-
Notifications
You must be signed in to change notification settings - Fork 32
Tool Arsenal
CommonHuman-Lab edited this page Apr 14, 2026
·
1 revision
All tools are callable via MCP (run_tool) or directly from the dashboard.
| Tool | Purpose |
|---|---|
| nmap | Advanced port scanning with NSE scripts and service/version detection |
| nmap_advanced | Custom NSE scripts, OS detection, stealth and aggressive modes |
| rustscan | Ultra-fast port scanner with Nmap hand-off |
| masscan | High-speed Internet-scale port scanning with banner grabbing |
| autorecon | Comprehensive automated multi-service reconnaissance |
| amass | Advanced subdomain enumeration and OSINT gathering |
| subfinder | Fast passive subdomain discovery with multiple API sources |
| assetfinder | Passive asset and subdomain discovery |
| shuffledns | Subdomain bruteforce and resolver with wildcard handling |
| massdns | High-performance DNS resolution and bruteforcing |
| fierce | DNS reconnaissance and zone transfer testing |
| dnsenum | DNS information gathering and subdomain bruteforcing |
| theHarvester | Email and subdomain harvesting from public sources |
| arp-scan | Local network discovery via ARP requests |
| whois | Domain and IP registration lookup |
| dig | DNS record lookup (A, MX, NS, TXT) |
| http-headers | Fetch and inspect HTTP response headers |
| Tool | Purpose |
|---|---|
| gobuster | Directory, file, DNS, and vhost enumeration |
| ffuf | Fast web fuzzer with advanced filtering |
| feroxbuster | Recursive content discovery with intelligent filtering |
| dirsearch | Directory and file discovery with extension support |
| dirb | Web content scanner |
| wfuzz | Web application fuzzer with payload generation |
| dotdotpwn | Directory traversal testing |
| httpx | Fast HTTP probing and technology detection |
| testssl | SSL/TLS configuration and vulnerability assessment |
| katana | Next-generation crawling with JavaScript support |
| hakrawler | Fast web endpoint discovery and crawling |
| gospider | Web crawler with 3rd-party URL source support |
| gau | Get All URLs from Wayback, Common Crawl, OTX, URLScan |
| waybackurls | Historical URL discovery from Wayback Machine |
| waymore | URL and response discovery from multiple archive sources |
| nuclei | Fast vulnerability scanner with 4000+ templates |
| nikto | Web server vulnerability scanner |
| sqlmap | Automatic SQL injection testing with tamper scripts |
| dalfox | Advanced XSS scanning with DOM analysis |
| wpscan | WordPress security scanner |
| joomscan | Joomla vulnerability scanner |
| jaeles | Vulnerability scanning with custom signatures |
| xsser | XSS vulnerability testing |
| commix | Command injection exploitation |
| burpsuite | Advanced web security testing platform |
| zaproxy | OWASP ZAP automated security scanning |
| wafw00f | Web application firewall fingerprinting |
| whatweb | Web technology identification and fingerprinting |
| arjun | HTTP parameter discovery |
| paramspider | Parameter mining from web archives |
| x8 | Hidden parameter discovery |
| anew | Append unique lines for pipeline data processing |
| hurl | String encoding, decoding, and hashing |
| qsreplace | Query string parameter replacement |
| uro | URL filtering and deduplication |
| graphql-scanner | GraphQL schema enumeration and introspection testing |
| jwt-analyzer | JWT algorithm confusion and secret attacks |
| api-schema-analyzer | Swagger/OpenAPI schema parsing and attack surface mapping |
| api_fuzzer | REST API endpoint fuzzing |
| http-framework | HTTP request framework for custom scripting |
| browser_agent | Headless Chrome automation with DOM analysis, form detection, screenshot capture, and network monitoring |
| Tool | Purpose |
|---|---|
| aircrack-ng | WPA/WPA2 PSK cracking from captured handshakes |
| airmon-ng | Enable/disable monitor mode, kill interfering processes |
| airodump-ng | Passive 802.11 packet capture for AP discovery and handshakes |
| aireplay-ng | Packet injection: deauth, fake auth, ARP replay |
| airbase-ng | Rogue/soft AP creation for Evil Twin attacks |
| airdecap-ng | Decrypt WEP/WPA/WPA2 encrypted pcap files |
| hcxdumptool | Clientless PMKID capture and handshake collection |
| hcxpcapngtool | Convert hcxdumptool pcapng to hashcat -m 22000 format |
| eaphammer | WPA-Enterprise Evil Twin for EAP credential harvesting |
| wifite | Automated WiFi auditing: PMKID, handshake, WPS |
| bettercap | WiFi recon, deauth, and Evil Twin via caplet system |
| mdk4 | 802.11 protocol stress testing and WIDS/WIPS evasion |
