hackingtool/docs/TOOLS.md

Tool catalog

Every tool hackingtool can install, launch, or point you at — 215 active tools across 21 categories, plus 59 archived entries kept out of this list (they are unmaintained or dead upstream and are hidden in the app unless you set show_archived true via /config).

Tags under each entry come from the fixed taxonomy in src/hackingtool/tags.py (63 tags in use). Inside the app you can filter by any of them with @tag:<name>, or search names/descriptions/tags with /search <keyword>.

Entries marked as a link point at the upstream project; a few are curated reference resources (labs, cheat sheets, online services) rather than installable binaries — hackingtool opens those instead of installing them.

Authorized targets only. Every tool here is for systems you own or have written permission to test.

Back to the README · How to use hackingtool

---

🛡 Anonymously Hiding Tools

• Anonymously Surf — _{anonymity, tunneling, network}
• Multitor — _{anonymity, tunneling, network}
• Tor + torsocks (SOCKS anonymity proxy) — _{anonymity, tunneling, network}
• proxychains-ng (chain traffic through proxies/Tor) — _{anonymity, tunneling, network}
• Whonix — Anonymity & Tor OpSec (docs) — _{anonymity, reference, learning}

🔍 Information gathering tools

• Network Map (nmap) — _{scanner, port-scan, recon, network}
• Port scanning — _{port-scan, scanner, network}
• Host to IP — _{recon, dns, lookup}
• RED HAWK (All In One Scanning) — _{web, recon, scanner, fingerprint}
• ReconSpider(For All Scanning) — _{osint, recon, crawler}
• IsItDown (Check Website Down/Up) — _{recon, online-service, web}
• SecretFinder (like API & etc) — _{web, recon, credentials, git-secrets}
• Port Scanner - rang3r — _{port-scan, scanner, network}
• Breacher — _{web, recon, enumeration}
• theHarvester (OSINT) — _{osint, email, subdomain-enum, recon}
• Amass (Attack Surface Mapping) — _{subdomain-enum, recon, osint, dns}
• Masscan (Fast Port Scanner) — _{port-scan, scanner, network}
• RustScan (Modern Port Scanner) — _{port-scan, scanner, network}
• Holehe (Email → Social Accounts) — _{osint, email, recon, lookup}
• Maigret (Username OSINT) — _{osint, recon, lookup}
• httpx (HTTP Toolkit) — _{web, recon, scanner, fingerprint}
• SpiderFoot (OSINT Automation) — _{osint, recon, subdomain-enum}
• Subfinder (Subdomain Enumeration) — _{subdomain-enum, recon, osint, dns}
• TruffleHog (Secret Scanner) — _{git-secrets, credentials, recon}
• Gitleaks (Git Secret Scanner) — _{git-secrets, credentials, reporting}
• naabu (fast port scanner) — _{port-scan, recon, network}
• dnsx (DNS toolkit) — _{dns, recon, enumeration}
• reconFTW (Automated Recon) — _{recon, osint, subdomain-enum, scanner, dns}
• gowitness (Web Screenshots) — _{web, recon, fingerprint, reporting}
• EyeWitness (Web Screenshots + Headers) — _{web, recon, fingerprint, reporting}
• Sn1per (Attack Surface Scanner) — _{scanner, recon, vuln-scan, enumeration, web}

📚 Wordlist Generator

• Cupp — _{wordlist, password-attack, credentials, osint}
• Hashcat (Password Cracker) — _{hash-crack, password-attack, credentials}
• John the Ripper — _{hash-crack, password-attack, credentials}
• haiti (Hash Type Identifier) — _{hash-crack, lookup, reference}
• crunch (Wordlist Generator) — _{wordlist, bruteforce, password-attack}
• CeWL (Custom Word List) — _{wordlist, osint, recon, credentials}
• SecLists (Wordlist Collection) — _{wordlist, reference, bruteforce}
• Kali wordlists package (rockyou etc.) — _{wordlist, reference, password-attack}

📡 Wireless attack tools

• WiFi-Pumpkin — _{wireless, mitm, phishing, credentials}
• pixiewps — _{wireless, bruteforce, password-attack}
• Bluetooth Honeypot GUI Framework — _{wireless, sniffing}
• Fluxion — _{wireless, phishing, social-engineering, credentials}
• Wifiphisher — _{wireless, phishing, social-engineering, mitm}
• Wifite — _{wireless, password-attack, bruteforce, credentials}
• Howmanypeople — _{wireless, sniffing, recon}
• Airgeddon (Wireless Attack Suite) — _{wireless, password-attack, mitm, credentials}
• hcxdumptool (PMKID Capture) — _{wireless, sniffing, pcap, credentials}
• hcxtools (PMKID/Hash Conversion) — _{wireless, hash-crack, pcap, credentials}
• Bettercap (Network/WiFi/BLE MITM) — _{wireless, mitm, sniffing, network}
• aircrack-ng (WiFi security suite) — _{wireless, password-attack, bruteforce, sniffing}
• Kismet (wireless detector / WIDS) — _{wireless, sniffing, recon, network}
• Reaver (WPS PIN attack) — _{wireless, bruteforce, password-attack, credentials}
• WiGLE (wardriving map & API) — _{wireless, osint, online-service, lookup}
• hashcat example hashes (WPA mode 22000) — _{wireless, hash-crack, reference}
• Aircrack-ng: cracking WPA (tutorial) — _{wireless, learning, reference}

