Turn Fedora into a pentest machine.

?What exactly is Pendora?

A modular installation framework and configuration template that turns a standard Fedora Linux install into a full penetration testing and security assessment VM — Kali's toolset and workflows, running natively on Fedora's RPM/DNF, Wayland, and systemd ecosystem.

?Why was Pendora developed?

Honestly? I wanted a familiar environment. Kali is great, but I enjoy Fedora far more — and since my host runs Fedora with Hyprland, I wanted that same feeling in my pentest VM. Manually reinstalling every package after a fresh setup, with no snapshots or backups to fall back on, was exactly the problem Pendora solves. I also wanted to give something back to the open-source community — and somewhere around that point, the idea of Pendora was born.

?Who is Pendora made for?

Penetration testers and red teamers who want a complete assessment VM through a repeatable install; students and CTF players learning on professional tooling in an isolated QEMU/KVM sandbox; Fedora users who want Kali's toolset without leaving DNF, Wayland, and systemd behind; and homelab or blue-team folks who need the networking packages plus SysReptor and BloodHound CE on localhost.

?Do I need to wipe my Fedora install or dual-boot?

No. Pendora runs as a single script, ./install.sh, on top of an existing Fedora installation. Everything is organized into plain-text lists you can read and edit before running anything. It's built and tested for a QEMU/KVM VM — snapshot your VM and you can always roll back.

?Will installing Sway remove my GNOME desktop?

Never. Installing Sway adds a second session — GNOME stays exactly where it is. Switch between the two at the GDM login screen, any time.

?Which install mode should I pick?

--basic if you want to keep your GNOME desktop and just get the tooling (recommended). --sway for a standalone Sway/Noctalia desktop with base packages and shell/editor configuration — it does not install the complete pentest toolkit. --all combines Basic and Sway in a single pass.

?What are the system requirements?

Baseline: 4 vCPU, 4 GB RAM, 25 GB disk. Recommended: 8 vCPU, 8 GB RAM, 35–50 GB. The install footprint is roughly 11 GB, with 18–19 GB peak usage during installation. Use up-to-date Fedora Workstation in a virt-manager/QEMU/KVM VM with internet access. BloodHound CE needs about 8 GB RAM.

?What do I get running out of the box?

131 native Fedora RPMs, 11 Pipx-isolated Python tools (netexec, impacket, certipy-ad, bloodhound-ce, updog, sqlmap…), standalone upstream suites including Responder, and containers — SysReptor on http://localhost:8000, BloodHound CE on http://localhost:8080, Portainer CE on https://localhost:9443 — plus Kali-style Zsh, Alacritty, and Neovim/LazyVim. SysReptor and BloodHound need starting after reboot; Portainer auto-starts.

?Can I add my own tools?

Yes — that's the point. Edit package lists in pkg-lists/ and pipx-lists/, installers in upstreams/, and shell dotfiles in zsh/. Comment out a package line to skip it; deleting it from a list does not uninstall an existing tool. Use -c to select categories, --file for a custom list, --pipx for Python tools, or --docker for the engine and container suites. Edit them directly, or use the suggest-tool form on the tools page to open a pre-filled GitHub issue.

?Does Sway resize when I resize the VM viewer?

Not yet. Sway uses a configured 1080p desktop; dynamic SPICE viewer resizing remains under investigation. Use GNOME at the GDM login screen if you need automatic display resizing. Bidirectional host/guest clipboard sharing in Sway is resolved and verified; removing a redundant bridge launch is still planned.

?How should I prepare, and how long does installation take?

Snapshot and update your Fedora VM first with sudo dnf upgrade --refresh -y. Run as your regular user, never sudo ./install.sh. Review ./install.sh --list and ./install.sh --all --dry-run before installing. A full install typically takes 15–30 minutes, with sudo prompts and credential cards; large downloads can appear idle. --yes automates the run and reboots afterward unless --no-reboot is added.

?Are the new roadmap tools available yet?

Not yet: ADWS Domain Dump, Nuclei, Coercer, and Oh My Pi are planned additions. The automated --test / --verify harness, uninstall/cleanup, and offline deployment are also still planned. The roadmap checkboxes distinguish open tasks from completed work.

?Is it production-ready?

The project is in beta: all three install modes are verified on Fedora Workstation VMs, while wider tool and container testing continues. Use master or a published release; the beta branch is unstable and can receive script-breaking changes without notice. Parts of the project were developed with AI assistance, and some upstream modules execute vendor scripts directly — inspect everything before running, and use entirely at your own risk.

$ pendora faq --list | 13 entries · more in the README▊