The catalogue site for windowsWTF — a maintained, reversible, auditable offensive Windows build, plus a debloat/privacy layer for real Windows machines.
Static, no build step, no third-party requests. Preact and htm are vendored in
assets/vendor and resolved by an import map; fonts are self-hosted. It serves straight
from GitHub Pages.
index.html entry point
assets/app.js the whole app (Preact + htm, no JSX, no bundler)
assets/app.css the macWTF/androidWTF visual system, retuned for Windows
assets/fonts/ self-hosted Space Grotesk, Instrument Serif, JetBrains Mono
assets/vendor/ preact, preact/hooks, htm
data/tools.json generated — do not hand-edit
data/packs.json curated pack definitions
scripts/build_catalogue.py
data/tools.json is generated from the windowsWTF repo's own catalog/bundles/*.yaml,
so the site cannot drift from the installer. With the two repos side by side:
python3 scripts/build_catalogue.pyOr pass the engine repo explicitly:
python3 scripts/build_catalogue.py ../windowsWTFNeeds pyyaml. Re-run it whenever a bundle changes and commit the result.
The one field the site adds. The YAML carries profiles and requires_vm; the site
turns those into four tiers, because on Windows the question is not what a tool can do
but where it is safe to put it.
| Tier | Name | Means |
|---|---|---|
| 0 | Bare metal | Ships on minimal/dev/hardened. Safe on a daily driver. |
| 1 | Exclusions | Benign, but Defender quarantines it. Needs an exclusion path. |
| 2 | VM only | Offensive tradecraft — AD, credential access, privesc. |
| 3 | Isolated lab | requires_vm in the catalogue. C2 and payload development. |
Tiers 2 and 3 map onto bundles and the requires_vm flag the engine really does check.
Tiers 0 and 1 are the site's own reading of the catalogue.