Overview 

Arsenal-NG is an interactive, terminal-based launcher that turns a sprawling collection of offensive-security tools into a single searchable command cheat-sheet. Instead of memorising flags or hunting through scattered notes, you search for a task, fill in your target details through guided prompts, and let the tool drop the finished command straight into your shell. This article demonstrates the complete workflow, from installation through executing a live Active Directory enumeration command against a lab domain controller.

Table of Contents:

• Introduction
• Installing Arsenal-NG
• Launching the Interface
• Browsing the Command Library
• Listing Every Available Tool
• Reading the Tools Table
• Inspecting a Single Tool
• Selecting a Command with a Live Preview
• Filling In the Arguments
• Executing the Command Against a Target
• Searching by Task Instead of by Tool
• Help and Global Variables
• Conclusion

Introduction

Penetration testers juggle hundreds of command-line tools, and each one carries its own syntax, flags, and quirks. Memorising every switch waste time and copying commands from scattered notes invites typos that break an engagement or, worse, hit the wrong target. Arsenal-NG attacks this problem head-on by acting as a fast, keyboard-driven front end that remembers the commands, so you do not have to.

At its core, Arsenal-NG maintains a large library of ready-to-run commands drawn from across the offensive-security toolset, spanning reconnaissance, enumeration, exploitation, wireless attacks, web testing, and Active Directory abuse. Each entry pairs a real command template with a plain-language description and a set of colour-coded tags, so you can locate the right technique by tool name or by intent. Templates use placeholder variables such as target, username, and password, which the tool resolves for you through an interactive argument form before execution.

The workflow stays entirely in the terminal. You search the catalogue in real time, highlight a command, review its live preview, supply the arguments once, and press Enter to run it in your active shell. Global variables push this further: you set a value like an IP address a single time, and Arsenal-NG auto-fills it everywhere that placeholder appears. Because the project ships as a standard package in the Kali Linux repositories, installation takes one command and pulls in the many tools it wraps. The sections below walk through that process step by step. 

Installing Arsenal-NG

Arsenal-NG ships as a standard package in the Kali Linux repositories, so a single APT command installs it along with the many offensive-security tools it wraps. Run the command below as root, and APT resolves and pulls in every dependency automatically.

apt install arsenal-ng

Launching the Interface

Once the installation finishes, you launch the tool by typing its name at the prompt. Arsenal-NG loads its command database and opens a full-screen interactive interface inside your terminal.

arsenal-ng

Browsing the Command Library

The main screen greets you with the Arsenal-NG banner and a search field at the top. Below it, the tool lists its entire command catalogue in real time. Each row shows the parent tool, a short description of the specific command, and a set of colour-coded tags such as web, security, pentest, reconnaissance, and enumeration. As you type in the search field, the list filters instantly, so you can narrow hundreds of entries down to the exact command you need within seconds. The screenshot below shows entries for 403bypasser, ad-miner, and aircrack-ng, each expanded into its distinct command variants.

Listing Every Available Tool

Rather than scrolling through commands one by one, you can view the complete inventory of supported tools. Type the keyword below into the search field, and Arsenal-NG prompts you to press Enter to reveal the full tool list. The status bar at the bottom also exposes the core keyboard shortcuts: arrow keys to navigate, set and unset for variables, and quick access to the tools, variables, and help screens.

tools

Reading the Tools Table

Pressing Enter renders a clean two-column table titled Available Tools. The left column names each tool, and the right column reports how many individual commands Arsenal-NG stores for it. This overview helps you gauge coverage at a glance. In the example below, bloodyad appears with fourteen commands, confirming strong support for that Active Directory attack utility.

Inspecting a Single Tool

To study one tool in depth, type its name into the search field. Arsenal-NG then displays every command it holds for that tool. Searching for bloodyad reveals its full range of LDAP-based Active Directory operations, including NTLM and Kerberos authentication, pass-the-hash, listing group members, adding a user to a group, setting a user password, and abusing shadow credentials. Each entry carries the privilege-escalation and authentication tags that describe its purpose.

bloodyad

Selecting a Command with a Live Preview

Arsenal-NG shines when you drill into a specific command. Searching for the NetExec LDAP module lists its many actions, from basic authentication to trust enumeration and ASREPRoast attacks. As you move the highlight bar over any entry, a preview panel at the top shows the exact command template and a plain-language explanation of what it does. Here the highlighted entry enumerates only active (enabled) domain users, and the preview confirms the underlying syntax with its placeholder variables.

nxc ldap

Filling In the Arguments

After you select a command, Arsenal-NG replaces its placeholder variables with an interactive argument form. You move between fields with Tab, type your target details, and watch the Command Preview at the top update as you go. In this example, the form collects the target IP address, the username, and the password for the domain enumeration command.

target   = 192.168.1.9
username = raj
password = Password@1

Executing the Command Against a Target

Pressing Enter drops the fully assembled command straight into your shell and runs it. No manual typing, no forgotten flags. The command below authenticates to the domain controller over LDAP and enumerates its user accounts. NetExec confirms the host as a Windows Server 2019 domain controller and returns thirty domain users from ignite.local, complete with each account’s last password-set date and bad-password count.

nxc ldap 192.168.1.9 -u raj -p Password@1 --users

Searching by Task Instead of by Tool

You do not need to know which tool performs a job. Arsenal-NG lets you search by intent, so a task-based query surfaces every relevant command across the whole toolset. Searching the phrase below returns matching options from drupwn, enum4linux-ng, impacket, NetExec, rpcclient, sqlmap, windapsearch, wpscan, and more. This intent-driven search turns Arsenal-NG into a living cheat-sheet that maps objectives to concrete commands.

enumerate users

Help and Global Variables

Typing help opens the built-in reference screen. It documents the navigation keys, the argument-input controls, and a powerful global-variables feature. By setting a variable once, you reuse it across every command that references it. For instance, you set an IP address a single time, and Arsenal-NG auto-fills the {{ip}} placeholder everywhere it appears, which removes repetitive typing during a long engagement.

set ip=10.10.10.10

Conclusion

Arsenal-NG streamlines the busywork around real penetration testing. It swaps memorised syntax for a searchable library, manual editing for guided argument forms, and copy-paste errors for one-key execution. Across this walkthrough, it carried us from a single APT install to a live LDAP enumeration that returned thirty domain users from a lab domain controller, without asking us to recall a single flag.

The value compounds as an engagement grows. The catalogue spans the whole offensive-security toolset, so reconnaissance, enumeration, exploitation, wireless attacks, web testing, and Active Directory abuse all sit behind one search field. Intent-based search means you need only know what you want to achieve, not which tool does it, and Arsenal-NG surfaces every matching command. Global variables kill repetitive typing, letting you set a target once and reuse it everywhere, while the live preview shows exactly what will run before you commit.

That control matters, because a launcher only accelerates the intent you bring. Run these commands only against systems you own or are authorised to test. Used responsibly, Arsenal-NG shifts your focus from syntax to the real work of an engagement, and for anyone juggling a broad toolset, it quickly earns a permanent place in the workflow.