LazyOwn

(★ 220)

LazyOwn RedTeam/APT Framework is the first RedTeam Framework with an AI-powered C&C, featuring rootkits to conceal campaigns, undetectable malleable implants compatible with Windows/Linux/Mac OSX, and self-configuring backdoors. With its Web interface and powerful Console Client, it is the best combination for your Autonomous RedTeam/APT campaigns.

Owner Repos

estorides ★ 94

Open-source intelligence (OSINT) aggregator and correlation engine inspired by Palantir, Bellingcat, Maltego, and Citizen Lab workflows. A pure open-source re-imagining of the original fucklantir / osint_palantir toolchain, with a much bigger source catalogue, a proper knowledge graph, structured parsers, and a multi-backend LLM analyst.

Python
LazyOwnInfiniteStorage ★ 30

LazyOwnInfiniteStorage es una herramienta para codificar y decodificar archivos en videos.

Python
FreeDom ★ 19

A free and open-source minimal web browser written in C, focused on Zero Trust and Zero Knowledge principles.

C
blacksandbeacon ★ 15

Black Sand Beacon — a lightweight, memory-resident micro beacon or implant for the LazyOwn RedTeam Framework — is the first offensive platform to deliver true native BOF (Beacon Object File) support for Linux. Inspired by the Windows-based Black Basalt Beacon, it enables red teams to write position-independent, fileless post-exploitation modules

C
beacon ★ 13

Experimental Lightweight Windows pure C Beacon CodeName: BlackBasalt for LazyOwn RedTeam Framework C2

C
QC ★ 13

Functional quasi-quantum computing simulator on classical hardware using physics models as a backend.

Python

File Explorer

ZIP Download
  • .codacyrc
  • .coverage
  • .env.example
  • .eslintignore
  • .eslintrc.json
  • .gitignore
  • .mcp.json
  • .pre-commit-config.yaml
  • .pylintrc
  • .readthedocs.yaml
  • .secrets.baseline
  • __init__.py
  • adversary.json
  • AGENTS.md
  • app.spec.dist
  • banner.py
  • CHANGELOG.md
  • CHEATSHEET.md
  • CLAUDE.md
  • CODE_OF_CONDUCT.md
  • COMMANDS.md
  • COMPARISON.md
  • config.json
  • CONTRIBUTING.md
  • DEPLOY.sh
  • discord_c2.py
  • docker-compose.yml
  • Dockerfile
  • Dockerfile.sandbox
  • ESSENTIALS.md
  • event_config.json
  • fast_run_as_r00t.sh
  • gen_cert.sh
  • install.sh
  • key.py
  • KNOWLEDGE_BASE.md
  • lazy_sentinel4.py
  • lazyc2.py
  • lazyown.py
  • LICENSE
  • make.bat
  • Makefile
  • MANIFEST.in
  • my_techniques.json
  • opencode.json
  • payload.example.json
  • pull_request_template.md
  • pwntomate.py
  • py2elf.sh
  • pyproject.toml
  • pyvenv.cfg
  • QUICKSTART.md
  • README.md
  • readmeneitor.py
  • report.py
  • requirements-dev.txt
  • requirements-ml.txt
  • requirements.txt
  • run
  • run.bat
  • run.ps1
  • run_telegram_hermes.sh
  • SECURITY.md
  • setup.py
  • slack_c2_bot.py
  • soul.md
  • specs.md
  • telegram_c2.py
  • telegram_hermes.py
  • testmeneitor.py
  • TUTORIAL_LazyOwn.md
  • user_aliases.json
  • user_commands.json
  • user_split.sh
  • users.example.json
  • utils.py
  • version.json

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Link
Example

Command Glossary

Commands referenced in this DOCs, explained below.

🔍

clock

View Details ▼

Set the system clock.

clock set {{23}}:{{59}}:{{59}} {{31}} {{april}} {{2000}}

Enter privileged execution mode:

clock active prefer

Auto negotiate with the far end of the link, defaulting to active-clock:

clock passive prefer

Auto negotiate with the far end of the link, defaulting to passive-clock:

🔍

login

View Details ▼

Manage console and virtual line authentication.
Accessed in configuration mode under `line`.

login local

Use local username and password for authentication:

login {{user}}

Log in as a user:

login -f {{user}}

Log in as user without authentication if user is preauthenticated:

🔍

amass

View Details ▼

In-depth Attack Surface Mapping and Asset Discovery tool.
Some subcommands such as `intel` have their own usage documentation.

amass {{intel|enum}} {{options}}

Execute an Amass subcommand:

amass -help

Display help:

amass {{intel|enum}} -help

Display help on an Amass subcommand:

🔍

apropos

View Details ▼

Search the manual pages for names and descriptions.
See also: `man`.

apropos {{regex}}

Search for a keyword using a `regex`:

apropos {{[-l|--long]}} {{regex}}

Search without restricting the output to the terminal width (long output):

apropos {{regex_1}} {{[-a|--and]}} {{regex_2}} {{[-a|--and]}} {{regex_3}}

Search for pages that match all the `regex` given:

