ONINET is a licensed, containerized offensive security platform built for professional penetration testers and red teams. One command gives you a full XFCE desktop accessible through your browser, pre-loaded with over 100 industry-standard tools.
Each engagement gets its own structured workspace with dedicated directories for ops, loot, evidence, and logs. Every terminal session is automatically recorded. Credentials are stored in an AES-256 encrypted vault that never leaks to recordings.
Heavy tools like BloodHound, Metasploit, and Burp Suite run in isolated satellite containers — pulled on demand, started in seconds, and stopped when you're done. No bloat in your main workspace.
Runs on Linux, Windows (WSL2), and macOS. Works offline for 30 days. Built by operators, for operators.
Get your license key and activate with oninet activate. Verified in seconds.
Download the ONINET image. Cached locally — works offline for 30 days.
oninet run gives you a full desktop + 100 tools via your browser.
Heavy tools in isolated containers. sat start bloodhound — done.
XFCE desktop in your browser via noVNC. Firefox, terminal, file manager — zero local install.
AES-256-GCM encrypted vault with auto-lock, shell integration, and GUI access.
nmap, masscan, rustscan, nuclei, httpx, subfinder — the full stack, pre-configured.
BloodHound, netexec, impacket, ldapsearch, certipy — complete AD attack chain.
AWS, Azure, GCP CLIs plus ScoutSuite and cloudfox. Multi-cloud from one workspace.
Shared folders, operator naming, concurrent containers. Work together without collisions.
Custom hostnames, dropped capabilities, network isolation. Blend in by design.
Heavy tools in isolated containers. Pull only what you need. Update independently.
OpSpace survives restarts. Ops, loot, evidence, logs — structured and persistent.
AES-256-GCM encrypted storage for captured credentials. Shell integration, GUI access, auto-lock. Works even when the container is stopped.
Create scoped engagements with structured workspaces: ops, loot, evidence, logs. Track operators, dates, and generate summaries.
Every terminal session is recorded with asciinema. Replay in-terminal, search across recordings, extract commands. Vault-entered passwords are never captured.
Heavy tools in isolated containers. Auto-login, bridge networking, on-demand pull. Start and stop independently — zero bloat in your main workspace.
Generate engagement summaries with credential counts, session timelines, satellite usage. Markdown reports ready for your deliverables.
Sync your container clock to a Domain Controller for Kerberos attacks. Continuous background sync with skew monitoring — prompt shows live status.