🔴 dotfiles-Offense

The offensive role layer — recon → exploit → evasion, on any OS-native layer.
Explore the docs »

Red ↔ Blue · Report Bug · Request Feature

Table of Contents

1. About The Project
   • Languages
   • Tools
2. Getting Started
3. What's In This Layer
4. Contributing
5. License
6. Contact

About The Project

dotfiles-Offense is the offensive Role layer — the red twin of dotfiles-Defense. The shared Core (zsh, tmux, Neovim, git, starship, mise) is vendored under core/ via git subtree; your OS-native layer owns packages, clipboard and paths; and this repo adds the offensive stage on top — engagement scaffolding and workspace workflow for authorized engagements.

It is distro-agnostic and installs nothing by default. ./bootstrap.sh wires symlinks and reports which offensive tools the box already has; --install is the opt-in. The OS half of this repo — the apt base list, the pinned out-of-band installs, the WSL bootstrap, the zsh/git/ssh overlays — moved to dotfiles-Debian, which now accepts ID=kali as a first-class target.

The one rule that matters: this is a public showcase repo, so engagement and client data never live in it. Everything goes under ~/engagements/ (outside any git tree); the paranoid .gitignore is only a backstop. Every tool here is for authorized work with written rules of engagement — the scope-first scaffolding exists to keep that discipline mechanical.

The full docs live on the documentation site; the defensive mirror is dotfiles-Defense.

The system is three layers; this repo is the third:

Layer	Lives in	Owns
Core	dotfiles-core, vendored under core/	zsh, tmux, nvim, git, starship — identical everywhere
OS-native	a separate repo — dotfiles-Debian for Kali/Debian/Ubuntu	package manager, clipboard, paths
Role (offensive)	offensive/ — this repo	engagement scaffolding + workspace workflow

Languages

• 

Tools

• 
• 
• 
• 

(back to top)

Getting Started

Prerequisites

An OS-native layer already installed, and Git. Kali is the box this is built for — install dotfiles-Debian first and it will provision it. Any other Debian-family box works too; the tool report will just be shorter.

Running Kali under WSL2? It is NAT'd by default, so a listener / reverse shell / C2 isn't reachable from your LAN until you enable mirrored networking in the Windows-side %UserProfile%\.wslconfig (networkingMode=mirrored, Win11 22H2+) — not /etc/wsl.conf. The example file lives in dotfiles-Debian/wsl/.

Installation

# 1. the OS-native layer (skip if you already run one)
git clone https://github.com/dotgibson/dotfiles-Debian ~/dotfiles-Debian
~/dotfiles-Debian/bootstrap.sh

# 2. this role layer
git clone https://github.com/dotgibson/dotfiles-Offense ~/dotfiles-Offense
cd ~/dotfiles-Offense
./bootstrap.sh                 # symlinks + the host-tool report; installs nothing
./bootstrap.sh --install       # opt-in: the offensive tool stack

core/ is a vendored subtree and is already present in a clone — there is no submodule step. Flags: --install (the opt-in tool install — apt from install/offensive-packages.txt on Kali, a pipx/go subset elsewhere), --links-only (just re-create symlinks), --no-check (skip the host-tool report), --dry-run.

(back to top)

What's In This Layer

The offensive stage loads after os and before local (… os offensive local) — band 85, linked as 85-offensive.zsh — so your OS layer's paths and clipboard resolve first and a machine override still wins:

• offensive/offensive.zsh — the role-stage helpers (mkengagement, eng, logshell, nmapsweep, bhce, …), each HAVE_*-guarded — no exploit code
• offensive/hacktheplanet, ippsec, exploitdev, evasion — the vim-folded field references (htp / ipp / xdev / evade)
• offensive/companion/ — the ATT&CK-tagged red↔blue corpus, a vendored subtree of htpx (browsed with htpx)
• PURPLE-TEAM.md — the defensive mirror of hacktheplanet (Splunk/Sentinel)
• install/tools.lst — the host-tool probe list; install/offensive-packages.txt — the apt list --install uses on Kali only
• core/ — vendored from dotfiles-core (read-only here; edit upstream)

The tradecraft — the phase → ATT&CK → tool map, the OPSEC hygiene, and the tools that bite (nxc/NetExec, BloodHound CE) — is written up on the hub:

→ Offensive methodology · dotfiles-Offense on the hub

(back to top)

Contributing

This is a Role layer stacked on Core + an OS layer, so two vendored trees are off-limits and the rest is the offensive stage:

1. Never hand-edit core/ or offensive/companion/. Both are vendored subtrees (dotfiles-core and htpx), overwritten on the next sync. Fix them upstream, then re-sync.
2. Offensive config goes in the offensive stage, not in core/. If it's identical everywhere it's Core; if it changes with the OS it's the OS layer.
3. Keep the discipline. No payloads, loot, or targets in the repo; scope and authorization come first. Green the gates — make lint && make test (shellcheck + bash -n / zsh -n + markdownlint; vendored trees excluded).

Full details, including how to sync either subtree and what the engagement-data guards actually enforce, are in CONTRIBUTING.md. Run make with no target for the list of entry points.

Bugs and ideas: open an issue. Security reports go through private vulnerability reporting — see SECURITY.md.

(back to top)

License

Distributed under the MIT License. See LICENSE for more information.

(back to top)

Contact

Garrett Allen - @gerrrrt - garrettallen2@gmail.com - LinkedIn

Project Link: dotgibson

(back to top)