Tools
48 tools
The tools an operator actually reaches for, current and curated. Not a dump of everything on GitHub: the modern recon chain, the AD toolkit, the open-source C2s, and the reporting stack, each with the moment you use it.
Recon & OSINT recon
Map the attack surface before you touch it: subdomains, live hosts, exposed services, and what the internet already knows.
- Amass OWASP
In-depth attack-surface mapping and subdomain enumeration.
when Scoping a domain: the widest passive + active subdomain net you can cast.
-
Fast passive subdomain discovery from dozens of sources.
when The first command on any external engagement, piped into httpx.
-
Fast, multi-purpose HTTP prober and fingerprinter.
when Turn a list of hosts into live web servers with titles, tech, and status.
-
Fast SYN/CONNECT port scanner in Go.
when A quick port sweep across many hosts before a full nmap on the hits.
-
Emails, names, subdomains, and hosts from public sources.
when Building a user list and footprint for phishing or password spraying.
-
Pull every URL a domain has served, straight from the Wayback Machine.
when Surfacing forgotten endpoints, parameters, and old paths before you fuzz.
- Shodan service
Search engine for internet-exposed devices and services.
when Find exposed panels, versions, and known-vulnerable services before scanning.
Web & API web
Discover content and parameters, crawl the app, and template the checks so nothing hides in a forgotten endpoint.
-
Fast web fuzzer for content, vhosts, and parameters.
when Directory and parameter discovery: the operator default for fuzzing.
-
Fast, recursive content discovery in Rust.
when Deep-crawling a site where directories nest and ffuf gets tedious.
-
Next-generation crawling and spidering framework.
when Mapping every endpoint and JS-defined route before you attack.
-
Template-driven vulnerability scanner with a huge community library.
when Sweeping for known CVEs, misconfigs, and exposures at scale, safely.
-
HTTP parameter discovery suite.
when Finding hidden parameters that unlock injection or IDOR.
- Caido modern
A modern, lightweight web proxy · a Burp alternative.
when Manual testing when you want speed and a clean workflow.
-
WordPress security scanner: core, plugins, themes, and users.
when The target runs WordPress: enumerate versions and known-vulnerable plugins.
Active Directory ad
The internal engagement runs on these: enumerate the domain, map the paths, and abuse Kerberos and AD CS.
- NetExec (nxc) modern
The maintained successor to CrackMapExec · swiss-army for AD/network protocols.
when Auth checks, share hunting, spraying, and command exec across the domain.
-
Graphs Active Directory attack paths with Cypher.
when Every AD engagement: find the shortest path from owned to Domain Admin.
-
Python classes for network protocols · secretsdump, GetUserSPNs, psexec, and more.
when The backbone of AD attacks from Linux: roasting, relaying, dumping, executing.
-
Enumerate and abuse Active Directory Certificate Services.
when AD CS is present: find and exploit ESC1-ESC16 for privilege escalation.
-
Kerberos abuse toolkit for Windows.
when On a Windows foothold: roasting, ticket requests, S4U, and pass-the-ticket.
-
Coerce a Windows host to authenticate via many methods.
when Setting up NTLM relay or PetitPotam-style coercion to a DC.
Exploitation & C2 exploit + c2
Land the shell, then hold it. The exploitation framework plus the modern open-source command-and-control operators actually run.
-
The exploitation framework: modules, payloads, and handlers.
when A known exploit exists, or you need a quick multi/handler and msfvenom.
- Sliver modern
Modern, open-source, cross-platform C2 framework in Go.
when A real engagement needs resilient, extensible C2 without a Cobalt license.
- Havoc modern
Modern, malleable post-exploitation C2 framework.
when You want a capable, evasive teamserver and a demon agent, free.
-
Reverse-shell and C2 handler that shares sessions between operators.
when Fast, lightweight C2 for a small engagement or a CTF.
-
Post-exploitation platform that supercharges a raw reverse shell.
when You caught a shell and want auto-stabilization, persistence, and enum.
