Exegol for Offensive Security

Overview

Exegol is a Docker-based pentest environment with 100+ pre-installed offensive tools, managed via a Python CLI wrapper. It replaces traditional Kali VMs with fast, reproducible, disposable containers.

Core concept: exegol start <name> <image> creates a ready-to-hack container in seconds. All tools, resources, and configurations are pre-loaded.

For the complete CLI reference, images list, and resource catalog, see exegol-reference.md in this skill directory.

When to Use

• User needs to set up a pentest/red team environment
• User wants to launch tools available in Exegol (BloodHound, Burp, Responder, CrackMapExec, etc.)
• User is doing HTB, CTF, or lab work and needs a quick environment
• User asks about container-based offensive security setups
• User needs to manage multiple engagement environments simultaneously

When NOT to use: For defensive/blue team tooling, forensics-only workflows, or general Docker questions unrelated to security testing.

Quick Reference

Task	Command
Start interactive container	exegol start mypentest full
Start with workspace	exegol start client1 full -w ./engagement/
Start with current dir	exegol start client1 full -cwd
Start with VPN	exegol start htb full --vpn ~/vpn/lab.ovpn
Start with logging	exegol start client1 full -l -w ./engagement/
Run single command	exegol exec mypentest 'nmap -sV 10.10.10.1'
Run GUI tool in background	exegol exec -b mypentest burpsuite
Temp container for one-off	exegol exec --tmp full 'whatweb http://target'
List containers/images	exegol info
Stop container	exegol stop mypentest
Remove container	exegol remove mypentest
Install an image	exegol install full
Update everything	exegol update

Engagement Setup Workflow

1. Choose the Right Image

Image	Use Case
full	General pentest, full toolkit (50GB+)
ad	Active Directory / internal pentest
web	Web application testing
light	Quick recon, limited disk space
osint	OSINT / reconnaissance only
free	Same as full but community edition (delayed releases)

2. Create the Engagement Container

# Standard engagement setup with workspace and logging
exegol start <engagement-name> <image> -w /path/to/engagement/ -l

# Example: Internal AD pentest
exegol start acme-internal ad -w ./acme-corp/ -l

# Example: Web app pentest
exegol start webapp-audit web -w ./webapp-audit/ -l

# Example: HTB lab with VPN
exegol start htb full --vpn ~/vpn/htb-lab.ovpn -w ./htb/

3. Network Configuration

Scenario	Config
Host network (default)	No flag needed, shares host interfaces
VPN to target network	--vpn ~/path/to/config.ovpn
VPN with credentials	--vpn config.ovpn --vpn-auth creds.txt
Isolated container	--network disable
Container-to-container	--network docker
Port forwarding	-p 8080:8080 -p 4444:4444

4. Privilege Options for Specific Attacks

# WiFi / network sniffing (needs NET_ADMIN)
exegol start wifi full --cap NET_ADMIN -d /dev/bus/usb/

# USB device access (Proxmark, Rubber Ducky, etc.)
exegol start hw full -d /dev/ttyACM0

# Full privilege (use sparingly)
exegol start lab full --privileged

Pentest Workflow Patterns

AD / Internal Pentest

# Create container with AD image
exegol start internal ad -w ./client-engagement/ -l --vpn client-vpn.ovpn

# Inside container:
neo4j start                              # Start Neo4j for BloodHound
bloodhound-ce                            # Launch BloodHound CE (port 1030)
crackmapexec smb 10.0.0.0/24             # Network discovery
responder -I eth0                        # LLMNR/NBT-NS poisoning
bloodhound-python -d domain.local -u user -p pass -c All  # Collect AD data

Default credentials inside container:

Service	User	Password
Neo4j	neo4j	exegol4thewin
BloodHound CE	via web UI	exegol4thewin
Empire	empireadmin	exegol4thewin

Web Application Pentest

# Create container with web image
exegol start webapp web -w ./webapp-audit/ -l

# Inside container:
burpsuite                                # Launch Burp Suite (proxy on 8080)
nuclei -u https://target.com             # Automated vuln scanning
sqlmap -u "http://target/page?id=1"      # SQL injection testing
ffuf -u http://target/FUZZ -w /opt/resources/...  # Directory fuzzing

