diff --git a/blix.nix b/blix.nix
index 11caf01..e6f1a54 100644
--- a/blix.nix
+++ b/blix.nix
@@ -73,15 +73,16 @@ with lib;
     theharvester tor
 
     # disk analysis
-    testdisk squashfs-tools-ng ddrescue yara yarGen yallback spyre # volatility
+    testdisk squashfs-tools-ng ddrescue yara yarGen yallback
     stegseek apktool adbfs-rootless ursadb android-udev-rules
     valgrind dos2unix file exiftool foremost pngcheck ccrypt
     docker xcd trufflehog sleuthkit radare2 radare2-cutter
+    clamav spyre # volatility
 
     # exploit
     doona metasploit twa wifite2 burpsuite wpscan wfuzz
     sqlmap thc-hydra (callPackage ./pkgs/routersploit.nix { })
-    dsniff beef
+    dsniff beef dnschef
 
     # crack
     hashcat mfoc john crunch diceware crowbar # pyrit
diff --git a/manuals/blix-applications.7 b/manuals/blix-applications.7
index 0222bab..9699bd1 100644
--- a/manuals/blix-applications.7
+++ b/manuals/blix-applications.7
@@ -137,6 +137,8 @@ lovely hexdump utility
 search through git histories
 .It sleuthkit
 a collection of digital forensics tools
+.It clamav
+antivirus engine
 .El
 .
 .Ss Exploits
@@ -164,6 +166,8 @@ test for common router vulnerabilities. needs to be run in a
 .Cm nix-shell -p
 .It dsniff
 network auditing and penetration testing
+.It dnschef
+DNS proxy for penetration testing
 .El
 .
 .Ss Crackers