Tools
Classified by purpose, following the flow of an attack. Click a tool to see its step-by-step install, reference commands, flags, concepts and the machines where it appears.
Network & port scanning13
arp-scan
Discovers hosts on the local network via ARP (sees boxes that ignore ping).
braa
Mass SNMP OID querying, far faster than snmpwalk.
fping
Parallel ICMP sweep: discovers live hosts on a network segment.
hping3
Crafts TCP/UDP/ICMP packets by hand; firewall probing and discovery.
ike-scan
Probes IKE/IPsec and forces Aggressive Mode to crack the PSK.
masscan
Asynchronous port scanner: sweeps huge ranges in seconds.
nmap
Port scanning and service/version detection.
onesixtyone
High-speed brute force of SNMP community strings.
RustScan
Ultra-fast port scanner that finds open ports and hands them to nmap.
showmount
Lists the NFS shares a host exports.
snmp-check
Formatted SNMP enumeration (users, processes, network).
snmpbulkwalk
Bulk SNMP dump with GETBULK, far faster than snmpwalk.
snmpwalk
Walks the SNMP MIB tree hunting for sensitive data.
Recon, DNS & OSINT9
dig
DNS queries, including zone transfers (AXFR).
dnsenum
Full DNS enumeration: records, zone transfer and brute force.
dnsrecon
DNS enumeration by record type, AXFR and reverse sweeps.
fierce
Locates non-contiguous internal ranges of a domain from DNS.
ident-user-enum
Asks the ident service (113) which user owns each open port.
smtp-user-enum
Enumerates system users over SMTP (VRFY/EXPN/RCPT).
subfinder
Passive subdomain enumeration from public sources.
swaks
Flexible SMTP client: send mails and attachments (phishing).
theHarvester
OSINT: emails, subdomains and hosts of an organisation from public sources.
Web discovery & fuzzing22
Aquatone
Bulk web screenshots from a list of hosts or ports.
dirb
Web directory brute forcer with bundled wordlists; the classic before gobuster.
dirsearch
Brute-forces web paths and files with a wordlist.
droopescan
Drupal/SilverStripe scanner (version, modules, themes).
EyeWitness
Screenshots hundreds of web apps and groups them into one report.
feroxbuster
Recursive web content discovery, written in Rust and very fast.
ffuf
Blazing-fast Go web fuzzer: directories, parameters and virtual hosts.
FinalRecon
All-in-one web recon: headers, whois, DNS, SSL and paths.
git
Clones repos and rebuilds an exposed .git to read source and secrets.
git-dumper
Downloads an HTTP-exposed .git and rebuilds the repository to read its history.
gitleaks
Scans a repo and its FULL history for secrets (keys, tokens, passwords).
gobuster
Directory and virtual-host fuzzing.
gowitness
Screenshots many web hosts at once to triage them at a glance.
JoomScan
Joomla-specific scanner: version, components and exposed files.
magescan
Magento scanner: version, modules and exposed configuration.
moodlescan
Moodle scanner: version and known vulnerabilities.
sslscan
Enumerates ciphers, protocols and certificate of a TLS service.
TruffleHog
Hunts secrets in repos and verifies them (checks if the credential is still live).
wafw00f
Fingerprints whether a WAF sits in front and which product it is.
wfuzz
Web fuzzer: paths, parameters, subdomains and headers.
whatweb
Fingerprints a website's technologies and CMS.
WPScan
WordPress scanner: users, themes and vulnerable plugins.
Web exploitation12
Bashfuscator
Obfuscates Bash commands to evade filters and signature detection.
BeEF
Browser exploitation framework: hooks victims through XSS.
Burp Suite
Intercepting web proxy: tampers requests, Repeater and Intruder.
cadaver
WebDAV client to upload and move files (webshell via PUT/MOVE).
davtest
Tests which extensions a WebDAV accepts to plant a webshell.
jwt_tool
Tampers and re-signs JWTs; tests weak secrets and algorithm confusion.
