All Tools

File archiver with high compression ratio supporting 7z, XZ, GZIP, TAR, ZIP and other formats.

GNU archiver that can read and extract files from archives, useful for file read operations.

ARJ archiver that can read and write files with elevated privileges.

File compression utility using Burrows-Wheeler algorithm that can read files via compression pipeline.

Decompresses gzip-compressed (.gz) files.

Portable archive tool, can read and write files.

GNU tape archiver; can read/write files, transfer data, and spawn shells via checkpoint actions Can also download files, read arbitrary files, write to arbitrary files, spawn an interactive shell, upload files.

Extract compressed ZIP archives; can read arbitrary files.

Argument injection via awk

Argument injection via chrome

Argument injection via curl

Argument injection via dig

Argument injection via env

Argument injection via file

Argument injection via find

Argument injection via gcc

Argument injection via git

Argument injection via hg

Argument injection via javac

Argument injection via lftp

Argument injection via logrotate

Argument injection via make

Argument injection via psql

Argument injection via qt5

Argument injection via run-parts

Argument injection via sendmail

Argument injection via sftp

Argument injection via socat

Argument injection via ssh

Argument injection via ssh-keygen

Argument injection via tar

Argument injection via unzip

Argument injection via wget

Argument injection via zip

OSS sound wrapper that can spawn a shell by wrapping /bin/sh.

Text-to-speech synthesizer, can read files and execute commands.

Ansible playbook executor that can spawn a shell via crafted playbook with shell tasks.

Ansible testing tool that can spawn a shell directly via the shell subcommand.

Configuration management tool, can spawn a shell via the cdist shell command.

Automates interactive applications, can read files and spawn interactive shells.

Bareos backup console, can read files via error messages and spawn shells via @exec.

BorgBackup deduplicating backup tool, can spawn a shell via the extract command's rsh option.

Backup tool, can read files and execute commands.

Boot screen daemon, can execute commands.

GNU assembler that can read files via the @file directive, leaking lines as error messages.

Netwide Assembler, can execute commands via compiled binaries.

Automatic Makefile dependency generator that can execute arbitrary commands through Makefile rules.

Generate configuration scripts, can be used to spawn a shell via the AUTOM4TE environment variable.

Generate config.h.in templates, can be used to spawn a shell via the AUTOM4TE environment variable.

Rebuild autoconf files, can be used to spawn a shell via the AUTOM4TE environment variable.

Cross-platform build system generator, can read files and spawn shells.

GNU C compiler that can read files, delete files, and spawn shells via wrapper/plugin options.

Go programming language compiler and toolchain that can execute arbitrary Go code.

GNU C++ compiler, can execute code and spawn shells via compiled shared objects.

Rust compiler, can execute code via compiled binaries.

Rust documentation tool, can execute commands via test code.

Rust code formatter, can execute commands.

Rust toolchain manager, can execute commands.

Distributed C compiler, can spawn a shell by passing /bin/sh as the compiler.

Redis CLI, can execute commands and read files.

AWS command-line interface for managing cloud resources, can read files via EC2 filter option.

Google Cloud CLI, can execute commands and spawn shells via gcloud compute SSH.

Backdrop CMS command-line tool, can execute PHP code inherited from PHP binary.

Fax program, can execute commands via crafted fax files.

Asterisk PBX remote console, can spawn a shell from the CLI when running as root or via sudo/SUID.

Decompress gzipped files to stdout; can read arbitrary files.

General-purpose data compression utility; can read arbitrary files.

Compress files into ZIP archives; can read files and spawn shells via test command.

Chef CLI, can execute Ruby code.

Configuration management tool, can execute Ruby code.

Container hypervisor, can spawn privileged containers with host filesystem.

Multi-container orchestration tool for defining and running complex Docker application stacks.

Container runtime, can spawn privileged containers with host access.

containerd CLI, can spawn a privileged shell by running a container with host filesystem mount.

Container platform for developing, shipping, and running applications in isolated environments.

Certificate authority management, can execute commands via openssl config.

chisel server (server on local machine)

Coercer - list vulns

Scan drupal web site with drupwn

Fuzz a web site with ffuf with classic extensions

Fuzz a web site with gobuster with classic extensions

Bruteforce a JWT token key

kerbrute - kerberos user enumeration

masscan - scan all port

mimikatz one liner

msfvenom - payload windows x86 meterpeter unstagged

NetExec - enumerate hosts, network

Nmap - hosts alive

Dump a process memory - local

Responder - Launch

Rubeus - inject ticket from file

Stealthy psexec

socat port forwarding listener (on local machine)

SQLMap - classic with tamper

Scan wordpress web site with wpscan

MySQL client, can execute SQL queries and read files via LOAD DATA.

PostgreSQL client, can execute SQL queries and read files via COPY.

Samba TDB database manipulation tool; can read and write files.

SQLite3 database command-line interface; can execute queries, read/write files, and spawn shells.

Build automation tool for compiling and managing project dependencies using Makefile-based rule definitions.

Ruby build tool, can execute commands via Rakefile.

Memory debugging and profiling tool; can read arbitrary files.

.NET CLI; can execute arbitrary code and spawn shells Can also read arbitrary files, spawn an interactive shell.

Foundry framework for Ethereum smart contract development; can spawn a shell via build scripts.

Haskell package build system, can spawn shells via cabal exec with project-file option.

Infrastructure-as-code provisioning tool; can spawn a shell.

Kickstart script parser; can read arbitrary files.

S-Lang scripting language interpreter; can execute commands and spawn shells.

Nix-based development environment tool, can spawn a shell via codex sandbox.

Fast, reliable Node.js package manager; can execute arbitrary scripts.