PrivEsc & Post-Exploitation privesc
Enumerate the box, find the misconfiguration, and take the creds. The scripts and references that run on every foothold.
-
winPEAS and linPEAS · the definitive privesc enumeration scripts.
when First thing on any foothold: automate the whole privesc checklist.
-
Watch Linux processes and cron without root.
when Hunting for a root-run cron or script you can hijack.
- GTFOBins reference
How to break out of a binary via sudo, SUID, or capabilities.
when sudo -l or a SUID list in hand: look up each binary here.
- LOLBAS reference
Windows living-off-the-land binaries and scripts.
when Execution, download, or bypass on Windows without dropping tools.
-
Extract plaintext creds, hashes, tickets, and keys from Windows memory.
when Local admin or SYSTEM on Windows: harvest everything in LSASS.
-
Nightly-built, ready-to-run offensive .NET binaries.
when You need Rubeus, Certify, SharpHound, or Seatbelt compiled and current.
Tunneling & Pivoting pivot
Reach the next network. Modern tunnels that beat the old plink/socat dance and route your whole toolkit inward.
- Ligolo-ng modern
Tunneling via a TUN interface · no SOCKS, no proxychains.
when Pivoting into an internal subnet: the current operator default.
-
Fast TCP/UDP tunnel over HTTP, secured with SSH.
when Port-forwarding or a SOCKS proxy through a single foothold.
-
Transparent proxy that routes traffic over an SSH connection.
when You have SSH to a pivot and want a poor-man VPN into its network.
-
Force any TCP tool through a chain of proxies.
when Running nmap, impacket, or a browser through your SOCKS pivot.
Passwords & Cracking cracking
Identify the hash, feed it the right wordlist, and spray what you already know. The offline half of credential access.
-
GPU-accelerated password recovery for hundreds of hash types.
when You captured a crackable hash and have the horsepower.
-
Password cracker with the huge *2john format-conversion toolkit.
when Cracking odd formats (zip, keepass, kerberos) or when GPU is unavailable.
-
Identify a hash type from its shape, with hashcat/john modes.
when You have a hash and need to know what mode to crack it with.
-
Fast Kerberos pre-auth username enumeration and password spraying.
when A user list against a DC: validate names and spray without lockout noise.
- SecLists reference
The collection of wordlists for every stage of an assessment.
when Any fuzzing, cracking, or spraying: start from the right list here.
Reporting & Engagement Ops reporting
The half that pays: turn findings into a deliverable, and start every engagement with scope and authorization in writing.
- SysReptor modern
Customizable, open-source pentest reporting platform.
when Writing the report without fighting Word: templated, versioned, exportable.
-
Red-team engagement management and reporting (SpecterOps).
when Tracking findings, infrastructure, and the report across a team.
-
Pentest report generator with a reusable vulnerability database.
when You want a shared finding library that fills the report for you.
- Obsidian notes
Local-first, linked markdown notes.
when Live engagement notes, host tracking, and command logs that link together.
- Rules of Engagement & authorization reference
Reference reports and templates for scope, RoE, and authorization letters.
when Before you touch anything: get scope and written permission on file.
AI-Assisted AI
The newest lane, and no substitute for judgment: agents that test and prove, an LLM co-pilot that reasons through the engagement with you, and models that read source for the bugs a skim would miss. Fast leverage · verify everything they surface.
- Strix agents
Open-source AI agents that autonomously test an app, then prove findings by exploiting them in a sandbox.
when You want an autonomous first pass that surfaces and validates real bugs, not just noise.
- PentestGPT co-pilot
An LLM co-pilot that guides a penetration test step by step, tracking state and suggesting the next move.
when You want a reasoning partner to structure the engagement and unstick you, not run it for you.
- Vulnhuntr code
LLM-driven static analysis that traces user input to dangerous sinks and finds multi-step vulnerabilities in source.
when You have the source: hunt injection, SSRF, and IDOR chains a linter would skip.