🔍

arjun

View Details ▼

Discover HTTP parameters for web applications.

arjun -u {{https://example.com/page.php}}

Scan a URL for GET parameters:

arjun -u {{https://example.com/api}} -m POST

Scan using POST method:

arjun -u {{https://example.com}} -o {{path/to/output.json}}

Save discovered parameters to a JSON file:

🔍

arp-scan

View Details ▼

Send ARP packets to hosts (specified as IP addresses or hostnames) to scan the local network.

arp-scan {{[-l|--localnet]}}

Scan the current local network:

arp-scan {{10.0.0.1}}

Scan a specific host:

arp-scan {{192.168.1.1}}/{{24}}

Scan an IP network with a custom bitmask:

🔍

banner

View Details ▼

Print the argument as a large ASCII art.

banner "{{Hello World}}"

Print the text message as a large banner (quotes are optional):

banner {{[-w|--width]}} 50 "{{Hello World}}"

Use a banner width of 50 characters:

banner

Read text from `stdin`:

🔍

chisel

View Details ▼

Create TCP/UDP tunnels, transported over HTTP, secured via SSH.
Includes both client and server in the same `chisel` executable.

chisel server

Run a Chisel server:

chisel server {{[-p|--port]}} {{server_port}}

Run a Chisel server listening to a specific port:

chisel server --auth {{username}}:{{password}}

Run a chisel server that accepts authenticated connections using username and password:

🔍

claude

View Details ▼

An agent-based coding tool that understands your code base and helps you code faster through natural language commands.

claude prompt

Execute with prompt:

claude update

Update `claude`:

claude mcp list

Get the list of specified MCP servers:

🔍

cron

View Details ▼

A system scheduler for running jobs or tasks unattended.
The command to submit, edit, or delete entries to `cron` is called `crontab`.

tldr crontab

View documentation for managing `cron` entries:

🔍

crunch

View Details ▼

Wordlist generator.

crunch {{1}} {{3}}

Output a list of words of length 1 to 3 with only lowercase characters:

crunch {{8}} {{8}} {{0123456789abcdef}}

Output a list of hexadecimal words of length 8:

crunch {{1}} {{1}} -p {{abc}}

Output a list of all permutations of abc (lengths are not processed):

🔍

dig

View Details ▼

DNS lookup utility.
See also: `resolvectl`, `nslookup`, `host`.

dig +short {{example.com}}

Lookup the IP(s) associated with a hostname (A records):

dig +noall +answer {{example.com}}

Get a detailed answer for a given domain (A records):

dig +short {{example.com}} {{A|MX|TXT|CNAME|NS}}

Query a specific DNS record type associated with a given domain name:

🔍

dirsearch

View Details ▼

Web path scanner.

dirsearch {{[-u|--url]}} {{url}} --extensions-list

Scan a web server for common paths with common extensions:

dirsearch {{[-l|--url-list]}} {{path/to/url-list.txt}} {{[-e|--extensions]}} {{php,jsp,aspx,...}}

Scan a list of web servers for common paths with given file extensions:

dirsearch {{[-u|--url]}} {{url}} --extensions-list {{[-w|--wordlists]}} {{path/to/url-paths1.txt,path/to/url-paths2.txt,...}}

Scan a web server for user-defined paths with common extensions:

🔍

edit

View Details ▼

A terminal-based text editor from Microsoft.

edit {{path/to/file}}

Open a file:

tldr run-mailcap

View documentation for the original command:

<Ctrl f>{{pattern}}<Enter>

Search for a pattern:

🔍

feroxbuster

View Details ▼

Simple, fast, recursive content discovery tool written in Rust.
Used to brute-force hidden paths on web servers and more.

feroxbuster --url "{{https://example.com}}" --wordlist {{path/to/file}} --threads {{100}} --extensions "{{php,txt}}" --random-agent

Discover specific directories and files that match in the wordlist with extensions and 100 threads and a random user-agent:

feroxbuster --url "{{https://example.com}}" --wordlist {{path/to/file}} --no-recursion --proxy "{{http://127.0.0.1:8080}}"

Enumerate directories without recursion through a specific proxy:

feroxbuster --url "{{https://example.com}}" --extract-links

Find links in webpages:

🔍

ffuf

View Details ▼

A fast web fuzzer written in Go.
The `FUZZ` keyword is used as a placeholder. `ffuf` will try to hit the URL by replacing the word `FUZZ` with every word in the wordlist.

ffuf -c -w {{path/to/wordlist.txt}} -u {{https://example.com/FUZZ}}

Enumerate directories using [c]olored output and a [w]ordlist specifying a target [u]RL:

ffuf -w {{path/to/subdomains.txt}} -u {{https://FUZZ.example.com}}

Enumerate webservers of subdomains by changing the position of the keyword:

ffuf -o -w {{path/to/wordlist.txt}} -u {{https://example.com/FUZZ}} -t {{500}} -x {{http://127.0.0.1:8080}}