Node package manager, can execute commands via pre/postinstall scripts.

File manager/launcher for Haiku OS; can execute commands and leverage sqlite3.

Perl bug reporting tool, can execute commands.

PHP dependency manager, can spawn a shell via composer run-script.

Python debugger, can execute Python code and spawn shells.

Python dependency manager, can execute Python code via scripts.

Python interpreter, can execute Python code and spawn shells.

Fast Python package installer and resolver; can execute arbitrary code.

Ruby dependency manager (Bundler), can spawn shells via exec and Gemfile manipulation.

Ruby debugger, can execute Ruby code inherited from Ruby binary.

Python programming language interpreter

Rust package manager, can read files via pager (less) inheritance.

List symbols from object files, can read files.

ELF file reader, can read binary files.

Tcl scripting language shell; can execute code, read/write files, and spawn shells.

Tcl/Tk GUI application shell; can inherit Tcl capabilities.

TypeScript compiler; can execute code and spawn shells.

Python type checker, can execute Python code via plugins.

Python type checker (Node.js), can execute commands.

Distributed version control system for tracking changes in source code and coordinating collaborative development.

Mercurial VCS, can execute Python code via hgrc or hooks.

Development environment virtualization tool; can spawn a shell.

Visual Studio Code editor; can spawn a shell and execute commands via integrated terminal Can also download files, send a reverse shell, upload files.

Document converter, can read files and execute commands via filters.

PDF manipulation tool, can read and write files.

Extensible text editor that can read, write files, and spawn interactive shells.

Vi text editor; can execute commands, read/write files, and spawn shells.

Vim text editor; can execute arbitrary commands and read/write files via embedded interpreters.

Convert ASCII text to PBM bitmap format, can read files via sudo or SUID.

Base58 encoding/decoding utility, can read files via sudo.

Base encoding/decoding utility from coreutils, can read files via sudo or SUID.

Extended base encoding/decoding utility, can read files via sudo or SUID.

ASCII85 encoder/decoder for binary-to-text encoding, can encode arbitrary files.

Base32 encoder/decoder that can encode and decode arbitrary files to read their contents.

Encode binary files for email transmission; can read arbitrary files.

JTAG boundary scan tool, can execute commands.

Screenshot tool, can execute commands via exec/postexec options.

GNU Image Manipulation Program, can execute scripts via Script-Fu.

Dual-purpose repository for human study and machine-readable automation

COBOL compiler, can spawn a shell via compiled COBOL code.

Glasgow Haskell Compiler, can execute code and spawn shells via compiled binaries.

Glasgow Haskell Compiler interactive, can execute code and spawn shells.

Common Lisp interpreter, can spawn a shell via run-shell-command.

Perl module installer, can execute Perl code inherited from Perl binary.

GiNaC symbolic math shell, can execute commands and read files.

GNU Guile Scheme interpreter, can execute commands.

Copy files and directories while preserving file attributes and permissions.

Execute AppleScripts and other OSA language scripts and commands.

Capture a screenshot from command line.

File-less compression of data passed in through stdin.

Compile AppleScripts or OSA language scripts.

Enable the WebDriver Safari browser API for Selenium testing.

Paste the contents of clipboard to the terminal.

Interact with Keychain, macOS's built-in password manager.

Changes file or directory flags

Create, manipulate and verify code signatures.

Configure or view system security policies.

Read, write, and delete user preference values.

Access system log messages from Apple Unified Logging (AUL).

List metadata attributes for the specified file.

Create a temporary file or directory and return the file/directory name to stdout

Download, upload, and read files.

Kill processes by name or pattern.

Read, create or edit plist files.

Convert text to audible speech.

Manage the security assessment policy subsystem, Gatekeeper settings, and control which apps are allowed to run on the system.

Command-line tool for managing the Transparency, Consent, and Control (TCC) permissions database

Manipulate text files in various formats.

Discover local network services using the DNS-Based Service Discovery (SD) protocol.

gather information, statistics and initiate queries to the Directory Service cache.

Interact with Directory Services.

retrieves/changes configuration for Directory Services Active Directory Plugin.

Get attributes of files and directories.

Displays a hierarchial view of the I/O Kit registry.

Display the status of loaded kernel extensions (kexts)

Interact with the macOS Launch Services database.

Configure network settings in System Preferences.

Monitor and post Darwin notifications for inter-process communication and system event monitoring.

Access and manage the host's non-volatile random-access memory (NVRAM).

odutil allows caller to examine or change state of opendirectoryd

List and remove configuration profiles.

Display basic network information, check the dns config, set the computer hostname and perform several other tasks.

Binary to manage the Shared File List framework.

Interact with the macOS software update service.

Prints macOS version information.

Reports system hardware and software configuration.

Prevent the system from sleeping on behalf of a utility.

The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.

Manipulate disk images using the DiskImages framework.

Interact with LaunchAgents and LaunchDaemons.

Open files, folders, apps, URLs, and header files.

Arbitrarily execute swift code from the terminal.

Create/delete local accounts, guest account, enable SMB/AFP Guest access.

Display and manipulate extended attributes.

Manage Time Machine backups.

Create and manage macOS file sharing points for SMB, AFP, and FTP.

Send SNMP trap notifications; receive them with snmptrapd.

Enable remote login, remote apple events for the machine

Prevents a process from being terminated when a shell session or terminal is closed.

Set attributes of files and directories.

Export data from an Open Directory directory services server.

Locate files using the Spotlight database.

Arbitrary precision calculator language that can read files via -s flag, leaking content as errors.

Reverse-polish desk calculator that can execute shell commands via the ! operator.

Julia language REPL, can execute commands and spawn shells.

GNU Octave (MATLAB-like), can execute commands.