OWASP ZAP
Free intercepting proxy, the open alternative to Burp.
php_filter_chain_generator
php:// filter chains that turn an LFI into RCE with no file.
sqlmap
Automates detection and exploitation of SQL injection.
weevely
Generates and drives stealthy, encrypted PHP webshells.
XSStrike
Detects XSS by analysing context and generating tailored payloads.
XXEinjector
Automates XXE, including out-of-band and blind exfiltration.
Vulnerabilities & exploits5
Nessus
Commercial vulnerability scanner: the reference for authenticated assessment.
Nikto
Classic web scanner: dangerous files, headers and known versions.
nuclei
Vulnerability scanner driven by community YAML templates.
OpenVAS / GVM
Free vulnerability scanner, the open alternative to Nessus.
searchsploit
Searches public exploits for a product and version.
Databases7
mssqlclient.py
impacket MSSQL client: xp_cmdshell, impersonation and NTLM capture.
ODAT
Swiss-army knife against Oracle TNS: SIDs, credentials and RCE.
PowerUpSQL
Discovers, audits and abuses MS SQL instances from PowerShell.
raptor_udf
MySQL/MariaDB UDF privesc (do_system as the service account).
redis-cli
Redis client: enumerates keys and config, and loads modules for RCE.
redis-rogue-server
RCE on exposed Redis by abusing replication (malicious module).
sqsh
MS SQL client from Linux, an alternative when mssqlclient fails.
SMB, NetBIOS & RPC8
enum4linux
All-in-one SMB/RPC enumeration (users, groups, shares).
enum4linux-ng
Modern rewrite of enum4linux: more reliable SMB/RPC enumeration, with JSON.
lookupsid.py
RID cycling over MS-RPC: resolves SIDs to usernames (impacket).
rpcclient
MS-RPC enumeration (users, groups) over SMB.
smbclient
SMB client to list and access shares.
smbmap
Enumerates SMB shares and their permissions.
Snaffler
Crawls domain shares hunting for secrets and sensitive files.
username-anarchy
Generates username permutations from real names.
Active Directory enumeration13
adidnsdump
Dumps the DNS records integrated into Active Directory.
BloodHound
Maps relationships and attack paths in Active Directory.
BloodHound CLI
Installs and manages BloodHound Community Edition in one command.
bloodhound-python
BloodHound ingestor from Linux, no Windows agent needed.
CrackMapExec
NetExec's predecessor: SMB/WinRM/LDAP sweeping with credentials.
kerbrute
Enumerates valid domain users via Kerberos.
ldapdomaindump
Dumps domain users, groups and computers over LDAP to HTML/JSON.
ldapsearch
LDAP queries against a domain directory.
NetExec
Swiss-army knife for SMB/WinRM/LDAP: validates creds and enumerates (formerly CrackMapExec).
PingCastle
Audits a domain's security posture and scores its weaknesses.
PowerView
AD enumeration and abuse from PowerShell.
SharpHound
BloodHound's official collector: dumps the AD graph for analysis.
windapsearch
Canned LDAP queries against a DC: users, groups and privileges.
AD abuse (ACL, ADCS, coercion)7
bloodyAD
Abuses AD ACLs from Linux (set password, SPN, RBCD).
Certipy
Enumerates and abuses AD CS certificate templates (ESC1-ESC16).
dacledit.py
Edit the DACL of an AD object (grant yourself rights).
noPac (CVE-2021-42278/42287)
Escalates from domain user to DA by abusing sAMAccountName spoofing.
owneredit.py
WriteOwner: change the owner of an AD object (impacket).
Powermad
Creates machine accounts (a step in RBCD).
pyWhisker
Shadow Credentials: add a KeyCredentialLink to the victim.
Kerberos & tickets8
GetNPUsers.py
AS-REP Roasting: tickets of accounts without pre-auth (impacket).
getnthash.py
UnPAC-the-hash: recovers the NT hash from a PKINIT TGT.
getST.py
S4U tickets for delegation (RBCD/constrained) in impacket.
gettgtpkinit.py
PKINIT: requests a TGT using a certificate (a step in Shadow Credentials abuse).
