Channel configures River input devices through the River input-management, libinput-configuration and XKB-configuration protocols. It reads profiles and matching rules from the River config.rh file, applying settings when devices appear or the configuration changes. It runs separately from the window manager and does not configure the system or start itself automatically.

wlr-randr is a utility to manage outputs of a Wayland compositor.

Xkbcommon is a library to handle keyboard descriptions, including loading them from disk, parsing them and handling their state. It is mainly meant for client toolkits, window systems, and other system applications; currently that includes Wayland, kmscon, GTK+, Qt, Clutter, and more. Despite the name, it is not currently used by anything X11 (yet).

Swaylock is a screen locking utility for Wayland compositors.

fuzzel is a Wayland-native application launcher, similar to rofi's drun mode. It has Emacs key bindings and remembers frequently launched applications. The font and colors can be configured.

Libinput is a library to handle input devices for display servers and other applications that need to directly deal with input devices.

River separates Wayland composition from window-management policy. This package builds River with Xwayland support and requires a separate window manager implementing river-window-management-v1. It is used by the XMonad Wayland nested test and does not configure a system session.

Lynis is a security auditing tool. It performs an in-depth security scan and runs on the system itself. The primary goal is to test security defenses and provide tips for further system hardening. It will also scan for general system information, vulnerable software packages, and possible configuration issues.

Nmap ("Network Mapper") is a network discovery and security auditing tool. It is also useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. It also provides an advanced netcat implementation (ncat), a utility for comparing scan results (ndiff), and a packet generation and response analysis tool (nping).

Arp-scan is a tool that uses ARP to discover and fingerprint IP hosts on the local network.

fping is a ping-like program which uses ICMP echo requests to determine if a target host is responding.

fping differs from ping in that you can specify any number of targets on the command line, or specify a file containing the lists of targets to ping. Instead of sending to one target until it times out or replies, fping will send out a ping packet and move on to the next target in a round-robin fashion.

Reaver performs a brute force attack against an access point's Wi-Fi Protected Setup (WPS) PIN. Once the PIN is found, the WPA passphrase can be recovered and the AP's wireless settings can be reconfigured.

Binwalk is a tool for analyzing, reverse engineering, and extracting firmware images.

This package provides a tool to demonstrate how easy it is to gain unauthorized access to a system by automatically attempting logins and passwords. It supports a wide range of protocols including SSH, SMTP and HTTP.

whois searches for an object in a WHOIS (RFC 3912) database. It is commonly used to look up the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system. It can automatically select the appropriate server for most queries.

For historical reasons, this package also includes mkpasswd, which encrypts passwords using crypt(3) and is unrelated to the Expect command of the same name.

Aircrack-ng is a complete suite of tools to assess WiFi network security. It focuses on different areas of WiFi security: monitoring, attacking, testing, and cracking. All tools are command-line driven, which allows for heavy scripting.

mtr combines the functionality of the traceroute and ping programs in a single network diagnostic tool. mtr can use several network protocols to detect intermediate routers (or hops) between the local host and a user-specified destination. It then continually measures the response time and packet loss at each hop, and displays the results in real time.

This package provides a wireless network and device detector, sniffer, wardriving tool, and WIDS (wireless intrusion detection) framework. Kismet works with Wi-Fi interfaces, Bluetooth interfaces, some SDR (software defined radio) hardware like the RTLSDR, and other specialized capture hardware

Netdiscover is a network address discovery tool developed mainly for wireless networks without a DHCP server. It also works on hub/switched networks. It is based on ARP packets, it will send ARP requests and sniff for replies.

Radare2 is a complete framework for reverse-engineering, debugging, and analyzing binaries. It is composed of a set of small utilities that can be used together or independently from the command line.

Radare2 is built around a scriptable disassembler and hexadecimal editor that support a variety of executable formats for different processors and operating systems, through multiple back ends for local and remote files and disk images.

It can also compare (diff) binaries with graphs and extract information like relocation symbols. It is able to deal with malformed binaries, making it suitable for security research and analysis.

Proxychains-ng is a preloader which hooks calls to sockets in dynamically linked programs and redirects them through one or more SOCKS or HTTP proxies.

This package implements file encryption according to the https://age-encryption.org/v1 specification. It features small explicit keys, no configuration options, and Unix-style composability. This package provides a command line interface (CLI) tools.

SDB is a simple key/value database based on djb's cdb disk storage that supports JSON and array introspection.

Rizin is a reverse engineering framework and a set of small command-line utilities, providing a complete binary analysis experience with features like disassembler, hexadecimal editor, emulation, binary inspection, debugger, and more.