Plotting utility, can execute commands.

R language for statistics, can execute commands.

Nagios plugin for SSH check, can spawn a shell via ProxyCommand exploit.

Nagios plugin for CUPS check, can read files via --extra-opts option.

Nagios plugin for log file checking, can read and write files via -F/-O options.

Nagios plugin for memory checking, can read files via --extra-opts option.

Nagios plugin for RAID checking, can read files via --extra-opts option.

Nagios plugin for SSL certificate checking, can spawn a shell via --grep-bin option.

Nagios plugin for status file checking, can read files via path argument.

Multimedia converter, can read and write files and execute commands.

Python-based packet crafting and network manipulation framework for packet generation, sniffing, protocol analysis, and network attack development.

BitTorrent client, can read files and execute commands.

Dump traffic on a network interface

Captures TCP connections and reconstructs data streams.

Replays pcap network traffic for device testing.

Configure network bridges, can read files via error message output.

Configure network interfaces

Show/manipulate routing, devices, policy routing and tunnels

Show/manipulate the IP routing table

Packet crafting and network analysis tool that can spawn shells and exfiltrate data over ICMP.

DHCP client, can spawn a shell via the -sf (shell script) option.

Fast ping tool, can execute commands via crafted packets.

Combines ping and tracert with packet loss per hop.

Network diagnostic tool combining traceroute and ping, can read files.

Network utility for testing reachability and measuring round-trip latency to a remote host.

Traces the route packets take to a network destination.

Network diagnostic tool for displaying the route and measuring transit delays of packets across an IP network.

ARP table manipulation tool that can read files when used with privileges via -f flag.

DNS lookup utility for querying name servers and debugging DNS resolution issues.

DNS forwarder and DHCP server, can execute commands via --conf-script option.

Simple DNS lookup for forward and reverse lookups.

Queries DNS servers for domain name or IP resolution.

Lightweight multi-protocol download utility that can execute commands via hooks and read files.

Download videos from YouTube and other sites; can execute arbitrary commands.

Alpine email client that can read arbitrary files when invoked with the -F flag.

GNU mail processor that can spawn a shell via exec flag or mail interactive mode.

Terminal email client, can read files and execute commands.

Mail processing tool, can execute commands via recipes.

User information lookup service; can read arbitrary files Can also download files, upload files.

Administration tool for IPv4 firewall rules

Save iptables rules, can read files and execute commands.

nftables rule manager, can read files and execute commands.

File Transfer Protocol client; can transfer files and spawn shells Can also download files, spawn an interactive shell, upload files.

Trivial File Transfer Protocol client; can transfer files and spawn shells.

Apache HTTP server benchmarking tool that can also be used for file download and upload operations.

Apache HTTP server that can be used for file read operations via configuration directives.

Apache HTTP server control interface that can leak file contents via config Include directive.

Transfers data from or to a server using supported protocols (HTTP, HTTPS, FTP, SFTP, SCP, etc.).

Web server, can read files and execute commands via modules.

Non-interactive download utility supporting HTTP, HTTPS, and FTP protocols with recursive download and resume capability.

Returns MAC addresses of network adapters.

NetworkManager command-line client.

Displays and changes Ethernet device settings.

Network bandwidth monitor, can read files.

Displays active connections, listening ports, and routing tables.

MQTT message broker, can execute commands via config.

Displays NetBIOS over TCP/IP statistics and name tables.

Shows NFS server export lists and mount information.

Displays NFS statistics about mounts, RPC calls, and server activity.

Run commands through the Tor anonymizing network; can spawn a shell.

Run commands through Tor (legacy wrapper); can spawn a shell.

Remote login client, can execute commands.

Telnet protocol client for remote connections

Wireshark CLI network protocol analyzer; can spawn a shell.

Netcat - arbitrary TCP/UDP connections and listening

Versatile networking utility for reading/writing data across TCP and UDP connections, port scanning, and network debugging.

Multipurpose relay tool for bidirectional data transfer between sockets, pipes, files, and serial ports with SSL support.

Socket statistics utility; can read remote files via TCP.

SSH File Transfer Protocol client; can transfer files and spawn shells Can also download files, spawn an interactive shell, upload files.

Secure Shell client; can execute remote commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, spawn an interactive shell, upload files.

SSH authentication agent; can spawn a shell.

Install SSH public keys on remote hosts; can write to authorized_keys and spawn shells.

SSH key generation and management; can read and write files.

Gather SSH host public keys from remote servers.

Mount remote filesystems over SSH; can read, write, and manage remote files.

Non-interactive SSH password authentication; can spawn a shell.

Instant terminal sharing over SSH; can spawn a shell.

Set system time from NTP server, can execute commands.

Transfer ASCII files using XMODEM protocol, can read arbitrary files via sudo or SUID.

Sophisticated file transfer program, can download and upload files and execute commands.

Text web browser, can download files and execute commands.

Perl web download tool, can download and execute files.

Perl web client, can download and upload files and execute commands.

FTP client, can download and upload files and execute commands.

PuTTY SFTP client, can download and upload files.

Secure copy over SSH protocol

Fetch URLs using uriparser library; can download and upload files.

Tunneling/pivoting proxy for network penetration testing.

OpenVPN client, can execute commands via config and up/down scripts.

Transparent VPN over SSH; can execute remote commands.

WireGuard-based mesh VPN client; can spawn a shell.

Quick setup for WireGuard VPN tunnels; can spawn a shell.

Displays all current TCP/IP network configuration values and refreshes DHCP and DNS settings.

Kubernetes command-line tool that can spawn shells via exec auth config and serve files via proxy.

APT package manager that can execute arbitrary commands via dpkg pre-invoke hooks or update pre-invoke.

