The 0x00sec Package Manager: Agora! Introduction & How to use

(Leader & Offsec Engineer & Forum Daddy) #1

Hi all! Recently we have been able to get our own GitLab server, made possible by @L0k1! Since then we have moved all of 0x00sec’s project there. You can find us at

In this tutorial I will going over how to use Agora to get packages from NullHub.


So NullHub is a GitLab repo, inside this repo (as you will see) there are lots of JSON files. We call these files “Jasons”, affectively named by me and @Joe_Schmoe. Inside these files are essentially just a description of the package, and a git url to where we can find them. An example is DTM’s k3kbot

    "k3kbot": [{
        "description":"Badass Malware started by DTM",
            "@93aef0ce4dd141ece6f5 (dtm)"

When we run agora for the first time, it clones (Downloads) the repo, and imports the Jasons. When we install a package, it clones the git repo that is supplied in repo-url. It’s really that simple. When we run an update, it iterates through the installed packages and runs git pull. And of course, when we delete, it rm -r's the folder it got cloned into.

How to use Agora

First off, you’re going to want to clone the repo, ensuring you have git installed run

git clone

This will create a directory called “Agora”, type cd Agora.

On first run, Agora will detect that it is a new installation, and will automagically create the directories needed, and update the package list. To see a list of commands type

./agora -h

Now, you’re going to update your package list, so you can be sure everything is up to date.

./agora -y

This will update the Jason list. (In the image, I was fully up to date so it did nothing apart from check.)

Okay! Now you’re good to go! Lets see whats available…

./agora -l

(If you look next to “JavaSocketPortscan” notice the ‘[installed]’ label? This shows that I have that package installed. )

So, I’m in the mood for some 1337 DoS’ing (@dtm) , so I will try sockstress. Installing packages with Agora is as easy as

./agora -S sockstress

This is will download sockstress and put it in the Packages directory.

I could have found this tool equally by using the search function.

./agora -s dos

This will return all packages with “dos” either in the name or in the description. (another reason why agora is better than null-get)

To uninstall a package, just type

./agora -R sockstress

This will uninstall sockstress.

Submitting packages to NullHub

Submitting packages to NullHub is fairly simple once you get the hang of it. I won’t spoonfeed you it so what you need to do is - Fork NullHub, upload your Jason to your repo, make a pull request. You can generate Jasons with the genjason.rb script.

I hope this all helped you out! I look forward to seeing what packages get uploaded to NullHub!



(Leader & Offsec Engineer & Forum Daddy) closed #2

This topic was automatically closed after 30 days. New replies are no longer allowed.