| wireshark | Packet capture and protocol analysis (GUI) |
| tshark | Command-line Wireshark for packet capture and filtering |
| tcpdump | Lightweight packet capture |
| kismet | Wireless network detector and packet sniffer |
| Tool | Purpose |
|---|---|
| hydra | Network login cracker supporting 50+ protocols |
| john | Password hash cracking with custom rules |
| hashcat | GPU-accelerated password recovery with 300+ hash types |
| medusa | Speedy parallel modular login brute-forcer |
| patator | Multi-purpose brute-forcer with advanced modules |
| hashid | Hash algorithm identification with confidence scoring |
| ophcrack | Windows password cracking via rainbow tables |
| responder | LLMNR/NBT-NS/MDNS poisoning for credential harvesting |
| Tool | Purpose |
|---|---|
| enum4linux | SMB enumeration: users, groups, shares |
| enum4linux-ng | Advanced SMB enumeration with enhanced output |
| nxc | NetExec — network service exploitation framework |
| smbmap | SMB share enumeration and file access |
| nbtscan | NetBIOS name scanning |
| rpcclient | RPC enumeration and null sessions |
| evil-winrm | Windows Remote Management shell with PowerShell |
| ldapdomaindump | Active Directory LDAP enumeration |
| impacket-scripts | Impacket suite: psexec, secretsdump, GetADUsers, GetUserSPNs, wmiexec |
| Tool | Purpose |
|---|---|
| gdb | GNU Debugger with Python scripting |
| radare2 | Advanced reverse engineering framework |
| ghidra | NSA software reverse engineering suite (headless) |
| binwalk | Firmware analysis and extraction |
| checksec | Binary security property checker |
| strings | Extract printable strings from binaries |
| objdump | Object file disassembly and analysis |
| xxd | Hex dump with formatting |
| ropgadget | ROP/JOP gadget finder |
| ropper | ROP gadget finder for exploit development |
| one-gadget | Find one-shot RCE gadgets in libc |
| angr | Binary analysis with symbolic execution |
| pwntools | CTF framework and exploit development library |
| pwninit | Automate binary exploitation setup |
| libc-database | Libc identification and offset lookup |
| autopsy | Digital forensics platform with timeline analysis |
| Tool | Purpose |
|---|---|
| msfconsole | Metasploit framework — full module execution |
| msfvenom | Metasploit payload generator with encoding |
| searchsploit | Exploit-DB local search |
| pwntools | CTF framework and exploit development |
| pwninit | Binary exploitation setup automation |
| commix | Command injection exploitation |
| Tool | Purpose |
|---|---|
| prowler | AWS/Azure/GCP security assessment with compliance checks |
| scout-suite | Multi-cloud security auditing |
| cloudmapper | AWS network visualization and analysis |
| pacu | AWS exploitation framework |
| trivy | Vulnerability scanner for containers and IaC |
| clair | Container vulnerability analysis |
| docker-bench-security | CIS Docker benchmark assessment |
| kube-hunter | Kubernetes penetration testing |
| kube-bench | CIS Kubernetes benchmark checker |
| checkov | Infrastructure as code security scanning |
| terrascan | IaC security scanner with policy-as-code |
| falco | Runtime security monitoring for containers |
| Tool | Purpose |
|---|---|
| sherlock | Username investigation across 400+ social networks |
| spiderfoot | OSINT automation with 200+ modules |
| sublist3r | Subdomain enumeration using OSINT sources |
| parsero | robots.txt analysis and hidden path discovery |
| joomscan | Joomla vulnerability and OSINT scanner |
| recon-ng | Web reconnaissance framework with modular architecture |
| trufflehog | Git repository secret scanning with entropy analysis |
| Tool | Purpose |
|---|---|
| volatility | Memory forensics with comprehensive plugin support |
| vol (volatility3) | Next-generation memory forensics |
| foremost | File carving and data recovery |
| steghide | Steganography detection and extraction |
| exiftool | Metadata reader/writer for all file formats |
| hashpump | Hash length extension attack tool |
| photorec | File recovery with advanced carving capabilities |
| testdisk | Disk partition recovery and repair |
| scalpel | File carving with configurable signatures |
| bulk_extractor | Digital forensics feature extraction |
| stegsolve | Steganography analysis with visual inspection |
| zsteg | PNG/BMP steganography detection |
| outguess | JPEG steganography tool |
| file | File type identification |
| sleuthkit | Command-line digital forensics tools |
| Tool | Purpose |
|---|---|
| mysql | Direct SQL querying and enumeration for MySQL/MariaDB |
| sqlite3 | Local file-based SQL querying for SQLite |