Fuzz with specified [t]hreads (default: 40) and pro[x]ying the traffic and save [o]utput to a file:

🔍

ftp

View Details ▼

Tools to interact with a server via File Transfer Protocol.

ftp {{ftp.example.com}}

Connect to an FTP server and run in interactive mode:

ftp {{host}}

Connect to a remote FTP server interactively:

ftp {{ip_address}} {{port}}

Connect to an FTP server specifying its IP address and port:

🔍

gcc

View Details ▼

Preprocess and compile C and C++ source files, then assemble and link them together.
Part of GCC (GNU Compiler Collection).

gcc {{path/to/source1.c path/to/source2.c ...}} {{[-o|--output]}} {{path/to/output_executable}}

Compile multiple source files into an executable:

gcc {{path/to/source.c}} -Wall {{[-o|--output]}} {{output_executable}}

Activate output of all errors and warnings:

gcc {{path/to/source.c}} -Wall {{[-g|--debug]}} -Og {{[-o|--output]}} {{path/to/output_executable}}

Show common warnings, debug symbols in output, and optimize without affecting debugging:

🔍

git clone

View Details ▼

Clone an existing repository.

git clone {{remote_repository_location}} {{path/to/directory}}

Clone an existing repository into a new directory (the default directory is the repository name):

git clone --recursive {{remote_repository_location}}

Clone an existing repository and its submodules:

git clone {{[-n|--no-checkout]}} {{remote_repository_location}}

Clone only the `.git` directory of an existing repository:

🔍

git

View Details ▼

Distributed version control system.
Some subcommands such as `commit`, `add`, `branch`, `switch`, `push`, etc. have their own usage documentation.

git init

Create an empty Git repository:

git clone {{https://example.com/repo.git}}

Clone a remote Git repository from the internet:

git status

View the status of the local repository:

🔍

gobuster

View Details ▼

Brute-forces hidden paths on web servers and more.

gobuster dir {{[-u|--url]}} {{https://example.com/}} {{[-w|--wordlist]}} {{path/to/file}}

Discover directories and files that match in the wordlist:

gobuster dns {{[-do|--domain]}} {{example.com}} {{[-w|--wordlist]}} {{path/to/file}}

Discover subdomains:

gobuster s3 {{[-w|--wordlist]}} {{path/to/file}}

Discover Amazon S3 buckets:

🔍

hashcat

View Details ▼

Fast and advanced password recovery tool.

hashcat {{[-m|--hash-type]}} {{hash_type_id}} {{[-a|--attack-mode]}} 3 {{hash_value}}

Perform a brute-force attack (mode 3) with the default hashcat mask:

hashcat {{[-m|--hash-type]}} {{hash_type_id}} {{[-a|--attack-mode]}} 3 {{hash_value}} "{{?d?d?d?d}}"

Perform a brute-force attack (mode 3) with a known pattern of 4 digits:

hashcat {{[-m|--hash-type]}} {{hash_type_id}} {{[-a|--attack-mode]}} 3 --increment {{hash_value}} "{{?a?a?a?a?a?a?a?a}}"

Perform a brute-force attack (mode 3) using at most 8 of all printable ASCII characters:

🔍

hello

View Details ▼

Print "Hello, world!", "hello, world", or a customizable text.

hello

Print "Hello, world!":

hello {{[-t|--traditional]}}

Print "hello, world", the traditional type:

hello {{[-g|--greeting]}} "{{greeting_text}}"

Print a text message:

🔍

htop

View Details ▼

Display dynamic real-time information about running processes.
An enhanced version of `top`.
See also: `top`, `atop`, `glances`, `btop`, `btm`.

htop

Start `htop`:

htop {{[-u|--user]}} {{username}}

Start `htop` displaying processes owned by a specific user:

htop {{[-t|--tree]}}

Display processes hierarchically in a tree view to show the parent-child relationships:

🔍

httprobe

View Details ▼

Take a list of domains and probe for working HTTP and HTTPS servers.

cat {{input_file}} | httprobe

Probe a list of domains from a text file:

cat {{input_file}} | httprobe --prefer-https

Only check for HTTP if HTTPS is not working:

cat {{input_file}} | httprobe -p {{https:2222}}

Probe additional ports with a given protocol:

🔍

hydra

View Details ▼

Online password guessing tool.
Protocols supported include FTP, HTTP(S), SMTP, SNMP, XMPP, SSH, and more.

hydra-wizard

Start Hydra's wizard:

hydra -l {{username}} -P {{path/to/wordlist.txt}} {{host_ip}} {{ssh}}

Guess SSH credentials using a given username and a list of passwords:

hydra -L {{path/to/usernames.txt}} -P {{path/to/wordlist.txt}} {{host_ip}} {{https-post-form}} "{{url_without_host}}:{{https_post_request}}:{{login_failed_string}}"

Guess HTTPS webform credentials using two specific lists of usernames and passwords ("https_post_request" can be like "username=^USER^&password=^PASS^"):

