​

Toolkit

Each audit runs in a fresh darkops sandbox — a hardened Linux environment with the offensive security toolkit pre-installed and ready. Golem has full bash access to all of these tools. The sandbox is provisioned per-audit and destroyed at completion. No state leaks between engagements.

​

Reconnaissance & scanning

​

Content discovery & fuzzing

​

Vulnerability scanning

​

TLS

​

Custom probes (/opt/giga/)

Purpose-built probes for high-frequency checks, exposed to the agent as discrete tools:

​

Traffic capture & exploitation support

​

Egress shaping

proxychains4 and tor are available for chain routing when an engagement calls for it.

​

Wordlists

Pre-loaded at /opt/darkops/wordlists/ (also at /usr/share/wordlists/): common.txt, big.txt, subdomains-5k.txt, subdomains-20k.txt, passwords-10k.txt, usernames.txt, sqli-payloads.txt, xss-payloads.txt, rockyou.txt.

​

Browser

The sandbox includes a full Chrome installation plus selenium for any interaction that requires a real browser — JavaScript-heavy SPAs, complex auth flows, CSRF token handling.

​

Python libraries

requests, beautifulsoup4, lxml, dnspython, pycryptodome, selenium, scapy are pre-installed for custom exploit scripting.

​

Notable exclusions

The image deliberately omits tools that don’t fit the external-web attack surface: no Burp Suite or ZAP, no internal-network/AD attack tooling in the active toolkit, and no commercial threat-intel CLIs. Golem can install additional tools on demand within an engagement when a specific check calls for it.

​

Next steps