GetUserSPNs.py
Kerberoasting: service tickets of SPN accounts (impacket).
Rubeus
Windows Kerberos swiss-army knife: request TGT, kerberoast, S4U, pass-the-ticket.
targetedKerberoast
Targeted Kerberoasting: adds a temporary SPN (GenericWrite) and cleans up.
ticketer.py
Forges Kerberos tickets (Silver/Golden) from a hash.
NTLM coercion & relay7
Coercer
Coerces a host to authenticate to you over multiple RPCs (for relay or roast).
Inveigh
Responder for Windows: poisons LLMNR/NBT-NS from a domain shell.
krbrelayx
Kerberos/NTLM relay and coercion for unconstrained delegation.
mitm6
Hijacks DNS over IPv6 to become MITM and chain an NTLM relay.
ntlmrelayx
Relays captured NTLM authentications to another service (LDAP, SMB, ADCS).
PetitPotam
NTLM coercion via MS-EFSRPC; classic to relay the DC machine account to ADCS.
Responder
Poisons LLMNR/NBT-NS/mDNS and captures NetNTLMv2 hashes to crack or relay.
Access, shells & transfer21
certutilLOLBIN
Windows LOLBIN; handy to download files to the target.
curlLOLBIN
HTTP client to test payloads (traversal, webshells, RCE).
evil-winrm
WinRM shell via password, hash or certificate.
ftp
FTP client; handy for anonymous access.
LibreOffice
Opens ODF documents; its (Basic) macros can execute code.
Metasploit
Exploitation framework: modules, handlers and post-exploitation.
msfvenom
Generates payloads (reverse shells, executables, webshells).
netcatLOLBIN
Network listener and swiss-army knife; catches reverse shells.
Nishang
Offensive PowerShell framework: in-memory reverse shells.
powercat
PowerShell netcat for in-memory reverse shells.
psexec.py
Remote SYSTEM execution over SMB (impacket).
rlwrap
Adds history and line editing to a raw reverse shell.
rsync
Syncs/exfiltrates files; abusable anonymous modules and SUID.
smbserver.py
Spins up an SMB share to move files or capture NTLM hashes.
sshLOLBIN
Remote access and tunnels (port forwarding with -L).
ssh-keygenLOLBIN
Generates SSH keypairs to plant in authorized_keys.
sshpass
Non-interactive SSH with a password (spraying, legacy algorithms).
vncviewer
VNC client to open remote (or tunnelled) graphical desktops.
wgetLOLBIN
Downloads files to the target; sometimes an abusable SUID (GTFOBins).
wmiexec.py
Remote execution over WMI, stealthier than psexec (impacket).
xfreerdp
RDP client; GUI access with password/hash (RDP Pass-the-Hash).
Credential dumping & theft11
DonPAPI
Harvests and decrypts DPAPI secrets remotely and at scale.
firefox_decrypt
Decrypts the passwords stored in a Firefox profile.
gpp-decrypt
Decrypts the Group Policy Preferences cPassword (public AES key).
LaZagne
Harvests passwords stored by dozens of Windows and Linux programs.
mimikatz
Dumps LSASS credentials and manipulates Kerberos tickets on Windows.
mimipenguin
Extracts cleartext passwords from Linux process memory.
mRemoteNG-decrypt
Decrypts mRemoteNG's confCons.xml passwords.
ProcDump
Sysinternals: dumps a process's memory (LSASS) to extract credentials offline.
pypykatz
Pure-Python Mimikatz: parses an LSASS dump offline on the attacker box.
secretsdump.py
Dumps hashes (SAM/LSA/NTDS), DCSync included (impacket).
SharpDPAPI
Decrypts DPAPI masterkeys, credentials and secrets (GhostPack, C#).
Privilege escalation17
accesschk
Sysinternals: which objects and services a user can write.