🔍

ipinfo

View Details ▼

Official CLI for the IPinfo.io IP geolocation and network intelligence API.
Note: Some commands will require a token from IPinfo.io.

ipinfo myip

Display details for your current IP address:

ipinfo {{ip_address}}

Display details for a specific IP address:

ipinfo bulk {{path/to/ips.txt}}

Display details for multiple IP addresses in bulk from a file:

🔍

john

View Details ▼

Password cracker.

john {{path/to/hashes.txt}}

Crack password hashes:

john --show {{path/to/hashes.txt}}

Show passwords cracked:

john --show --users={{user_ids}} {{path/to/hashes1.txt path/to/hashes2.txt ...}}

Display users' cracked passwords by user identifier from multiple files:

🔍

lazygit

View Details ▼

A simple terminal UI for Git commands, providing an intuitive interface for managing repositories.

lazygit

Open Lazygit in the current repository:

lazygit {{[-p|--path]}} {{path/to/repository}}

Open Lazygit for a specific Git repository:

lazygit {{status|branch|log|stash|...}}

Start Lazygit with focus on a specific panel:

🔍

ldapsearch

View Details ▼

Query an LDAP directory.

ldapsearch {{[-D|--bindDN]}} '{{admin_DN}}' {{[-w|--bindPassword]}} '{{password}}' {{[-h|--hostname]}} {{ldap_host}} {{[-b|--baseDN]}} {{base_ou}} '{{memberOf=group1}}' displayName

Query an LDAP server for all items that are a member of the given group and return the object's displayName value:

ldapsearch {{[-D|--bindDN]}} '{{admin_DN}}' {{[-u|--keyStorePasswordFile]}} '{{password_file}}' {{[-h|--hostname]}} {{ldap_host}} {{[-b|--baseDN]}} {{base_ou}} '{{memberOf=group1}}' displayName

Query an LDAP server with a no-newline password file for all items that are a member of the given group and return the object's displayName value:

ldapsearch {{[-D|--bindDN]}} '{{admin_DN}}' {{[-w|--bindPassword]}} '{{password}}' {{[-h|--hostname]}} {{ldap_host}} {{[-b|--baseDN]}} {{base_ou}} '{{memberOf=group1}}' {{[-z|--sizeLimit]}} 5 displayName

Return 5 items that match the given filter:

🔍

logout

View Details ▼

Exit a login shell.

logout

Exit a login shell:

logout {{exit_code}}

Exit a login shell and specify a return value:

🔍

medusa

View Details ▼

A modular and parallel login brute-forcer for a variety of protocols.

medusa -d

List all installed modules:

medusa -M {{ssh|http|web-form|postgres|ftp|mysql|...}} -q

Show usage example of a specific module (use `medusa -d` for listing all installed modules):

medusa -M ftp -h host -U {{path/to/username_file}} -P {{path/to/password_file}}

Execute brute force against an FTP server using a file containing usernames and a file containing passwords:

🔍

msfvenom

View Details ▼

Manually generate payloads for metasploit.

msfvenom {{[-l|--list]}} payloads

List payloads:

msfvenom {{[-l|--list]}} formats

List formats:

msfvenom {{[-p|--payload]}} {{payload}} --list-options

Show payload options:

🔍

nano

View Details ▼

Text editor. An enhanced `pico` clone.
See also: `pico`, `rnano`.

nano {{path/to/file1 path/to/file2 ...}}

Open specific files, moving to the next file after closing the previous one:

nano {{[-I|--ignorercfiles]}}

Start the editor without using configuration files:

nano +{{line}},{{column}} {{path/to/file}}

Open a file and position the cursor at a specific line and column:

🔍

nbtscan

View Details ▼

Scan networks for NetBIOS name information.

nbtscan {{192.168.0.1/24}}

Scan a network for NetBIOS names:

nbtscan {{192.168.0.1}}

Scan a single IP address:

nbtscan -v {{192.168.0.1/24}}

Display verbose output:

🔍

netexec

View Details ▼

This command is an alias of `nxc`.

tldr nxc

View documentation for the original command:

🔍

next

View Details ▼

React framework that uses server-side rendering for building optimized web applications.

next dev

Start the current application in development mode:

next dev {{[-p|--port]}} {{port}}

Start the current application and listen on a specific port:

next build

Build the current application optimized for production:

🔍

ngrok

View Details ▼

Reverse proxy that creates a secure tunnel from a public endpoint to a locally running web service.

ngrok http {{80}}

Expose a local HTTP service on a given port:

ngrok http {{example.com}}:{{80}}

Expose a local HTTP service on a specific host:

ngrok http https://localhost

Expose a local HTTPS server:

🔍

nikto

View Details ▼

Web server scanner which performs tests against web servers for multiple items.

perl nikto.pl {{[-h|-host]}} {{192.168.0.1}}

Perform a basic Nikto scan against a target host:

perl nikto.pl {{[-h|-host]}} {{192.168.0.1}} {{[-p|-port]}} {{443}}

Specify the port number when performing a basic scan:

perl nikto.pl {{[-h|-host]}} {{https://192.168.0.1:443/}}

Scan ports and protocols with full URL syntax:

🔍

npm run

View Details ▼

Run a script.

npm run

List available scripts:

npm run {{script_name}}

Run a script:

npm run {{script_name}} -- {{argument}} {{--option}}

Pass arguments to a script:

🔍

nuclei

View Details ▼

Fast and customizable vulnerability scanner using a simple YAML-based DSL.

nuclei {{[-ut|-update-templates]}}

Update `nuclei` templates to the latest released version (downloaded to `~/nuclei-templates` on macOS/Linux or `%USERPROFILE%\nuclei-templates` on Windows):

nuclei -tl {{[-pt|-type]}} {{dns|file|http|headless|tcp|workflow|ssl|websocket|whois|code|javascript}}

[l]ist all [t]emplates by specific [p]rotocol [t]ype:

nuclei {{[-as|-automatic-scan]}} {{[-u|-target]}} {{example.com}}

Run an automatic web scan using Wappalyzer technology detection for a specific target [u]RL/host:

🔍

openssl s_client

View Details ▼

Create TLS client connections.

openssl s_client -connect {{host}}:{{port}} 2>/dev/null | openssl x509 -noout -dates

Display the start and expiry dates for a domain's certificate:

openssl < /dev/null s_client -connect {{host}}:{{port}}

Display the certificate presented by an SSL/TLS server:

openssl s_client -connect {{host}}:{{port}} -servername {{hostname}}

Set the Server Name Indicator (SNI) when connecting to the SSL/TLS server:

🔍

pip install

View Details ▼

Install Python packages.

pip install {{package1 package2 ...}}

Install one or more packages:

pip install {{package1 package2 ...}} {{[-U|--upgrade]}}

Upgrade all specified packages to the latest version, installing any that are not already present:

pip install {{package}}=={{version}}

Install a specific version of a package:

🔍

pop

View Details ▼

Send emails from your terminal.

pop

Launch the Text-based User Interface:

pop < {{path/to/message.md}} --from {{[email protected]}} --to {{[email protected]}} --subject "{{On the Subject of Ducks...}}" --attach {{path/to/attachment}}

Send an email using the content of a Markdown file as body:

pop --help

Display help:

🔍

pup

View Details ▼

HTML parsing tool.

cat {{index.html}} | pup --color

Transform a raw HTML file into a cleaned, indented, and colored format:

cat {{index.html}} | pup '{{tag}}'

Filter HTML by element tag name:

cat {{index.html}} | pup '{{div#id}}'

Filter HTML by ID:

🔍

python3

View Details ▼

This command is an alias of `python`.

tldr python

View documentation for the original command:

🔍

route

View Details ▼

Show and manipulate the route table.

route -n

Display the information of route table:

sudo route add "{{destination_ip_address}}" "{{gateway_address}}"

Add a route to a destination through a gateway:

sudo route add -net {{ip_address}} netmask {{netmask_address}} gw {{gw_address}}

Add route rule:

🔍

rsync

View Details ▼

Transfer files either to or from a remote host (but not between two remote hosts), by default using SSH.
To specify a remote path, use `user@host:path/to/file_or_directory`.

rsync {{path/to/source}} {{path/to/destination}}

Transfer a file (use `--dry-run` to simulate the transfer):

rsync {{[-a|--archive]}} {{path/to/source}} {{path/to/destination}}

Use archive mode (recursively copy directories, copy symlinks without resolving, and preserve permissions, ownership, and modification times):

rsync {{[-zvhP|--compress --verbose --human-readable --partial --progress]}} {{path/to/source}} {{path/to/destination}}

Compress the data as it is sent to the destination, display verbose and human-readable progress, and keep partially transferred files if interrupted:

🔍

scp

View Details ▼

Secure copy.
Copy files between hosts using Secure Copy Protocol over SSH.

scp {{path/to/local_file}} {{remote_host}}:{{path/to/remote_file}}

Copy a local file to a remote host:

scp -P {{port}} {{path/to/local_file}} {{remote_host}}:{{path/to/remote_file}}

Use a specific port when connecting to the remote host:

scp {{remote_host}}:{{path/to/remote_file}} {{path/to/local_directory}}

Copy a file from a remote host to a local directory:

🔍

sherlock

View Details ▼

Find usernames across social networks.
See also: `maigret`.

sherlock {{username}} --output {{path/to/file}}

Search for a specific username on social networks saving the results to a file:

sherlock {{username1 username2 ...}} --folderoutput {{path/to/directory}}

Search for specific usernames on social networks saving the results into a directory:

sherlock --tor {{username}}

Search for a specific username on social networks using the Tor network:

🔍

shred

View Details ▼

Overwrite files to securely delete data.

shred {{path/to/file}}

Overwrite a file:

shred {{[-v|--verbose]}} {{path/to/file}}

Overwrite a file and show progress on the screen:

shred {{[-z|--zero]}} {{path/to/file}}

Overwrite a file, leaving zeros instead of random data:

