Gameplans

Obliquity uses reusable gameplans to describe what should run and in what order. Each gameplan contains one or more stages with defined tools, wordlists, extensions, recursion depth, filters, request limits, and output settings. Feroxbuster handles recursive directory and file discovery, while ffuf handles parameter, API, header, cookie, method, and request-body fuzzing.

Hashcat

The planned Hashcat integration will add hash identification and cracking workflows using dictionary, rule, mask, and hybrid attacks. Before execution, Obliquity can count wordlist entries, estimate requests and duration, display per-stage and overall progress, and record which operation, target, tool, and wordlist combination has already run. Built-in testing lists and user-selected wordlists are supported, while project history and coverage tracking help reduce repeated work and preserve results across multiple sessions.

Feroxbuster and Ffuf

Feroxbuster and ffuf are the currently integrated discovery engines, with Hashcat intended as the third primary engine. Obliquity's adapter-based design also allows Gobuster, Wfuzz, and John the Ripper to be supported as optional alternatives:

Gobuster for focused directory, DNS, and virtual-host discovery. Wfuzz for flexible request and parameter fuzzing and John for additional password-cracking formats and workflows.

Regardless of the underlying tool, Obliquity's goal is to provide the same project structure, gameplan system, wordlist management, progress feedback, execution history, coverage visibility, interruption handling, and consolidated reporting experience.

Interfaces & Drivers

Muon auto-detects your USB wireless adapter, matches it against a chipset database covering RTL8812AU, RTL8814AU, RTL8822BU, MT7612U, MT7961U, AR9271, and over a dozen other common chips, and can install the correct driver automatically via apt or a git clone and build. It also brings interfaces up and down, toggles monitor mode, and auto-detects the resulting monitor interface name (like wlan1mon) on every entry — so a renamed interface never silently breaks the rest of your session.

Command Library

A scrollable library of 100+ prebuilt commands spans 15 categories — scanning, monitor mode, packet injection, cracking, traffic capture, Kismet, Bettercap, and WPS attacks among them. Selecting a command drops it into a full keyboard line editor with arrow keys, Home/End, and word-delete shortcuts, so it's editable without retyping the whole thing — the difference between a usable workflow and a nightmare when you're working off a phone screen.

Session Variables

Interface names, target BSSID, channel, SSID, and wordlist path are all tracked as session variables and substituted into every command automatically. Scan a network once and every attack command from deauth to handshake cracking already has the right target and interface filled in — no retyping MAC addresses or manually swapping wlan1 for wlan0 between commands. It also supports managing multiple cards at once and surfaces both public and private IPs at a glance.

Muon also includes session projects that save and restore your full working state — interface, variables, mode, watchdog settings — as JSON, a watchdog that keeps a connection alive and can lock to a specific SSID, and a Pi-Tail keepalive mode for gadgets that need to stay tethered to a hotspot. A built-in help and troubleshooting guide covers common adapter and driver issues along the way.

It runs in two modes depending on privilege: full mode with root access on Kali NetHunter, Kali Linux, or a Raspberry Pi, and a limited mode for non-rooted Android through Termux, where root-only actions stay visible but grayed out instead of disappearing.

Campaign Builder

Pretext walks the analyst through a five step wizard that assembles a full campaign in one pass. You enter the client and target details first, then choose a login page from a library of over fifty templates, then pick a matching email template from twenty eight options. The wizard recommends login pages, email templates, and MFA pages that already work well together, and you can preview, download, or copy any piece before saving the campaign.

Email Preview

One of the most useful pieces is the email preview, which shows exactly how a phishing email will render in a Gmail or Outlook inbox, in both light and dark mode, on desktop and mobile. Pretext also tailors the generated email copy to the target's role, so an email aimed at an executive reads differently than one aimed at a graphic artist. Seeing the subject line, sender, and body the way a real recipient would helps the analyst judge whether the pretext actually holds up before it goes out.

Landing Pages and Domains

The login page library includes fully custom designs where you set the company name, logo, subtitle, and support email, plus over forty cloned templates covering major platforms like Microsoft, Google, and Facebook. A built in page cloner can also pull down a live URL and save a local copy for the library. Alongside the page builder, Pretext includes a phishing domain helper that suggests plausible lookalike domains based on the target organization's name, useful for planning the pretext before any infrastructure gets stood up.

