![](.extras/assets/sl-hack-ware.jpg) # Sl (hack) ware ### a Slackware GNU/Linux Pentesting Suite The aim of this project is to bring a curated collection of programs, tools, libraries and various utilities, ~~packaged~~ (some packages are way too big, sorry) and ready to be installed on Slackware. ### Why Slackware Because it's the best distro ever. ### We have Kali and/or Parrot Yes, but I prefer Slackware. ## Packages List This list is ever growing, if you want to ask for a package to be prioritized, just open an issue Legend: ✅ yes / available / build-tested   ❎ not on SlackBuilds.org   ❔ not yet tested | Package Name | SlackBuilds.org available | Upstream | Version | Tested -current | Tested -stable | | -------------------- | ------------------------- | ------------------------------------------------------------ | ---------- | --------------- | -------------- | | SecLists | ✅ | [danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) | 2026.1 | ✅ | ❔ | | ffuf | ✅ | [ffuf/ffuf](https://github.com/ffuf/ffuf) | 2.1.0 | ✅ | ❔ | | gobuster | ✅ | [OJ/gobuster](https://github.com/OJ/gobuster) | 3.8.2 | ✅ | ❔ | | hashcat | ✅ | [hashcat.net](https://hashcat.net/hashcat/) | 7.1.2 | ✅ | ❔ | | john | ✅ | [openwall.com](https://www.openwall.com/john/) | 1.9.0 | ✅ | ❔ | | exploitdb | ✅ | [exploit-db.com](https://www.exploit-db.com/) | 2026-04-30 | ✅ | ❔ | | cadaver | ✅ | [notroj/cadaver](https://notroj.github.io/cadaver/) | 0.28 | ✅ | ❔ | | nuclei | ✅ | [projectdiscovery/nuclei](https://github.com/projectdiscovery/nuclei) | 3.8.0 | ✅ | ❔ | | feroxbuster | ❎ | [epi052/feroxbuster](https://github.com/epi052/feroxbuster) | 2.13.1 | ✅ | ✅ | | netexec | ❎ | [Pennyw0rth/NetExec](https://github.com/Pennyw0rth/NetExec) | 1.5.1 | ✅ | ❎ | | windows binaries | ❎ | [kali.org](https://www.kali.org/tools/windows-binaries/) | 0.6.10 | ✅ | ❔ | | webshells | ❎ | [kali.org](https://www.kali.org/tools/webshells/) | 1.1 | ✅ | ❔ | | metasploit framework | ❎ | [metasploit.com](https://www.metasploit.com/) | 6.4.135 | ✅ | ✅ | > [!IMPORTANT] > > The exploitdb package pulls also the binsploits which consists of 1.1Gb of exploits. > [!NOTE] > > There's a metasploit package on slackbuilds.org but is an older version (last updated in 2022). I'll contact the mantainer and ask to transfer it to me and I'll update it. > > The cadaver package is available on slackbuilds.org but it's for an older version. I've reported here the script and built the newest version. The slackbuild includes now a pull from the [notroj/neon](https://github.com/notroj/neon) repository which is usually not allowed for SlackBuilds that are uploaded to slackbuilds.org > > The Powershell package is available on slackbuilds.org without modifications necessary so I removed it. ## Git Hooks This repo ships maintainer git hooks under `.extras/hooks/`. After cloning, install them with: ```bash cp .extras/hooks/* .git/hooks/ && chmod 0755 .git/hooks/{pre,post}-commit ``` - **pre-commit** lints each changed package with `sbolint` and blocks the commit on errors. It also refuses staged source archives (these are fetched with `sbodl`, never committed). Bypass linting with `SBOLINT=no git commit`. - **post-commit** offers to build an SBo submission tarball (`SBo/.tar.gz`) for any added or updated package. To answer the prompt non-interactively, set `SBO_ARCHIVE=yes` or `SBO_ARCHIVE=no` in the environment. ## Building an SBo archive on demand `.extras/mksboarchive ` builds the same `.tar.gz` SBo submission tarball the post-commit hook produces, but on demand by name rather than at commit time: ```bash .extras/mksboarchive feroxbuster # writes ./feroxbuster.tar.gz OUTPUT=/tmp .extras/mksboarchive hydra # writes /tmp/hydra.tar.gz ``` Run it from the repo root: it looks for a `/.SlackBuild` below the current directory, removes any `sbodl` source symlinks from the package directory first (so they never leak into the tarball), then archives the directory. The output directory defaults to the current working directory and can be overridden with the `OUTPUT` environment variable. This means it works the same whether you run `.extras/mksboarchive` or an installed copy (e.g. in `~/bin`), as long as you are in the repo root. ## Vendored Crates (Rust packages) Rust packages such as `feroxbuster` build from a vendored crates tarball (`--vendor.tar.gz`) declared as a second source in the `.info` file, alongside the upstream tarball. The SlackBuild unpacks it, points cargo at it via `.cargo/config.toml`, and builds fully offline (`cargo build --offline --locked`). This mirrors how SlackBuilds.org packages Rust (and Go) software. SBo builds must be reproducible from the checksummed sources declared in `.info` and run in a clean chroot with no network access. Letting cargo fetch from crates.io at build time would break that: builds would depend on crates.io being reachable and unchanged, and the SBo build farm (which runs offline) would reject the package. The vendor tarball is generated once per version with `cargo-vendor-filterer` and hosted by the maintainer. `SOURCE_DATE_EPOCH` is pinned to the upstream release tag's commit date so the archive is byte-for-byte reproducible: ```bash tar xf feroxbuster-.tar.gz && cd feroxbuster- export SOURCE_DATE_EPOCH="$(date -u -d '' +%s)" cargo vendor-filterer \ --platform=x86_64-unknown-linux-gnu \ --prefix=vendor \ --format=tar.gz \ feroxbuster--vendor.tar.gz ``` The tag commit date comes from the GitHub API (`commits/` → `.commit.committer.date`). Then update `MD5SUM_x86_64` for the new tarball in the `.info` file. The exact command is also recorded in the package's own `README`.