Cybersecurity
Mode

Introduction

Cybersecurity Mode is a dedicated security workstation environment designed for HackerOS. It provides a unified graphical interface for both offensive security professionals (penetration testers, red teamers) and defensive security practitioners (auditors, blue teamers), running all tools inside an isolated BlackArch Linux Podman container.

The application is designed to run as a dedicated TTY session (similar to Steam's Gamescope session) launched via cage, providing a clean, distraction-free security workspace. It can also be launched inside an existing desktop session.

Architecture

Cybersecurity Mode is built from three separate compiled components that work together:

Components

Communication Flow

cybersec (CLI)
    │
    ├── launches cybersec-mode-main (GUI)
    │       │
    │       ├── connects via Unix socket ──► cybersec-mode-backend (Rust)
    │       │       │
    │       │       └── manages ──► Podman Container (BlackArch Linux)
    │       │                           └── security tools (nmap, metasploit, …)
    │       │
    │       └── embeds ──► Terminal Panel ──► shell inside container
    │
    └── direct commands ──► container exec / podman / system

Operational Modes

On first launch (or every launch if configured), Cybersecurity Mode asks you to select an operational mode. This determines which tools are prominently displayed and sets the visual theme accent color.

Switching Modes

You can switch modes at any time using:

• Hacker Menu → Change Mode in the GUI
• cybersec set-mode red or cybersec set-mode blue from the CLI

Startup Behavior

In Settings → Always ask mode at startup, you control whether the mode selection dialog appears every time. If disabled, Cybersecurity Mode remembers your last choice.

Requirements

System Requirements

Runtime Dependencies

Installing

For HackerOS

hacker unpack cybersecurity-mode

This command will fetch and install the precompiled Cybersecurity Mode package directly on your HackerOS system.

Container Setup

All security tools run inside a BlackArch Linux Podman container. The container is created automatically when you click Start Container in the Main panel, or you can manage it manually.

Manual Container Management

# Pull the BlackArch image manually
podman pull blackarchlinux/blackarch

# Create the container (done automatically by the app)
podman run -d \
  --name cybersec-mode-env \
  --privileged \
  --network host \
  --cap-add NET_ADMIN \
  --cap-add NET_RAW \
  -v /home:/home:rw \
  blackarchlinux/blackarch \
  sleep infinity

# Open a shell inside the container
podman exec -it cybersec-mode-env bash

# Install additional tools
podman exec -it cybersec-mode-env pacman -S metasploit burpsuite

Persistent Tool Data

Tool configurations and output files can be stored in /home/<user> which is bind-mounted into the container. Results saved to /home persist across container restarts.

Main Panel

The Main panel is the central dashboard showing available security tools for the currently selected mode. It displays tool cards, container status, and provides quick-launch access.

• Tool Cards — Click the ▶ button on any tool card to open it in the terminal
• Search — Filter tools by name using the search box (top right)
• Container Status — Shows if the BlackArch container is running with a Start/Stop button
• Mode title — Changes between "⚔ Offensive / Pentest" and "🛡 Defensive / Audit"

Terminal Panel

The Terminal panel provides an embedded shell connected directly to the BlackArch container. It uses bash by default (configurable in Settings).

Features

• Command history with ↑/↓ arrow key navigation
• Output scrollback buffer (10,000 lines)
• Clear button to reset output
• New terminal button (opens additional session)
• Direct container shell — commands run inside BlackArch

Shell Environment

# The terminal connects to:
podman exec -it cybersec-mode-env bash

# All BlackArch tools are available:
nmap --version
msfconsole --version
sqlmap --version

Docs Panel

The Docs panel provides in-app reference documentation organized by topic. It is designed to be beginner-friendly while remaining useful for experienced practitioners.

Documentation Categories

• Getting Started — Welcome guide, first steps, container setup
• Penetration Testing — Reconnaissance, exploitation, web testing, post-exploitation
• Defensive Security — Network monitoring, system hardening, incident response
• CLI Reference — Complete cybersec CLI documentation

Settings Panel

All user preferences are stored in ~/.cache/HackerOS/Cybersecurity-Mode/config.json.

Available Settings

Hacker Menu

The Hacker Menu is accessible from the ⚡ Hacker Menu button in the bottom-left corner of the application. It provides quick access to system actions.

cybersec CLI Reference

The cybersec binary is installed at /usr/bin/cybersec.

CLI Examples

# Start a Cybersecurity Mode session from a TTY (e.g. Ctrl+Alt+F2)
cybersec

# Open the GUI inside your current KDE/GNOME session
cybersec please

# Check everything is working
cybersec status

# Run nmap directly in the container
cybersec exec 'nmap -sV 192.168.1.0/24'

# Run a full update (shows live output in terminal)
cybersec update

# Switch to blue mode permanently
cybersec set-mode blue

# List installed plugins
cybersec plugin list

IPC Protocol

The GUI communicates with the Rust backend via newline-delimited JSON-RPC over a Unix domain socket.

Request Format

{"method": "container_status", "params": {"name": "cybersec-mode-env"}}

Response Format

{"ok": true, "result": {"name": "cybersec-mode-env", "running": true, "state": "running"}}
{"ok": false, "error": "Container not found"}

Available RPC Methods

Plugin System

Plugins extend Cybersecurity Mode with additional tools, documentation pages, and UI panels. Plugin metadata is stored as JSON files in ~/.cache/HackerOS/Cybersecurity-Mode/plugins/.

Plugin Manifest Format (planned)

{
  "name": "my-plugin",
  "version": "1.0.0",
  "description": "Adds custom recon tools",
  "author": "security-researcher",
  "tools": ["amass", "subfinder"],
  "docs": "docs/recon-advanced.html",
  "panel": "panels/recon.py"
}

Configuration Reference

Config file: ~/.cache/HackerOS/Cybersecurity-Mode/config.json

{
  "mode": null,
  "always_ask_mode": true,
  "theme": "dark_gray",
  "font_size": 13,
  "terminal_font": "JetBrains Mono",
  "terminal_font_size": 13,
  "shell": "bash",
  "container_engine": "podman",
  "container_image": "blackarchlinux/blackarch",
  "container_name": "cybersec-mode-env",
  "backend_socket": "/tmp/cybersec-mode-backend.sock",
  "session_mode": false,
  "show_welcome": true,
  "sidebar_collapsed": false,
  "log_level": "INFO",
  "keybindings": {
    "toggle_terminal": "Ctrl+T",
    "toggle_docs":     "Ctrl+D",
    "toggle_main":     "Ctrl+M",
    "toggle_settings": "Ctrl+,",
    "hacker_menu":     "Ctrl+H"
  }
}

Paths & Directories

Key runtime paths for Cybersecurity Mode:

• User config: ~/.cache/HackerOS/Cybersecurity-Mode/config.json
• Logs: ~/.local/share/HackerOS/Cybersecurity-Mode/logs/cybersec-mode.log
• IPC socket: /tmp/cybersec-mode-backend.sock
• Container home mount: /home inside container → host home

Default Keybindings

All keybindings are customizable in Settings → Keybindings.

Tool Reference

Red Mode Tools

Blue Mode Tools