Seven MFA page templates cover common providers like Microsoft Authenticator, Duo, Okta, and Google 2 Step, and the wizard auto selects the right one based on the login page chosen. All submissions from login and MFA pages route to a shared capture endpoint that logs timestamp, IP address, and submitted fields for later review.

Pretext only generates content. It does not send emails or manage delivery, so the output is meant to be exported into infrastructure like GoPhish, Evilginx, or King Phisher, and it is built strictly for authorized social engineering engagements with documented scope and consent.

As of version 2.0.0, Pretext also ships as a standalone Electron desktop app for Windows, Mac, and Linux, so it runs as a native window with no PHP or Docker setup required. The browser based Docker and PHP deployment paths are still there if you prefer them.

Tech Detection

Ecliptic detects over 1,500 technologies across more than 30 categories, powered by the same webappanalyzer signature database that Wappalyzer uses, running entirely on-device. Detection merges three layers at once: HTTP response headers, HTML source analysis, and live JavaScript globals probed through Android WebView, so it catches technologies a single layer would miss. Major CMS platforms and payment card brands are grouped intelligently instead of listed as noise.

Security and Network Recon

A dedicated audit tab scores ten critical security headers like Content Security Policy, HSTS, and X-Frame-Options, showing full values for what's present and flagging what's missing. The Network tab pulls TLS certificate details, live DNS records, ASN and organization lookups, and extracted social links, while the Recon tab layers in WHOIS and RDAP data, robots.txt, security.txt, and sitemap.xml, plus a direct link to the Wayback Machine archive for the scanned URL.

HTTP Repeater

Ecliptic includes a built in HTTP repeater with both a raw request editor and a visual wizard mode, pre populated from whatever was just scanned. Requests and responses expand to fullscreen independently, with syntax colored output and quick add chips for common headers like User Agent, Authorization, and Content Type, making it easy to poke at an API or endpoint without leaving the app.

Every scan is saved automatically, up to 50 at a time, so past results can be browsed with simple back and forward navigation and exported later as a full styled HTML report. API detection covers REST, GraphQL, OpenAPI, SOAP, gRPC, and JSON RPC, and the whole app can be triggered straight from Chrome's share sheet for an instant scan of whatever page you're looking at.

Ecliptic is built natively in Kotlin with Jetpack Compose, and everything runs on-device through OkHttp and a real Chromium WebView, with no backend server involved anywhere in the process. It is currently available as a direct APK install, with a Google Play release planned.

Massive File Viewer

Entropy can open and scroll through wordlists that are normally impossible to load in a text editor, handling files with 30 million or more lines while using under 100MB of RAM. A 14 million line rockyou.txt loads in under two seconds, and regex powered search highlights and jumps between matches directly inside the viewer instead of falling back to head and tail on the command line.

Wordlist Generator

The generator works like the Mentalist app, starting from a base wordlist, which can be a language dictionary or any existing list, and building it up through a chain of transformations. Prefixes, suffixes, and geographic data like states, zip codes, countries, and phone area codes can all be layered in, along with common male and female names, pet names, keyboard patterns, and dictionaries for a dozen or so languages including English, German, French, Spanish, Chinese, Japanese, Arabic, and Russian.

Hashcat Rules and Torque

A rule preview feature shows exactly how a hashcat rule set like best64 or OneRuleToRuleThemAll mutates a single word, so you can see the transformation instead of guessing at it. The Torque tab was actually the inspiration for Obliquity, it lets you build gameplans that chain together multiple wordlist, rule, and file extension combinations, then generates a bash script that runs the whole sequence one step at a time.

A statistics tab runs analysis on any wordlist, covering length distribution and pattern detection, useful for understanding what's actually inside a list before spending time cracking against it. Every tab keeps its own independent zoom level with keyboard shortcuts, which matters more than it sounds like once you're staring at a few million lines of text.

Entropy is written in Rust with a native GTK4 and libadwaita interface, and it only runs on Linux. It draws direct inspiration from the Mentalist for wordlist generation, CyberChef for chaining operations together, and Midnight Commander for the dual pane feel of the interface.