How to use fsociety: install, run the menu and tips

What fsociety is and who it is for

fsociety is a collection of security testing scripts packaged together under one menu. The README groups them into areas such as information gathering, password attacks, wireless testing, web hacking and post-exploitation.

The project is meant for people who want to run these tools against systems they are allowed to test. It suits security students who want to read and run classic pentest scripts in one place, and penetration testers with explicit written permission.

• Good fit: security students, penetration testers with written permission, people studying how common web and network attacks are scripted
• Poor fit: anyone without written permission to test a target, beginners who need guidance on each tool, users who need Python 3 support

Check the requirements before you install

The README describes fsociety as a Python 2 project and badges it as Python 2.7. It says the tools are tested on Linux, OSX, Windows and Android. It also points to a separate Python 3 fork at fsociety-team/fsociety.

For the script-based install you need a Linux shell, Termux on Android, or Cygwin on Windows with Python. For the Docker route you need Docker and docker-compose.

• Python 2.7 (per the README badge and description)
• Docker and docker-compose if using the Docker route
• Termux on Android, or a Linux shell, for the script-based install

Install fsociety on Linux or Termux

On Linux, or in Termux on Android, the README gives a single one-line install command. Run it in your terminal. Review what the command does before running it, because it downloads and executes a script from the internet.

Run fsociety with Docker

The README's Docker route uses docker-compose. Build the image, start the container in the background, then open the fsociety menu inside it. The last command shuts the instance down and destroys it.

Run these commands from the directory that holds the project's docker-compose file.

• docker-compose build builds the image
• docker-compose up -d starts the container in the background
• docker-compose exec fsociety fsociety opens the menu inside the container
• docker-compose down stops and destroys the instance

Navigate the fsociety menu

The menu lists categories such as Information Gathering, Password Attacks, Wireless Testing, Exploitation Tools, Sniffing and Spoofing, Web Hacking, Private Web Hacking and Post Exploitation. Each category holds short tool names.

The README gives only short names and little documentation for each tool. Read each tool's own source or documentation before running it, and confirm the target is one you are permitted to test.

• Information Gathering includes Nmap, WPScan, XSStrike and Crips
• Password Attacks includes Cupp and Ncrack
• Wireless Testing includes Reaver and Pixiewps
• Exploitation Tools includes sqlmap and Commix
• Post Exploitation includes POET and Weeman

Understand the limits before you rely on it

The README shows no release history, and the project is a bundle of third-party tools. Expect to maintain and verify each component yourself. Because the README says the version works with Python 2, check the Python 3 fork if your environment requires Python 3.

Use these tools only on systems you own or have explicit written permission to test. Attacking systems without permission is illegal.

• No release history is shown in the README
• Documentation is short; check each bundled tool
• Python 3 users should look at fsociety-team/fsociety