The Toolkit

Webapps

Not every essential tool is something you install. Some of the most useful resources in security live on the web — a data-transformation workbench, a search engine for exposed devices, a breach-lookup service — and Oniomarchy treats them as first-class citizens rather than bookmarks you have to remember. Each one is installed as a proper application launcher with its own icon, so it opens in its own window and shows up in the menu next to everything else.

They’re grouped under Security → Webapps, and they complement the installed tools: the OSINT sites sit right beside Information Gathering, CyberChef beside Reverse Engineering, and so on.

Reconnaissance & OSINT

Webapp	What it’s for
Shodan	Search engine for internet-connected devices and services.
Censys	Another perspective on internet-wide host and certificate data.
Have I Been Pwned	Check email addresses and passwords against known breaches.
PimEyes	Reverse face-search across the web.
urlscan.io	Scan and analyze what a URL actually loads and does.
OSINT Framework	A curated directory of OSINT resources, by category.

Web & exploitation

Webapp	What it’s for
revshells.com	Generate reverse-shell one-liners for any language and listener.
Exploit-DB	The web front end to the public exploit archive.
GTFOBins	Unix binaries that can be abused to break out or escalate.
LOLBAS	The Windows equivalent — living-off-the-land binaries and scripts.
SSL Labs	Deep analysis of a site’s TLS configuration.
ATT&CK Navigator	Map and annotate techniques against the MITRE ATT&CK matrix.

Analysis & forensics

Webapp	What it’s for
CyberChef	The “cyber Swiss Army knife” — encode, decode, and transform data.
VirusTotal	Scan files and URLs against dozens of antivirus engines.
any.run	Interactive malware sandbox in the browser.

Radio

Webapp	What it’s for
KiwiSDR Public Receivers	Directory of public networked SDRs to listen through.
SIGIDWiki	The signal-identification guide — figure out what you’re hearing.
WiGLE	The global database of wireless networks, mapped.

How they got there

These are installed with Omarchy’s own webapp install mechanism, so each becomes a real desktop launcher — icon fetched automatically, opens in its own window, and searchable in the menu like any other app. They open in your default browser; for the OSINT and recon sites especially, that pairs well with routing through Tor or the hardened browser.