APT package manager with a text interface that can spawn a less pager to read files.

Debian package manager that can spawn shells via crafted package before-install scripts.

OPKG package manager, can execute commands via pre/post-install scripts.

FreeBSD package manager, can execute commands via pre/post-install scripts.

Python package installer (setuptools), can execute Python code via setup.py.

Python package installer, can execute Python code via setup.py.

Isolated Python app installer, can execute Python code.

Fedora package manager, can execute commands by installing crafted RPM packages.

RPM package manager, can execute commands via pre/post-install scripts.

RPM database query tool, can read files.

RPM package query tool, can read files.

RPM package verification tool, can read files.

Ruby package manager that can spawn shells via editor open or install hooks.

Snap package manager; can spawn a shell.

Yellowdog Updater Modified package manager; can execute arbitrary commands and spawn shells.

openSUSE/SLES package manager; can execute commands and spawn shells.

Run command immune to hangups, can execute commands.

Run script command, can execute commands.

Run a program in a modified environment, can spawn a shell.

Execute command in parallel, can execute commands.

Manage file locks from shell scripts, can spawn a shell when used with privileges.

Lock file and execute command, can execute commands.

Remote Desktop Connection client.

Connects a Remote Desktop session to a different session.

Disconnects a Remote Desktop Services session.

Displays Remote Desktop Services sessions on a server.

Resets a Remote Desktop Services session.

Windows Remote Shell via WinRM.

Nashorn JavaScript engine for JVM, can execute JavaScript and spawn shells.

Java script runner, can execute JavaScript and spawn shells via JVM.

JShell (Java REPL), can execute Java code and spawn shells.

Java runtime that can execute compiled Java class files to spawn shells.

JavaScript runtime, can execute JS code and spawn shells.

Perl interpreter, can execute arbitrary Perl code and spawn shells.

PHP interpreter, can execute PHP code and spawn shells.

Interactive Ruby shell, can execute arbitrary Ruby code.

Interactive Ruby shell with introspection, can execute Ruby code.

Ruby interpreter, can execute Ruby code and spawn shells.

Lua programming language interpreter with extensive capabilities for shell, file, and network operations.

BloodHound Python ingestor for Active Directory relationships.

Active Directory Certificate Services (AD CS) exploitation tool that finds vulnerable certificate templates, escrows, and performs ESC1-ESC8 attacks for domain privilege escalation.

Domain Controller diagnostics tool for analyzing AD domain controllers.

Python reimplementation of enum4linux for comprehensive SMB and NetBIOS enumeration of Windows and Active Directory targets.

Imports and exports Active Directory objects using CSV format files.

Tool for performing Kerberos pre-authentication brute-forcing, user enumeration, and password spraying against Active Directory.

LDAP directory search tool for querying Active Directory to enumerate users, groups, computers, organizational units, and domain policies.

Impacket psexec — Windows remote command execution via SMB service control manager for lateral movement in Active Directory environments.

Active Directory query tool for retrieving objects from the directory.

Active Directory replication diagnostics and management tool.

Samba RPC client for executing MS-RPC functions against Windows systems for user, group, domain, and privilege enumeration.

Kerberos abuse toolkit for Windows for performing AS-REP roasting, Kerberoasting, pass-the-ticket, S4U attacks, and Kerberos ticket manipulation.

Impacket secretsdump tool that extracts NTLM hashes, Kerberos keys, and credential material from Windows systems via NTDS.dit, SAM, and LSA techniques.

BloodHound data collector written in C# that enumerates Active Directory relationships, ACLs, group memberships, and session information for attack path analysis.

SMB/CIFS client for accessing and managing file shares on Windows systems, part of the Samba suite of interoperability tools.

SMB enumeration tool that provides recursive listing, file download/upload, and command execution across SMB shares on Windows networks.

Network test tool for querying and managing Active Directory trust relationships.

Impacket tool for semi-interactive remote command execution over Windows Management Instrumentation (WMI) without deploying services or agents.

ClamAV antivirus scanner, can read files via error message leakage with custom YARA rules.

Run a program with a specified AppArmor profile, can spawn a shell when used with sudo or SUID.

Multi-protocol brute-forcing tool that supports FTP, SSH, HTTP, SMTP, SNMP, and many other services for login credential testing.

Linux capability shell wrapper that can spawn a privileged shell by dropping or manipulating capabilities.

Set file capabilities, can execute commands via cap-enabled binaries.

Custom wordlist generator that spiders websites to gather unique words for crafting targeted password lists.

Wordlist generator that produces all possible combinations and permutations of specified character sets.

Common User Passwords Profiler — generates intelligent wordlists based on personal profile information gathered from the target.

Simple hash identification tool that determines the probable hash type from a given hash string.

World's fastest password recovery tool supporting GPU acceleration, hundreds of hash types, and advanced attack modes.

Very fast parallel network logon cracker supporting numerous protocols for brute-force authentication testing.

Leading password cracking tool supporting hundreds of hash types with multiple cracking modes (single, wordlist, incremental, external).

Parallel network login auditor for brute-forcing authentication across multiple protocols and services.

High-speed network authentication cracking tool for testing credential strength across multiple network services.

Wordlist mangling/generation tool that takes a base wordlist and applies transformation rules to create variants.

Post-exploitation credential extraction tool that recovers plaintext passwords, NTLM hashes, Kerberos tickets, and DPAPI keys from Windows memory and registry hives.

Comprehensive cryptographic toolkit for SSL/TLS, certificate management, encryption, hashing, and key generation.

DNS enumeration script that performs SRV record discovery, subdomain bruteforce, DNSSEC testing, zone transfer attempts, and reverse DNS lookups.