🔍

smbclient

View Details ▼

FTP-like client to access SMB/CIFS resources on servers.

smbclient {{[-L|--list]}} {{server}} --no-pass

List available shares on a server anonymously:

smbclient //{{server}}/{{share}}

Connect to a share (will prompt for a password):

smbclient {{[-U|--user]}} {{domain/username}} //{{server}}/{{share}}

Connect to a share as a specific user:

🔍

smbmap

View Details ▼

Enumerate samba share drives across an entire domain.

smbmap --host-file {{path/to/file}}

Enumerate hosts with NULL sessions enabled and open shares:

smbmap {{[-u|--username]}} {{username}} --prompt -H {{ip_address}}

Display SMB shares and permissions on a [H]ost, prompting for user's password or NTLM hash:

smbmap {{[-u|--username]}} {{username}} --prompt -H {{ip_address}} -x {{command}}

Execute a shell command on a remote system:

🔍

snmpwalk

View Details ▼

SNMP query tool.

snmpwalk -v 1 -c {{community}} {{ip_address}}

Query the system information of a remote host using SNMPv1 and a community string:

snmpwalk -v 2c -c {{community}} {{ip_address}}:{{port}} {{oid}}

Query system information on a remote host by OID using SNMPv2 on a specified port:

snmpwalk -v 3 -l {{authNoPriv}} -u {{username}} -a {{MD5|SHA}} -A {{passphrase}} {{ip_address}} {{oid}}

Query system information on a remote host by OID using SNMPv3 and authentication without encryption:

🔍

socat

View Details ▼

Multipurpose relay (SOcket CAT).

sudo socat - TCP-LISTEN:8080,fork

Listen to a port, wait for an incoming connection and transfer data to STDIO:

sudo socat OPENSSL-LISTEN:4433,reuseaddr,cert=./cert.pem,cafile=./ca.cert.pem,key=./key.pem,verify=0 STDOUT

Listen on a port using SSL and print to `stdout`:

sudo socat - TCP4:www.example.com:80

Create a connection to a host and port, transfer data in STDIO to connected host:

🔍

sqlmap

View Details ▼

Detect and exploit SQL injection flaws.

python sqlmap.py {{[-u|--url]}} "{{http://www.example.com/vuln.php?id=1}}"

Run sqlmap against a single target URL:

python sqlmap.py {{[-u|--url]}} "{{http://www.example.com/vuln.php}}" --data="{{id=1}}"

Send data in a POST request (`--data` implies POST request):

python sqlmap.py {{[-u|--url]}} "{{http://www.example.com/vuln.php}}" --data="{{query=foobar;id=1}}" --param-del="{{;}}"

Change the parameter delimiter (& is the default):

🔍

ssh

View Details ▼

Secure Shell is a protocol used to securely log onto remote systems.
It can be used for logging or executing commands on a remote server.

ssh {{username}}@{{remote_host}}

Connect to a remote server:

ssh {{username}}@{{remote_host}} -i {{path/to/key_file}}

Connect to a remote server with a specific [i]dentity (private key):

ssh {{username}}@10.0.0.1 -p {{2222}}

Connect to a remote server with IP `10.0.0.1` and using a specific [p]ort (Note: `10.0.0.1` can be shortened to `10.1`):

🔍

sshd

View Details ▼

Secure Shell Daemon - allows remote machines to securely log in to the current machine.
Remote machines can execute commands as it is executed at this machine.

sshd

Start daemon in the background:

sshd -D

Run sshd in the foreground:

sshd -D -d

Run with verbose output (for debugging):

🔍

sslscan

View Details ▼

Check SSL/TLS protocols and ciphers supported by a server.

sslscan {{example.com}}

Test a server on port 443:

sslscan {{example.com}}:{{465}}

Test a specified port:

sslscan --show-certificate {{example.com}}

Show certificate information:

🔍

tcpdump

View Details ▼

Dump traffic on a network.

tcpdump {{[-D|--list-interfaces]}}

List available network interfaces:

sudo tcpdump {{[-i|--interface]}} {{eth0}}

Capture the traffic of a specific interface:

sudo tcpdump -A tcp

Capture all TCP traffic showing contents ([A]SCII) in console:

🔍

time

View Details ▼

Measure how long a command took to run.
Note: `time` can either exist as a shell builtin, a standalone program, or both.
See also: `times`.

time {{command}}

Run the `command` and print the time measurements to `stdout`:

time

Display the current system time and prompt to enter a new time (leave empty to keep unchanged):

time read

Create a very simple stopwatch (only works in Bash):

🔍

tree

View Details ▼

Show the contents of the current directory as a tree.

tree -L {{num}}

Print files and directories up to `num` levels of depth (where 1 means the current directory):

tree

Display the tree for the current directory:

tree -d

Print directories only:

🔍

trufflehog

View Details ▼

Find and verify credentials in files, Git repositories, S3 buckets, and Docker images.

