fsociety

  /$$$$$$                              /$$             /$$
 /$$__  $$                            |__/            | $$
| $$  \__//$$$$$$$  /$$$$$$   /$$$$$$$ /$$  /$$$$$$  /$$$$$$   /$$   /$$
| $$$$   /$$_____/ /$$__  $$ /$$_____/| $$ /$$__  $$|_  $$_/  | $$  | $$
| $$_/  |  $$$$$$ | $$  \ $$| $$      | $$| $$$$$$$$  | $$    | $$  | $$
| $$     \____  $$| $$  | $$| $$      | $$| $$_____/  | $$ /$$| $$  | $$
| $$     /$$$$$$$/|  $$$$$$/|  $$$$$$$| $$|  $$$$$$$  |  $$$$/|  $$$$$$$
|__/    |_______/  \______/  \_______/|__/ \_______/   \___/   \____  $$
                                                               /$$  | $$
                                                              |  $$$$$$/
                                                               \______/

Offensive security plugins for Claude Code

Plugins • Getting Started • How It Works • Adding a Plugin

A growing suite of Claude Code plugins for offensive security. Each plugin is a self-contained toolkit targeting a specific domain of penetration testing — web apps, reverse engineering, opsec, leak hunting, and beyond. One repo, multiple weapons, all conversational.

[!CAUTION] Authorized testing only. Always obtain written authorization before testing any target. Unauthorized access to computer systems is illegal. The authors assume no liability for misuse.

Plugins

Plugin	Domain	Description
elliot	Web & Application Security	Full offensive lifecycle — recon, scan, exploit, weaponize, report. 24 commands, 9 skills, 2 agents
romero	Reverse Engineering	Windows binary analysis, decompilation, malware classification. 10 commands, 5 skills, 1 agent
trenton	Operational Security	Machine hardening, VPS security, anti-forensics, footprint elimination. 12 commands, 5 skills, 2 agents
tyrell	Leak Database Hunting	Exposed database discovery, data acquisition, cross-plugin pipeline to elliot. 16 commands, 5 skills, 2 agents
fsociety	Engagement Setup	Interactive workspace wizard — targets, goals, scope, plugin selection, OPSEC profiles
dom	Mobile & IoT	Planned — Android/iOS testing, API interception, firmware analysis

Specialized Agents

Each plugin ships with AI agents designed for autonomous multi-step operations:

Agent	Plugin	Role
darlene	elliot	Campaign orchestrator — plans and runs multi-phase attack campaigns
scout	elliot	Reconnaissance — maps attack surface before exploitation
cipher	romero	Reverse engineering orchestrator — drives binary analysis workflows
ghost	trenton	Opsec orchestrator — multi-phase machine hardening
cleaner	trenton	Anti-forensics specialist — trace removal and footprint elimination
joanna	tyrell	Leak hunter — multi-source exposed database discovery
scott	tyrell	Acquisition specialist — probe, dump, convert, and pipeline data

Getting Started

Prerequisites

• Claude Code with MCP support
• Hexstrike MCP server on Kali Linux (or compatible)
• Node.js 18+

Installation

Add the fsociety marketplace, then install the plugins you need:

claude plugin marketplace add ogrodev/fsociety
claude plugin install elliot@fsociety

No cloning, no build step, no dependencies.

[!TIP] You can install multiple plugins at once. Each plugin is independent — install only what you need.

Quick Start

Initialize an engagement workspace with the setup wizard:

/setup my-operation

The wizard walks you through targets, goals, scope, and plugin selection. It generates a tailored workspace:

File	Purpose
engagement.json	Central config — targets, plugins, opsec level, scope
CLAUDE.md	Tailored guidance with only your active plugin commands
scope.md	Formal scope definition
targets.jsonl	Structured target list (append-only, SHA256-deduped)

OPSEC Profiles

Choose a profile that matches your engagement's anonymity requirements:

Profile	Speed	Anonymity	Use Case
surface	Maximum	None	Lab / CTF environments
standard	Moderate	Basic	Authorized external tests
paranoid	Slow	Full (Tor/VPN)	Red team engagements

How It Works

fsociety is not a Node.js application — there's no build step, no package.json, no test suite. It's a Claude Code plugin marketplace: a collection of markdown-driven plugins that extend Claude Code with offensive security capabilities.

Plugin Anatomy

Every plugin follows the same structure:

plugin-name/
├── plugin.json           # Plugin definition (name, version, skills, agents)
├── CLAUDE.md             # Plugin-specific guidance for Claude Code
├── commands/*.md         # Slash commands with YAML frontmatter
├── skills/*/SKILL.md     # Auto-activating skills with reference docs
├── agents/*.md           # Agent definitions with YAML frontmatter
├── scripts/*.js          # Node.js scripts (zero npm deps, stdlib only)
└── hooks/hooks.json      # Lifecycle hooks wiring scripts to events

Key Design Decisions

• Zero dependencies — all scripts use only Node.js built-ins (fs, path, crypto, child_process)
• Markdown-driven — commands, skills, and agents are .md files with YAML frontmatter
• Plugin isolation — no cross-plugin imports or shared scripts
• JSONL for data — append-only JSONL files for findings, techniques, and intel
• SHA256 deduplication — all trackers deduplicate by hashing normalized key fields

Repository Structure

fsociety/
├── .claude-plugin/
│   └── marketplace.json       # Plugin registry
├── elliot/                    # Web & Application security
├── romero/                    # Reverse engineering
├── trenton/                   # Operational security
├── tyrell/                    # Leak database hunting
├── fsociety/                  # Engagement setup & orchestration
├── CLAUDE.md
└── LICENSE

[!NOTE] See each plugin's own README.md for its complete command reference, data layer, and conventions