DoS testing tool that simulates Slow HTTP attacks including Slowloris, Slow HTTP POST, and Slow Read to test server resilience against application-layer DoS.

WinRM shell for remote Windows administration and post-exploitation, supporting plaintext, pass-the-hash, and Kerberos PKINIT authentication.

Browser Exploitation Framework for assessing browser security through client-side attack vectors and hooking.

.NET command and control framework for red teaming with real-time collaboration and multi-user support.

PowerShell-based post-exploitation framework for staged and stageless payloads with encrypted C2 communication.

Modern post-exploitation command and control framework with a GUI interface, supporting agent communication, payload generation, and team collaboration.

Cross-platform post-exploitation C2 framework written in Go, supporting HTTP/2, gRPC, and WebSocket communication for agent management.

Full-featured exploitation framework with thousands of modules for exploit development, payload generation, and post-exploitation.

Metasploit console, can execute Ruby code and spawn shells.

Collaborative red team C2 framework with a web UI, multi-agent support, and extensible payload agents for post-exploitation operations.

Cross-platform remote administration and post-exploitation framework written in Python, supporting in-memory execution, multiple transports, and extensible modules.

Router exploitation framework with modules for scanning, exploiting, and fuzzing embedded devices.

Command-line search tool for the Exploit-DB archive, enabling offline searching of exploits and shellcode.

Social Engineer Toolkit for automating credential harvesting, phishing campaigns, and payload generation.

Dynamic shellcode injection tool for creating backdoored portable executables while maintaining original functionality.

Implant-based C2 framework for adversary simulation, red team operations, and post-exploitation.

Veil framework for generating Metasploit-compatible payloads that bypass common anti-virus solutions.

GUI-based digital forensics platform built on The Sleuth Kit for disk image analysis, file carving, and timeline generation.

Perl-based metadata reader and writer for extracting EXIF, IPTC, XMP, and other metadata from files.

File carving tool that recovers deleted files from disk images based on file headers and footers.

Steganography tool for embedding and extracting hidden data within image and audio files.

Advanced memory forensics framework for analyzing RAM dumps, extracting processes, network connections, registry hives, and artifacts.

Collection of Python classes and scripts for working with network protocols and Windows AD, including secretsdump, psexec, wmiexec, kerberoast, and NTLM relay tools.

Post-exploitation framework for Active Directory assessment that automates enumeration, lateral movement, and attack execution against Windows domain networks.

GraphQL schema enumeration tool that uses introspection queries and field suggestion brute-force to recover API schema definitions.

SSH tar pit that slowly sends an endless banner to keep SSH clients connected, consuming their resources and preventing brute force attacks.

Dumps SAM (Security Account Manager) information from remote systems.

Impacket secretsdump - extracts secrets from Windows systems.

Impacket MSSQLexec - executes commands via MSSQL server.

Dumps RPC endpoint information from remote systems.

Impacket ATexec - executes commands via Windows Task Scheduler.

Impacket DCOMexec - executes commands via DCOM protocol.

Impacket PsExec - executes processes on remote Windows systems.

Impacket SMBexec - executes commands via SMB protocol.

Impacket WMIexec - executes commands via WMI protocol.

Gets Kerberos Service Tickets using credentials.

Gets Kerberos Ticket Granting Tickets (TGT) from a KDC.

Creates golden/silver Kerberos tickets.

Remote registry manipulation tool from Impacket.

Command-line interface to the Censys internet asset search engine for discovering exposed devices, certificates, and services across the global internet.

Command-line interface to the Shodan search engine for discovering internet-connected devices, open ports, and service banners.

Domain registration and IP address lookup service for querying WHOIS databases for ownership and metadata.

IOC (Indicator of Compromise) scanner that checks files and systems against threat intelligence feeds and YARA rules for malware detection.

Configures Kerberos realm mappings and encryption types.

Lists cached Kerberos tickets for authentication.

Dumps LDAP domain information from Active Directory.

LDAP search tool for querying directory services.

Sends an LDAP WhoAmI extended operation to a directory server.

Linux local privilege escalation enumeration and auditing script.

Process monitor for Linux privilege escalation detection.

Pattern matching swiss knife for malware researchers to identify and classify malware samples based on textual or binary patterns.

Comprehensive MITM attack toolkit for ARP poisoning, DNS spoofing, and network traffic interception and analysis in switched LAN environments.

LLMNR, NBT-NS, and MDNS poisoner that captures NTLMv1/v2 hashes for offline cracking or relay attacks in Windows network environments.

Layer 2 network protocol exploitation framework for attacking STP, CDP, DTP, VTP, HSRP, and other switching and routing protocols.

Swiss Army knife for network service exploitation (SMB, WinRM, MSSQL, SSH, LDAP).

Execute commands as another user (OpenBSD-style privilege escalation), can spawn a root shell.

Kerberized superuser, can execute commands as another user.

Execute command as another user via polkit, can spawn root shell.

In-depth DNS enumeration, subdomain discovery, and attack surface mapping tool from the OWASP project.

Command-line tool that finds domains and subdomains potentially related to a given domain using passive sources.

OSINT reconnaissance tool, can read files via debug log output.

Active Directory graph-based enumeration tool that maps relationships between users, groups, computers, and permissions to identify attack paths to domain privilege escalation.

Perl-based DNS enumeration tool that performs comprehensive DNS record queries, brute forcing, reverse lookups, and zone transfers.

DNS reconnaissance tool for locating non-contiguous IP space, subdomain brute forcing, and reverse DNS lookups.

Graphical link analysis and data mining tool for OSINT investigations, entity correlation, and relationship mapping.

