open source, MIT licence — no vendor dependency, easy to fork for internal use.

The Bigger Picture: Tooling That Matches Attacker Speed

Attackers don't hesitate over flag syntax. They have their own cheat sheets, their own command libraries, their own automation. Tools like Arsenal-NG are part of closing the speed gap — letting defenders and testers operate at attacker pace rather than stopping to Google every command.

This is the same principle behind PlayCISO's War Room scenarios: the goal isn't just knowing the right answer, it's being able to recall and act on it under pressure, in the time available. Speed of decision matters as much as quality of decision.

Check it out: github.com/halilkirazkaya/arsenal-ng

---

Want to test your own decision speed under incident pressure? Run a free War Room scenario →