Features • Supported commands • Installation • Usage • Documentation • Join us on Discord !

secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters and security researchers.

• Curated list of commands

• Unified input options

• Unified output schema

• CLI and library usage

• Distributed options with Celery

• Complexity from simple tasks to complex workflows

• Customizable

secator integrates the following tools:

Feel free to request new tools to be added by opening an issue, but please check that the tool complies with our selection criterias before doing so. If it doesn't but you still want to integrate it into secator, you can plug it in (see the dev guide).

pipx install secator

pip install secator

wget -O - https://raw.githubusercontent.com/freelabz/secator/main/scripts/install.sh | sh

docker run -it --rm --net=host -v ~/.secator:/root/.secator freelabz/secator --help

alias secator="docker run -it --rm --net=host -v ~/.secator:/root/.secator freelabz/secator"

secator --help

git clone https://github.com/freelabz/secator
cd secator
docker-compose up -d
docker-compose exec secator-client secator --help

Note: If you chose the Bash, Docker or Docker Compose installation methods, you can skip the next sections and go straight to Usage.

secator --help

To get a complete cheatsheet of what you can do with secator, please read the output of:

secator cheatsheet

Run a fuzzing task (ffuf):

secator x ffuf http://testphp.vulnweb.com/FUZZ

Run a url crawl workflow:

secator w url_crawl http://testphp.vulnweb.com

Run a host scan:

secator s host mydomain.com

To list all tasks / workflows / scans that you can use:

secator x --help
secator w --help
secator s --help

To figure out which languages or tools are installed on your system (along with their version):

secator health

secator supports shell completion for bash, zsh, and fish. This provides auto-completion for:

• Task names (e.g., nmap, httpx, nuclei)
• Workflow names (e.g., url_crawl, subdomain_recon)
• Scan names (e.g., host, domain, network)
• CLI options like --profiles, --workspace, --driver, --output

To install shell completion:

Bash:

secator util completion --shell bash --install
source ~/.bashrc

Zsh:

secator util completion --shell zsh --install
source ~/.zshrc

Fish:

secator util completion --shell fish --install

After installation, you can use tab completion:

secator task n<TAB>     # completes to nmap, naabu, nuclei, etc.
secator w url_<TAB>     # completes to url_crawl, url_fuzz, url_dirsearch, etc.
secator x nmap --profiles ag<TAB>  # completes to aggressive

secator auto-installs tools when you first use them. You can prevent this behavior by setting security.autoinstall_commands to false using either secator config set security.autoinstall_commands false or SECATOR_SECURITY_AUTOINSTALL_COMMANDS=0.

To install all tools, you can still run:

secator install tools

Addons are available for secator, please check our docs for details.

For instance, using the mongodb addon allows you to send runner results to MongoDB.

To go deeper with secator, check out:

• Our complete documentation
• Our getting started tutorial video
• Our Medium post
• Follow us on social media: @freelabz on Twitter and @FreeLabz on YouTube