trufflehog git {{https://github.com/trufflesecurity/test_keys}} --only-verified

Scan a Git repository for verified secrets:

trufflehog github --org {{trufflesecurity}} --only-verified

Scan a GitHub organization for verified secrets:

trufflehog git {{https://github.com/trufflesecurity/test_keys}} --only-verified --json

Scan a GitHub repository for verified keys and get JSON output:

🔍

unzip

View Details ▼

Extract files/directories from Zip archives.
See also: `zip`.

unzip {{path/to/archive1.zip path/to/archive2.zip ...}}

Extract all files/directories from specific archives into the current directory:

unzip {{path/to/archive1.zip path/to/archive2.zip ...}} -d {{path/to/output}}

Extract files/directories from archives to a specific path:

unzip -c {{path/to/archive1.zip path/to/archive2.zip ...}}

Extract files/directories from archives to `stdout` alongside the extracted file names:

🔍

venv

View Details ▼

Create lightweight virtual environments in Python.

python -m venv {{path/to/virtual_environment}}

Create a Python virtual environment:

{{[.|source]}} {{path/to/virtual_environment}}/bin/activate

Activate the virtual environment (Linux and macOS):

{{path\to\virtual_environment}}\Scripts\activate.bat

Activate the virtual environment (Windows):

🔍

wfuzz

View Details ▼

A web application bruteforcer.

wfuzz -w {{path/to/file}} -p {{127.0.0.1:8080:HTTP}} {{http://example.com/FUZZ}}

Directory and file bruteforce using the specified [w]ordlist and also [p]roxying the traffic:

wfuzz -w {{path/to/file}} -f {{filename}} {{http://example.com/FUZZ}}

Save the results to a [f]ile:

wfuzz -c -w {{path/to/file}} --sc {{200,301,302}} {{http://example.com/FUZZ}}

Show [c]olorized output while only showing the declared response codes in the output:

🔍

whatweb

View Details ▼

Next-generation web scanner.

whatweb {{website1 website2 ...}}

Scan websites/targets for web technologies:

whatweb {{[-i|--input-file]}} {{targets_file}}

Read targets/websites from a file:

whatweb {{[-v|--verbose]}} {{example.com}}

Scan a website/target in verbose mode:

🔍

wpscan

View Details ▼

WordPress vulnerability scanner.

wpscan --update

Update the vulnerability database:

wpscan --url {{url}}

Scan a WordPress website:

wpscan --url {{url}} --stealthy

Scan a WordPress website, using random user agents and passive detection:

🔍

apt install

View Details ▼

Install packages for Debian-based distributions.

sudo apt install {{package}}

Install a package, or update it to the latest version:

sudo apt install {{[-V|--verbose-versions]}} {{package}}

Display verbose package version information during installation or update:

🔍

cewl

View Details ▼

URL spidering tool for making a cracking wordlist from web content.

cewl {{[-d|--depth]}} 2 {{[-w|--write]}} {{path/to/wordlist.txt}} {{url}}

Create a wordlist file from the given URL up to 2 links depth:

cewl --with-numbers {{[-m|--min_word_length]}} 5 {{url}}

Output an alphanumeric wordlist from the given URL with words of minimum 5 characters:

cewl --debug {{[-e|--email]}} {{url}}

Output a wordlist from the given URL in debug mode including email addresses:

🔍

dnsmap

View Details ▼

The dnsmap command scans a domain for common subdomains e.g. smtp.domain.org.

dnsmap {{example.com}}

Scan for subdomains using the internal wordlist:

dnsmap {{example.com}} -w {{path/to/wordlist.txt}}

Specify a list of subdomains to check for:

dnsmap {{example.com}} -c {{path/to/file.csv}}

Store results to a CSV file:

🔍

enum4linux

View Details ▼

Enumerate Windows and Samba information from remote systems.

enum4linux -a {{remote_host}}

Try to enumerate using all methods:

enum4linux -u {{user_name}} -p {{password}} {{remote_host}}

Enumerate using given login credentials:

enum4linux -U {{remote_host}}

List usernames from a given host:

🔍

getcap

View Details ▼

Display the name and capabilities of each specified file.

getcap {{path/to/file1 path/to/file2 ...}}

Get capabilities for the given files:

getcap -r {{path/to/directory1 path/to/directory2 ...}}

Get capabilities for all the files recursively under the given directories:

getcap -v {{path/to/file1 path/to/file2 ...}}

Display all searched entries even if no capabilities are set:

🔍

ldapdomaindump

View Details ▼

Dump users, computers, groups, OS, and membership information via LDAP to HTML, JSON, and greppable output.
See also: `ldapsearch`.

ldapdomaindump {{[-u|--user]}} {{domain}}\{{username}} {{[-p|--password]}} {{password|ntlm_hash}} {{hostname|ip}}

Dump all information using the given LDAP account:

ldapdomaindump {{[-r|--resolve]}} {{[-u|--user]}} {{domain}}\{{username}} {{[-p|--password]}}{{password}} {{hostname|ip}}