High-speed TCP port scanner capable of scanning the entire internet in minutes, supporting banner grab, configurable rate limits, and multiple output formats.

Network discovery and security auditing scanner used for host discovery, port scanning, and service detection.

Full-featured reconnaissance framework with modules for OSINT, social engineering, and target profiling across dozens of data sources.

Lightning-fast port scanner written in Rust that automatically pipes results into Nmap for service detection and scripting.

Open-source intelligence automation tool that queries over 200 data sources for email, domain, IP, and web footprinting.

Fast passive subdomain discovery tool from ProjectDiscovery that queries dozens of online sources to find valid subdomains for target domains.

OSINT subdomain enumeration tool that uses search engines, DNS services, and certificate transparency logs to discover subdomains of a target domain.

OSINT tool for gathering emails, subdomains, IP addresses, and URLs from public data sources for a target domain.

URL extraction and analysis tool by tomnomnom that parses URLs and extracts components (domains, paths, params, values) for recon and data processing.

Enhanced wayback machine URL fetcher that retrieves historical URLs from Internet Archive and filters results using customizable patterns.

Firmware analysis tool for extracting filesystems, identifying embedded files, and scanning binary blobs for signatures.

Binary hardening checker that reports PIE, NX, RELRO, Stack Canary, and other security mitigations on ELF binaries.

Qt-based GUI for radare2 providing disassembly, decompilation (via Ghidra/rz-ghidra), and debugging capabilities.

GNU Project debugger for analyzing program execution, reverse engineering binaries, and debugging crashes.

NSA's reverse engineering framework with disassembly, decompilation, debugging, and scriptable analysis.

Library call tracer for monitoring dynamic library calls made by a running program.

Python CTF framework and exploit development library for binary exploitation, shellcode generation, and ROP chain building.

Advanced reverse engineering framework for binary analysis, disassembly, debugging, and patching with scriptable console.

Tool for finding ROP (Return-Oriented Programming) gadgets in binaries for building ROP chains.

System call tracer for monitoring syscalls made by a process, useful for debugging and reverse engineering.

SMB/CIFS RPC client for MS-RPC protocol operations.

SUID sandbox program that can escape confinement to spawn a privileged shell.

Sandbox wrapper for systemd, can execute commands and spawn shells.

SAST tool for detecting secrets, passwords, API keys, tokens, and other sensitive data in git repositories.

SMB/CIFS client for accessing SMB shares on remote servers.

Enumerates SMB/NetBIOS information from Windows systems.

SMB enumeration tool for share drives, permissions, and directory contents.

World's most popular network protocol analyzer for live traffic capture and offline pcap analysis with deep inspection of hundreds of protocols.

SQL Server injection and takeover tool that exploits blind SQL injection vulnerabilities for privilege escalation, command execution, and data extraction.

Let's Encrypt certificate client, can spawn a shell via pre-hook or manual hooks.

Fast C-based TLS/SSL scanner that checks protocol support, cipher suites, certificate information, and performs comprehensive server configuration analysis.

Python-based SSL/TLS scanner that analyzes server configurations for protocol support, cipher strength, certificate validation, and known vulnerabilities.

Shell script for TLS/SSL testing that checks protocol support, cipher suites, certificate issues, and known vulnerabilities on any TLS server.

Fast TCP/UDP tunnel over HTTP, used for network pivoting and port forwarding through restrictive firewalls using a single binary with no dependencies.

Tool for automatic visual inspection and screenshot capture of websites across large attack surfaces.

HTTP parameter discovery tool that finds hidden GET/POST parameters by analyzing server responses.

Integrated platform for web application security testing with proxy, scanner, intruder, repeater, and decoder tools.

Content Management System security scanner supporting WordPress, Joomla, Drupal, and Moodle fingerprinting and enumeration.

Automated command injection exploitation tool for testing and exploiting OS command injection vulnerabilities.

Fast CRLF injection scanner written in Go that detects HTTP response splitting and header injection vulnerabilities.

Fast parameter analysis and XSS scanner written in Go with WAF detection, mining, and multi-format output.

Advanced web path and content discovery tool for brute-forcing directories and files on web servers.

Directory traversal fuzzing tool that tests for path traversal vulnerabilities in web applications and services via HTTP, FTP, and TFTP protocols.

Fast, recursive content discovery tool written in Rust for directory and file brute-forcing with automatic filtering and Burp integration.

Fast web fuzzer written in Go for directory discovery, parameter fuzzing, virtual host enumeration, and value brute-forcing.

Get All URLs (gau) fetches known URLs from AlienVault's OTX, WayBack Machine, and other public archives for passive endpoint discovery.

Advanced SQL injection detection and exploitation tool written in Go with support for multiple DBMS and injection techniques.

Multi-purpose brute-force tool for directory/file discovery, DNS subdomain enumeration, and cloud bucket enumeration.

HTTP/2 cleartext smuggling tool that exploits connection upgrade to smuggle requests through reverse proxies and load balancers.

Fast and multi-purpose HTTP toolkit from ProjectDiscovery for probing, analyzing, and fingerprinting web servers and services.

JSON fuzzer that tests REST APIs and JSON endpoints for input validation vulnerabilities, schema bypass, and injection flaws.

Joomla CMS vulnerability scanner that detects component versions, known vulnerabilities, and security misconfigurations.

LFI (Local File Inclusion) scanning and exploitation tool that detects file inclusion vulnerabilities and leverages them for RCE and file reading.

Fast web crawler and spider from ProjectDiscovery for discovering endpoints, assets, and attack surface.

Local File Inclusion exploitation suite that automates LFI detection, file reading, RCE via log poisoning, and PHP wrapper attacks.

Web server scanner that tests for dangerous files, outdated server software, and misconfigurations on web servers.

