The Security Tools Menu

Oniomarchy adds a Security Tools category to Omarchy’s application menu, organized by tactic (Information Gathering, Vulnerability Analysis, Web Application Analysis, Password Attacks, Wireless Attacks, Software Defined Radio, Reverse Engineering, Exploitation Tools, Sniffing & Spoofing, Post Exploitation, Digital Forensics, Reporting Tools, Social Engineering Tools, Automotive, AI Tools) rather than by MITRE ATT&CK technique — a familiar, tool-first layout instead of a framework-first one.

CLI tools show help, not a live run

Clicking a CLI tool in the menu does not run it against a target. It opens a terminal showing the tool’s own usage/help text instead, plus the host machine’s real IP addresses (the thing you constantly need before pointing a tool at anything) and the exact command that was run.

This is deliberate: running many of these tools bare, with no arguments, either does nothing useful or actively fails — anything touching a raw socket (bettercap, for example) needs root and dies with a bare “Permission Denied” before printing anything at all. Showing help first means every entry in the menu is a safe, informative starting point rather than an accidental live action.

Each entry falls into one of four buckets, depending on what the tool itself actually supports:

  • Shows --help / -h / help output — the large majority of tools.
  • Shows the tool’s man page instead, for the handful with no help flag at all (dirb, nikto, rtl_power, rtl_adsb, wfuzz, besside-ng-crawler).
  • Re-runs under sudo for the few tools that refuse to print even their own usage as a normal user (airmon-ng, airodump-ng-oui-update, beef).
  • Starts the tool directly for servers and interactive frameworks where running is the useful action — setoolkit, rsf (RouterSploit), and similar.

GUI tools with a real desktop launcher (Wireshark, Ghidra, Burp Suite, and so on) launch directly, same as any other application — they’re not routed through the help-first behavior above, since clicking a GUI icon already does the right thing.

What’s below

The rest of this documentation lists every tool in each category, plus the webapp shortcuts, toggleable services, and plugin-based bar widgets that round out the pentest tooling. Source is always Arch’s official extra repository or the AUR — nothing here is name-guessed; every package is confirmed to actually exist before being added.