Churrasco
Classic token kidnapping to SYSTEM on Windows Server 2003.
docker
docker group or exposed socket → root by mounting the host disk.
FullPowers
Restores a service account's default privileges (SeImpersonate).
gccLOLBIN
Compiles local exploits (kernel, .so modules) on the target.
getcap
Lists file capabilities (cap_setuid, cap_dac_read...).
GodPotato
SeImpersonate → SYSTEM on modern Windows (successor to Juicy/RoguePotato).
JuicyPotato
SeImpersonate → SYSTEM via DCOM/BITS (older Windows).
logrotten
Exploits a logrotate race condition to run as root.
PEASS (lin/winPEAS)
Automated enumeration of escalation vectors (Linux/Windows).
PowerUp
Finds local Windows escalations: services, permissions and paths.
PrintSpoofer
SeImpersonate → SYSTEM by abusing the print spooler.
pspy
Spies on processes and cron jobs without root.
RunasCs
Runs processes as another user with their password or hash.
Seatbelt
Security survey of a Windows host: credentials, tokens, juicy configurations.
Sherlock
Hunts for local Windows privilege-escalation vulns from PowerShell.
windows-exploit-suggester
Compares systeminfo against the patch database to suggest kernel exploits.
Pivoting & tunnelling9
chisel
TCP tunnels to reach internal services (pivoting).
dnscat2
Command channel and tunnel encapsulated in DNS queries.
Ligolo-ng
TUN-interface pivoting: routes internal networks without proxychains or manual port-forwarding.
plink
PuTTY's command-line SSH client, for tunnels from Windows.
proxychains
Routes any tool through a SOCKS proxy (pivoting).
ptunnel-ng
TCP tunnel encapsulated inside ICMP (ping) packets.
socat
Relays and encrypted shells; port redirector in pivoting.
SocksOverRDP
SOCKS tunnel through an existing RDP virtual channel.
sshuttle
Poor-man's VPN over SSH: routes a whole subnet through a pivot without proxychains.
Cracking & wordlists15
CeWL
Builds wordlists from the words on a website.
crunch
Generates custom wordlists by length, charset and pattern.
CUPP
Builds personalised wordlists from the victim's own data.
fcrackzip
Brute-forces ZIP file passwords.
hashcat
GPU-accelerated hash cracking.
hashid
Identifies a hash type and gives the hashcat or john mode.
hydra
Online brute force of services (SSH, FTP, HTTP, forms).
John the Ripper
Cracks hashes and containers (zip, pfx, psafe...).
keepass2john
Extracts the master-password hash from a .kdbx for cracking.
Medusa
Parallel login brute forcer with a module per service.
Name-That-Hash
Identifies a hash type and suggests the hashcat/john mode.
opensslLOLBIN
Crypto operations: decryption, key extraction from .pfx.
psk-crack
Dictionary-cracks the IKE aggressive-mode PSK captured with ike-scan.
pwsafe / pwsafe2john
Opens Password Safe stores (.psafe3) and extracts the hash to crack.
SolarPuttyCracker
Brute-forces the saved SolarPutty sessions (.dat).
File analysis & reversing12
7z
Compresses/extracts; as SUID it can read root-owned files.
apktool
Unpacks an APK to smali and resources to read its logic and secrets.
Depix
Recovers pixelated text (passwords) from linear-box-blur screenshots.
dnSpy / dotPeek
Decompiles and debugs .NET binaries to read their logic and secrets.
exiftool
Reads metadata from images and documents (authors, paths, GPS).
Ghidra
NSA reverse-engineering suite: decompiles native binaries.
Immunity Debugger + mona
Debugger with the mona plugin to develop buffer-overflow exploits.
JD-GUI
Decompiles Java .jar/.class files back to source.
scrot
Screenshots an X11 session; handy to read data that only shows in a GUI.
strings
Pulls readable strings from a binary (quick analysis).
tcpdump
Captures network traffic hunting for cleartext credentials.
tshark / Wireshark
Analyses packet captures; filters cleartext creds (FTP, HTTP).
General3
No results