Fast, template-based vulnerability scanner from ProjectDiscovery that uses YAML templates to scan for CVEs, misconfigurations, and security issues.

Tool for mining parameters from web archives to discover hidden endpoints, GET/POST parameters, and potential injection points.

HTTP request smuggling scanner that detects and tests for CL.TE, TE.CL, and TE.TE smuggling vulnerabilities in web servers and proxies.

Automatic SQL injection detection and exploitation tool with support for all major DBMS and injection techniques.

Server-Side Template Injection (SSTI) exploitation tool that automates detection and exploitation of template injection vulnerabilities across multiple template engines.

Tool for fetching historical URLs from the Wayback Machine archive for discovering endpoints, parameters, and attack surface of target domains.

Web application bruteforcer for discovering hidden resources, parameter fuzzing, and content discovery.

Next-generation web server fingerprinting tool that identifies CMS platforms, frameworks, and technologies.

Black-box WordPress vulnerability scanner that detects themes, plugins, users, and security misconfigurations.

Advanced XSS detection suite with context-aware payload generation, WAF detection/evasion, and DOM XSS scanning.

OWASP Zed Attack Proxy — open-source web application security scanner for finding vulnerabilities in web applications and APIs.

Windows local privilege escalation enumeration and auditing script.

Complete suite for monitoring, attacking, testing, and cracking WiFi networks, including WEP and WPA/WPA2-PSK.

Powerful MITM framework for WiFi, Bluetooth, and wired network attacks with an interactive command console.

Command-line Bluetooth controller for device scanning, pairing, and management via BlueZ.

Bluetooth Low Energy (BLE) sniffing and jamming tool for security assessments of BLE devices.

WPS brute-force attack tool similar to Reaver but with improved reliability and performance.

Tool for capturing WLAN traffic and dumping PMKID and handshake captures for offline WPA cracking with hashcat.

Converts packet capture files to hash formats compatible with hashcat and john for WPA cracking.

Wireless network detector, sniffer, and intrusion detection system for 802.11 networks.

WiFi Protected Setup (WPS) PIN brute-force attack tool for recovering WPA/WPA2 passphrases.

Automated wireless attack tool that orchestrates aircrack-ng, reaver, and other tools to audit WiFi networks.

Almquist shell, a lightweight Unix shell that can write files and spawn interactive shells.

GNU Bourne-Again SHell; can execute commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, write to arbitrary files, load arbitrary libraries, send a reverse shell, spawn an interactive shell, upload files.

Bash bug reporting tool that opens a vi editor, which can be used to execute commands.

C shell, can spawn interactive shells and write files.

Enhanced C shell; can execute commands, read/write files, and spawn shells.

Debian Almquist shell, can spawn interactive shells and write files.

Expressive shell, can spawn interactive shells and execute commands.

Friendly interactive shell with advanced features, can be used for privilege escalation.

KornShell, can spawn interactive shells.

PowerShell Core, can execute PowerShell commands and spawn shells.

PowerShell Core, cross-platform, can execute PowerShell and spawn shells.

Plan 9 shell, can spawn interactive shells.

Stand-alone shell with built-in commands, can spawn interactive shells.

POSIX-compliant shell; can execute commands, read/write files, and spawn shells.

Z shell with advanced features; can execute commands, transfer data, read/write files, and spawn shells.

ISO image creator, can read files and execute commands.

Manage symbolic links for default commands; can read arbitrary files.

Set architecture and personality flags, can execute commands.

Copy files to and from archives, can read/write files and spawn shells via rsh-command.

Change user password, can execute commands via helper programs.

Run commands with substitute user credentials; can spawn a shell.

Execute commands with superuser privileges; can spawn a shell.

Edit group file with safe locking; can spawn a shell.

Edit password file with safe locking; can spawn a shell.

Run commands multiple times for timing, can execute commands.

Performance analysis tool, can execute commands via probe events.

Azure CLI - manages Azure resources from the command line.

File compression utility using the DEFLATE algorithm for reducing file sizes with optional decompression and stream processing.

Spawn a shell in an Arch Linux chroot container, can be used for privilege escalation via sudo.

Run command or shell with a different root directory, can spawn a privileged shell with SUID.

Enter namespaces, can escalate privileges and spawn shells in containers.

Run programs in isolated Linux namespaces; can spawn a shell.

Start and stop system daemons; can spawn a shell.

Run commands in transient systemd services; can execute arbitrary commands and spawn shells.

MongoDB Shell — interactive JavaScript interface to MongoDB.

Redis command line client for querying and managing Redis instances.

Display or set system date and time, can read files via -f flag.

Introspect and monitor the D-Bus bus, can spawn shells via address parameter or inherit less capabilities.

Ubuntu crash report handler that can spawn a pager (less) to read arbitrary files.

Core dump generator, can read process memory and files.

GNU debugger, can execute commands via Python scripting.

Library call tracer, can read files and execute commands.

Memory scanner, can read process memory.

Query XDG user directory paths; can spawn a shell.

Device mapper management, can spawn a shell via --exec option.

Linux kernel crash dump analysis tool, can read files via pager and execute commands via CRASHPAGER.

Display system manual pages, can read files and spawn shells via pager or groff.

Multi-call binary that combines many Unix utilities in a single executable for embedded systems.

DOS emulator, can read and write files via mounted host filesystem.

Base64 encode/decode data

A cat(1) clone with syntax highlighting, can read files via pager (less) inheritance.

Concatenate files and print to standard output

Change file attributes on Linux ext2/ext3/ext4 filesystems, can make files immutable for privilege escalation.

Change file mode bits

Change file owner and group

Compare two files byte by byte, can read files via byte comparison with /dev/zero.