Dump all information, resolving computer hostnames:

ldapdomaindump {{[-r|--resolve]}} {{[-n|--dns-server]}} {{domain_controller_ip}} {{[-u|--user]}} {{domain}}\{{username}} {{[-p|--password]}}{{password}} {{hostname|ip}}

Dump all information, resolving computer hostnames with the selected DNS server:

🔍

links

View Details ▼

Command-line text-only web browser.
See also: `links2`.

links {{https://example.com}}

Visit a website:

links -anonymous {{https://example.com}}

Apply restrictions for anonymous account:

links -enable-cookies {{0|1}} {{https://example.com}}

Enable Cookies (`1` to enable):

🔍

lynis

View Details ▼

System and security auditing tool.

sudo lynis update info

Check that Lynis is up-to-date:

sudo lynis audit system

Run a security audit of the system:

sudo lynis audit dockerfile {{path/to/dockerfile}}

Run a security audit of a Dockerfile:

🔍

ntpdate

View Details ▼

Synchronize and set the date and time via NTP.

sudo ntpdate {{host}}

Synchronize and set date and time:

ntpdate -q {{host}}

Query the host without setting the time:

sudo ntpdate -u {{host}}

Use an unprivileged port in case a firewall is blocking privileged ports:

🔍

ports

View Details ▼

Update/list the ports tree on a CRUX system.

ports -u

Update the ports tree:

ports -l

List the ports in the current tree:

ports -d

Check the differences between installed packages and the ports tree:

🔍

rev

View Details ▼

Reverse a line of text or a file.

rev

Reverse text typed into terminal:

rev {{path/to/file}}

Reverse each line in a file to `stdout`:

echo "hello" | rev

Reverse the text string "hello":

🔍

rpcclient

View Details ▼

MS-RPC client tool (part of the samba suite).

rpcclient {{[-U|--user]}} {{domain}}\{{username}}%{{password}} {{ip_address}}

Connect to a remote host:

rpcclient {{[-U|--user]}} {{username}} {{[-W|--workgroup]}} {{domain}} {{[-N|--no-pass]}} {{ip_address}}

Connect to a remote host on a domain without a password:

rpcclient {{[-U|--user]}} {{domain}}\{{username}} --pw-nt-hash {{ip_address}}

Connect to a remote host, passing the password hash:

🔍

swaks

View Details ▼

Swiss Army Knife SMTP, the all-purpose SMTP transaction tester.

swaks {{[-t|--to]}} {{[email protected]}} {{[-s|--server]}} {{test-server.example.net}}

Deliver a standard test email to `[email protected]` on port 25 of `test-server.example.net`:

swaks {{[-t|--to]}} {{[email protected]}} {{[-f|--from]}} {{[email protected]}} {{[-a|--auth]}} {{CRAM-MD5}} {{[-au|--auth-user]}} {{[email protected]}} --header-X-Test "{{test_email}}"

Deliver a standard test email, requiring CRAM-MD5 authentication as user `[email protected]`. An "X-Test" header will be added to the email body:

swaks {{[-t|--to]}} {{[email protected]}} --attach - {{[-s|--server]}} {{test-server.example.com}} {{[-n|--suppress-data]}} {{path/to/eicar.txt}}

Test a virus scanner using EICAR in an attachment. Don't show the message DATA part:

🔍

tshark

View Details ▼

Packet analysis tool, CLI version of Wireshark.

tshark

Monitor packets from the default interface:

tshark -f '{{udp port 53}}'

Only capture packets matching a specific capture filter:

tshark -Y '{{http.request.method == "GET"}}'

Only show packets matching a specific output filter:

🔍

netsh

View Details ▼

Manage Windows network settings.
Some subcommands such as `wlan` have their own usage documentation.

netsh add helper {{path\to\file.dll}}

Add a helper Dynamic Link Library (DLL):

netsh show helper

Show all loaded helper DLLs:

netsh delete helper {{path\to\file.dll}}

Delete a helper DLL:

🔍

psexec

View Details ▼

Execute a command-line process on a remote machine.
This is an advanced command and it might potentially be dangerous.

psexec \\{{remote_host}} cmd

Execute a command using `cmd` in a remote shell:

psexec \\{{remote_host}} -u {{user_name}} -p {{password}}

Execute a command on a remote host (pre-authenticated):

psexec \\{{remote_host}} cmd /c {{command}} -an ^>{{path\to\file.txt}}

Execute a command remotely and output the result to a file:

# Project Badges

  • LazyOwn_Redteam_framework LazyOwn_Redteam_framework
  • stars stars Visit
  • release release Visit
  • Python Python
  • Shell Script Shell Script
  • image image
  • image image
  • License: GPL v3 License: GPL v3 Visit
  • image image
  • image image
  • Ask DeepWiki Ask DeepWiki Visit
  • Anurag's GitHub stats Anurag's GitHub stats
  • image image
// repository documentation