Recon / OSINT

exegol start recon osint -w ./recon/

# Inside container:
subfinder -d target.com                  # Subdomain enumeration
httpx -l subdomains.txt                  # HTTP probing
theHarvester -d target.com -b all        # Email/domain harvesting

Privilege Escalation (Using Built-in Resources)

Resources are available at /opt/resources inside every container:

Resource	Path	Purpose
LinPEAS	/opt/resources/linux/linPEAS/	Linux privesc enumeration
WinPEAS	/opt/resources/windows/winPEAS/	Windows privesc enumeration
Mimikatz	/opt/resources/windows/mimikatz/	Windows credential extraction
Chisel	/opt/resources/linux/chisel/	TCP/UDP tunneling
ligolo-ng	/opt/resources/linux/ligolo-ng/	Network pivoting
SharpHound	/opt/resources/windows/SharpHound/	AD collection
PrintSpoofer	/opt/resources/windows/PrintSpoofer/	Windows privesc
GodPotato	/opt/resources/windows/GodPotato/	Windows privesc
netcat (static)	/opt/resources/linux/nc	Reverse shells

# Serve resources to target via HTTP
cd /opt/resources && python3 -m http.server 8888

# Or transfer specific tool
python3 -m http.server -d /opt/resources/linux/linPEAS/ 8888

Multi-Container Engagements

Run parallel containers for different phases or targets:

# Recon container
exegol start recon-phase osint -w ./engagement/recon/

# Attack container with VPN
exegol start attack full --vpn client.ovpn -w ./engagement/attack/ -l

# C2 container
exegol start c2 full -p 443:443 -p 80:80 -w ./engagement/c2/ -l

Switch between containers by spawning new shells:

exegol start attack      # Opens new shell in existing "attack" container

Credential Management (exegol-history)

# Add credentials found during engagement
exh add creds -u 'admin' -p 'P@ssw0rd!' -d 'ACME.LOCAL'
exh add creds -u 'svc_sql' -H 'aad3b435b51404eeaad3b435b51404ee:...' -d 'ACME.LOCAL'

# Set active credentials as environment variables
exh set creds

# Add discovered hosts
exh add hosts --ip 10.10.10.1 -n dc01 -r "Domain Controller"
exh add hosts --ip 10.10.10.5 -n web01 -r "IIS Web Server"

# View current context
exh show

# Bulk import
exh import creds --file found_creds.csv --format CSV

Logging & Evidence

# Enable logging at container creation
exegol start engagement full -l -w ./engagement/

# Logs are stored in /workspace/logs/ (asciinema format by default)
# Replay a session:
asciinema play /workspace/logs/session.cast

Logging methods:

• asciinema (default) — records terminal sessions, replayable
• script — raw terminal recording

Customization (my-resources)

Personal configs persist across all containers via ~/.exegol/my-resources/:

Path	Purpose
bin/	Custom tools (auto-added to $PATH)
setup/zsh/aliases	Custom shell aliases
setup/zsh/history	Custom command history
setup/python3/requirements.txt	Python packages to auto-install
setup/apt/packages.list	APT packages to auto-install
setup/bloodhound/customqueries_merge/	BloodHound custom queries
setup/firefox/policies.json	Firefox extensions, bookmarks
setup/load_user_setup.sh	Custom setup script (runs on first start)

Common Mistakes

Mistake	Fix
Trying to modify container config after creation	Container options are set at creation only. Remove and recreate.
Forgetting -l for logging	Always use -l on real engagements for evidence
Using --privileged everywhere	Use specific --cap flags instead (e.g., --cap NET_ADMIN)
Not setting workspace	Always use -w to persist data outside the container
Running out of disk space	full image is 50GB+. Use light or ad/web for focused work
VPN not working	VPN auto-switches to docker network mode. Check with exegol info <container>
GUI apps not displaying	Ensure X11 is not disabled. On macOS, install XQuartz.