Compare two sorted files line by line

Copy files and directories

Split files based on context, can read and write files via sudo or SUID.

Remove sections from each line of files

Convert and copy a file

Compare files line by line

Convert tabs to spaces; can read arbitrary files Can also read arbitrary files.

Determine file type

Search for files in a directory hierarchy

Hex dump (alias for hexdump -C), can read files.

Output the first part of files

Display file contents in hexadecimal

Copy files and set attributes, can read and write files and execute commands.

View file contents page by page

Create hard and symbolic links

Compute and check MD5 message digest

Move/rename files and directories

NCurses disk usage analyzer, can read files.

Dump files in octal and other formats

Apply diff patches to files

File manager, can read files and spawn shells.

Remove files or directories

Set file ACLs, can read files.

Compute and check SHA-1 message digest

Compute and check SHA-256 message digest

Securely delete files by overwriting them multiple times.

Sort lines of text files

Split files into fixed-size pieces; can read and write files and spawn shells.

Display file or filesystem status

Find printable strings in binary files

Concatenate and print files in reverse order; can read arbitrary files.

Output the last part of files

Translate or delete characters

Report or omit repeated lines

Extract SquashFS filesystem images; can read arbitrary files.

Print newline, word, and byte counts

Build and execute command lines from standard input

Hex dump or reverse hex dump

View compressed files page by page; can read arbitrary files.

ext2/ext3/ext4 filesystem debugger, can spawn a shell from the debugger CLI.

DMI/SMBIOS table decoder, can write files via --dump-bin with crafted SMBIOS data.

Execute command with a different group ID; can spawn an interactive shell.

GNOME help viewer; can read arbitrary files.

System inventory and configuration tool, can execute Ruby code via custom facts.

System information tool, can read files via custom config.

Get entries from databases like passwd, hosts, can read files.

System info display, can execute commands via custom config.

Control standard I/O buffering; can spawn a shell.

Reads from standard input and writes to both standard output and one or more files simultaneously.

Print kernel ring buffer messages, can read files via raw format flag and spawn less pager.

Configure kernel parameters at runtime; can read and write files.

Configure dynamic linker run-time bindings, can read files and execute commands.

Dynamic linker/loader, can execute arbitrary shared objects.

Reports the most recent login of all users or a given user.

CLI interface to the X11 clipboard.

Displays locale-related environment variables and settings.

Displays CPU architecture information like cores, threads, model, and flags.

Prints the number of processing units available.

Ejects removable media (CD-ROM, USB, etc.) from the system.

Locates/prints block device attributes like UUID and filesystem type.

Lists block devices (disks and partitions) in a tree-like format.

Lists file attributes on ext2/ext3/ext4 filesystems.

Displays the target of a symbolic link.

Lists all currently mounted filesystems in a tree format.

Checks if a directory is a mount point.

Prints system information like kernel name, hostname, OS, and architecture.

Shows how long the system has been running, user count, and load averages.

Generates modules.dep and map files for kernel modules.

Lists loaded kernel modules.

Displays information about a kernel module.

Adds or removes kernel modules from the Linux kernel.

Interactive process viewer and manager.

Reports CPU and I/O statistics for devices and partitions.

Reports virtual memory statistics, processes, CPU, and I/O activity.

Lists all PCI devices connected to the system.

Gets file access control lists (ACLs).

Identifies processes using files or sockets.

Lists open files and the processes that opened them.

System call tracer for Linux.

Lists USB buses and connected USB devices.

Creates a new user account with home directory, shell, and groups.

Displays who is logged in and their session details.

AWS Elastic Beanstalk CLI for managing environments; can read logs via journalctl.

Save log output to files, can read and write files.

Log rotation utility, can execute commands via crafted config files.

System logging daemon, can execute commands via config.

Run program via mailcap entries, can execute commands.

System resource statistics tool, can execute Python code via external plugins.

Process monitoring tool, can execute commands.

Send messages to all logged-in users; can read arbitrary files.

Create TCP/UDP communication endpoints; can transfer data and spawn shells.

Sticky note application for X11; can read arbitrary files.

Check for processes needing restart after updates, can execute commands.

Minimalistic PDF/document viewer; can read arbitrary files.

Cancel CUPS print jobs, can exfiltrate data via HTTP POST requests.

CUPS filter/converter, can read files via format conversion.

Print files, can read and write files.

Display and adjust OOM killer score, can spawn a shell via -n flag.

Manipulate real-time attributes of a process, can spawn a shell via chrt.

Limit CPU usage of a process, can spawn a shell via cpulimit.

Display amount of free and used memory

Set/get I/O scheduling class and priority

Send signals to processes

Run a program with modified scheduling priority

Report process status

Run a command with a time limit

Display Linux processes

Execute a program periodically

DNS resolver from systemd; can read arbitrary files.

Set soft resource limits for commands; can spawn a shell.

Job scheduler for one-time task execution; can execute arbitrary commands and spawn shells Can also execute arbitrary commands, spawn an interactive shell.

Daemon to execute scheduled commands

Schedule periodic tasks via cron, can execute commands via editor escape or direct scheduling.

Run scripts in a directory, can execute commands.

Get/set CPU affinity for processes; can spawn a shell.

Extended grep for pattern searching in files; can read arbitrary files.

Fixed-string grep for literal pattern searching; can read arbitrary files.

Search gzipped files for patterns; can read arbitrary files.

Fail2ban client, can execute commands via crafted config.

Query the systemd journal

systemd login manager control, can execute commands.

Run System V init script, can execute commands.

Control the systemd system and service manager

Show last logged in users, can read files.

Show bad login attempts, can read files.

Report filesystem disk space usage