Fsociety Hacking Tools Pack: All-in-One Pentest Framework for Lab

In the offensive-security community, one of the best-known “all-in-one” frameworks — primarily for educational use and quick demos — is the Fsociety Hacking Tools Pack. It is an open-source toolkit inspired by the Mr. Robot TV series that bundles dozens of recon, scanning, exploitation, and post-exploitation tools under a single menu. In this article we look at what it does, where it fits in an authorized engagement, and most importantly when it is not the right choice.

Legal & ethical scope: Fsociety bundles active scanning, exploitation, and phishing tools. Use it exclusively against lab VMs (DVWA, Metasploitable, OWASP Juice Shop, TryHackMe and HackTheBox boxes), against your own domains, or inside an engagement that you have explicit written authorization for. Any other use may constitute a criminal offense.

What Fsociety is

The Fsociety Hacking Tools Pack (maintained by Manisso on GitHub) is a CLI framework written in Bash and Python that acts as a “wrapper menu” over dozens of existing open-source tools. It does not invent new techniques — it just provides a quick menu for a broad range of typical pentest tasks.

It is one of the easiest-to-use educational frameworks for anyone starting out in pentesting, because it offers an overview of which tools exist at each phase of the kill chain. In mature engagements, however, most professionals prefer using each tool directly — see the discussion at the end.

Where it fits in the methodology

Fsociety’s menu maps almost 1-to-1 onto the Cyber Kill Chain and the MITRE ATT&CK tactics:

• Information Gathering — Reconnaissance (TA0043)
• Password Attacks — Credential Access (TA0006)
• Wireless Testing — Initial Access (TA0001)
• Exploitation Tools — Execution (TA0002) / Exploitation (TA0004)
• Sniffing & Spoofing — Collection (TA0009)
• Web Hacking — Initial Access against web apps
• Post-Exploitation — Persistence (TA0003) & Lateral Movement

The 10 menu modules

1. Information Gathering

Wrapper for: Nmap, SETToolkit, Host To IP, WPScan, CMS scanner, XSStrike, Dork (Google Dorks), Server User Scanner, Crips. This category aligns with the phase covered by the other articles in the Information Gathering category.

2. Password Attacks

Wrapper for Cupp (custom wordlist generation) and Ncrack (network authentication cracking). Use only against authorized credentials.

3. Wireless Testing

Reaver, Pixiewps, Bluetooth Honeypot. Use only against your own access points or against lab devices that you have permission to test.

4. Exploitation Tools

SQLMap, ATSCAN, Shellnoob, Commix, FTP Auto Bypass, JBoss Autopwn. Execute only against intentionally vulnerable VMs (Metasploitable, DVWA, vulnhub boxes).

5. Sniffing & Spoofing

SETToolkit, SSLStrip, pyPISHER, SMTP Mailer. Phishing simulations belong inside internal awareness campaigns coordinated with management — never as ad-hoc tests against employees.

6. Web Hacking

Drupal/WordPress/Joomla scanners, BruteX, Arachni. Same rule: only against applications you own or that fall under written authorization.

7. Private Web Hacking

Various scanners — server info, control panel finder, Cloudflare bypass. Use only in lab or authorized scope.

8. Post-Exploitation

Shell Checker, POET, Weevely. Persistence and shell management after you have legitimately obtained access to a lab system.

9 & 10. Contributors / Install & Update

Maintenance entries.

Installation on a Kali Linux lab VM

# 1) Clone repository
git clone https://github.com/Manisso/fsociety.git
cd fsociety

# 2) Install dependencies
chmod +x install.sh
sudo ./install.sh

# 3) Run framework
./fsociety.py

On the first menu screen you will see an ASCII banner inspired by Mr. Robot and 10 numbered options. Each option leads to a submenu of the matching tools.

Example flow in a CTF lab

Scenario: you have a DVWA VM at 192.168.56.101 and a Metasploitable at 192.168.56.102 on a host-only network.

1. Recon: Menu 1 → Nmap → 192.168.56.0/24 → list live hosts and services.
2. Web scan: Menu 6 → WordPress Scanner or Arachni → http://192.168.56.101/dvwa/.
3. Exploitation: Menu 4 → SQLMap → DVWA login form.
4. Post-exploit: If you obtain a shell, Menu 8 → Weevely for a persistent webshell inside the lab.

All of these steps can also be performed individually with the same tools directly from the CLI. Fsociety just sequences the flow.

Pros and cons

Pros	Cons
Fast intro to dozens of tools	Several tools bundled in the repo are outdated
Good for beginner training	Not maintained at the same pace as the upstream tools
Single menu instead of 30+ CLI commands	Professionals prefer direct CLI for real engagements
Covers the whole kill chain	Some modules are low-quality “glue scripts”

When it is not the right choice

• Real engagements: Use Nmap, Burp Suite, SQLMap, etc. directly — better control, better output, better tuning.
• Low-noise red team work: Default settings are noisy — prefer targeted queries.
• When you need reproducibility: Many Fsociety modules produce output that varies by version. Direct CLI is more stable for the report.

Defensive / Blue team perspective

• Network IDS rules: Suricata and Snort ship signatures for the default User-Agents and scan patterns of many tools wrapped by Fsociety.
• Web Application Firewall: A properly tuned ModSecurity or Cloudflare WAF will block the default payloads from SQLMap, XSStrike, and similar tools.
• Honeypots: T-Pot, Cowrie, and OpenCanary trivially catch default Fsociety scans.
• Phishing detection: Awareness training combined with DMARC, SPF, and DKIM is the most effective countermeasure against SETToolkit / pyPISHER campaigns.

Best practices

• Use it only inside lab VMs or under written authorization.
• Always read what each sub-tool actually does before running it — do not be a “script kiddie”.
• After training, graduate to direct CLI for professional engagements.
• Keep updated versions of the underlying tools (./install.sh plus manual updates).
• Record every action with timestamps in the pentest report.

Summary

The Fsociety Hacking Tools Pack is a useful educational framework for quickly familiarizing yourself with the main tools of each pentest phase. For professional work, however, the more stable and flexible route is to use the underlying tools directly. In every case, never forget the basic rule: only within legal scope.

Next steps

• All Information Gathering articles
• Subdomain enumeration with Amass
• Recon-ng — Part 1
• External references: MITRE ATT&CK, OWASP WSTG.

For deeper training in ethical hacking, see the courses at Audax Cybersecurity Academy.