Documentation

Everything Oniomarchy installs, wires up, and gets out of your way about — the toolkit, the privacy layers, and the machine underneath.

Start Here

What Oniomarchy Is
A beautiful, opinionated Linux workstation for security work — Omarchy's craft, pointed at offense.
Installing
One script, run on a stock Omarchy system. What it needs, what it does, and what a run looks like.
Finding Your Way Around
The menu map — where the tools, services, and quick actions live, and how the menu shows each tool's help first.

The Layers
How Oniomarchy thinks about privacy — as independent layers you combine, not a single "anonymous mode".
Tor & the Network
Route the whole machine or just the browser through Tor — with a kill switch, exit-country choice, and a leak check.
MAC & Your Hardware
Randomize the hardware address your network card broadcasts, so you're not trackable across networks.
The Hardened Browser
A Firefox configured to forget everything on exit, hide who you are, and be ready to intercept — sitting alongside your normal browser.
Secrets & Disk
Protecting data at rest — a password manager for your credentials and encrypted volumes for your loot.

Running Services
Toggle the servers you sometimes need — SSH, RDP, database, web, BeEF — with a confirmation before you expose anything.
Quick Attack Actions
The one-keystroke versions of the rituals that start every engagement — a listener, a file server, and proxy-CA trust.

Mapping hosts, services, domains, and people before you touch anything deeper. Most engagements start here.

Turning "these services exist" into "these services are weak" — automated scanning for known flaws.

Testing web applications directly — intercepting proxies, injection scanners, and fuzzers.

Cracking hashes offline and guessing credentials online — plus the wordlists that feed both.

Auditing Wi-Fi — capturing handshakes, cracking keys, and monitoring the airwaves.

Turning cheap radio hardware into a receiver for almost anything on the airwaves.

Taking software apart — disassemblers, decompilers, and the tools for reading what a binary really does.

Turning a discovered weakness into access — frameworks, exploit databases, and payload builders.

Watching and manipulating network traffic — packet capture and man-in-the-middle attacks.

What you do once you're in — credential harvesting, lateral movement, and command-and-control.

Recovering, examining, and analyzing evidence — memory, disks, files, and the data hidden inside them.

Capturing findings and turning them into deliverables — notes, screenshots, and organized results.

Attacking the human layer — phishing campaigns, credential harvesting, and pretext delivery.

Talking to vehicles — reading and writing the CAN bus that runs a modern car.

Security work at the intersection with AI — MCP servers that give agents real tooling, and a scanner for LLMs themselves.

The best web-based security tools, installed as first-class app launchers — no browser bookmark hunting.