💉 SQL Injection Tools

• Sqlmap tool — _{web, sql-injection, exploitation, scanner}
• NoSqlMap — _{web, sql-injection, exploitation}
• Damn Small SQLi Scanner — _{web, sql-injection, scanner}
• SQLScan — _{web, sql-injection, scanner}
• Ghauri (Modern SQLi Tool) — _{web, sql-injection, exploitation, scanner}
• PortSwigger — SQL Injection Labs — _{learning, web, sql-injection, reference}
• PayloadsAllTheThings — SQL Injection — _{cheatsheet, reference, sql-injection, web}

🎣 Phishing attack tools

• AdvPhishing — _{phishing, social-engineering, credentials}
• Setoolkit — _{social-engineering, phishing, credentials}
• SocialFish — _{phishing, credentials, web}
• HiddenEye — _{phishing, credentials, social-engineering}
• Evilginx3 — _{phishing, mitm, credentials, web}
• SayCheese — _{social-engineering, phishing}
• QR Code Jacking — _{phishing, social-engineering}
• QRLJacking — _{phishing, social-engineering, credentials}
• Maskphish — _{phishing, social-engineering}
• dnstwist — _{osint, dns, phishing}
• GoPhish (Phishing Simulation) — _{phishing, social-engineering, email, credentials, web}
• GoPhish Documentation — _{phishing, reference, learning}
• MITRE ATT&CK — Phishing (T1566) — _{phishing, social-engineering, reference}

🌐 Web Attack tools

• Skipfish — _{web, vuln-scan, scanner, crawler}
• SubDomain Finder — _{subdomain-enum, recon, osint, dns}
• Sub-Domain TakeOver — _{subdomain-enum, web, vuln-scan}
• Dirb — _{web, enumeration, bruteforce, wordlist}
• Nuclei (Vulnerability Scanner) — _{web, vuln-scan, scanner}
• ffuf (Web Fuzzer) — _{web, fuzzing, enumeration, wordlist}
• Feroxbuster (Directory Brute Force) — _{web, enumeration, bruteforce, wordlist}
• Nikto (Web Server Scanner) — _{web, vuln-scan, scanner}
• wafw00f (WAF Detector) — _{web, fingerprint, recon}
• Katana (Web Crawler) — _{web, crawler, recon, enumeration}
• Gobuster (Dir/DNS/Vhost Brute Force) — _{web, enumeration, bruteforce, dns, wordlist}
• Dirsearch (Web Path Discovery) — _{web, enumeration, bruteforce, wordlist}
• OWASP ZAP (Web App Scanner) — _{web, vuln-scan, scanner, fuzzing}
• testssl.sh (TLS/SSL Checker) — _{web, scanner, fingerprint}
• Arjun (HTTP Parameter Discovery) — _{web, fuzzing, enumeration}
• Caido (Web Security Auditing) — _{web, scanner, crawler}
• mitmproxy (Intercepting Proxy) — _{web, mitm, sniffing}
• WhatWeb (Web Fingerprinter) — _{web, fingerprint, recon, scanner}
• WPScan (WordPress Scanner) — _{web, vuln-scan, scanner, enumeration}
• PortSwigger Web Security Academy — _{learning, web, reference}
• PayloadsAllTheThings — _{cheatsheet, reference, payload, web}
• HackTricks — _{cheatsheet, reference, web, privesc}
• revshells.com (Reverse Shell Generator) — _{reverse-shell, cheatsheet, online-service, web}

🔧 Post exploitation tools

• pwncat-cs (Reverse Shell Handler) — _{post-exploitation, reverse-shell, persistence, privesc}
• Sliver (C2 Framework) — _{c2, post-exploitation, payload}
• PEASS-ng — LinPEAS/WinPEAS (Priv Esc) — _{privesc, post-exploitation, enumeration}
• Ligolo-ng (Tunneling/Pivoting) — _{tunneling, lateral-movement, post-exploitation, network}
• Chisel (HTTP Tunnel) — _{tunneling, lateral-movement, post-exploitation, network}
• Evil-WinRM (Windows Remote Shell) — _{lateral-movement, credentials, post-exploitation, active-directory}
• Mythic (C2 Platform) — _{c2, post-exploitation, lateral-movement}
• pspy (unprivileged process snooping) — _{post-exploitation, privesc, enumeration}
• linux-smart-enumeration (lse.sh) — _{privesc, post-exploitation, enumeration}
• LaZagne (Local Credential Recovery) — _{credentials, post-exploitation, password-attack}
• HackTricks (post-ex / privesc playbook) — _{post-exploitation, privesc, reference, cheatsheet}
• LOLBAS (Windows living-off-the-land binaries) — _{privesc, post-exploitation, reference, cheatsheet}
• revshells.com (reverse shell generator) — _{reverse-shell, post-exploitation, online-service, reference}
• PayloadsAllTheThings (payload + technique cheatsheets) — _{payload, post-exploitation, reference, cheatsheet}
• mimikatz (Windows credential dumping — reference) — _{credentials, post-exploitation, active-directory, reference}

🕵 Forensic tools

• Autopsy — _{forensics, metadata}
• Wireshark — _{network, forensics, sniffing, pcap}
• Bulk extractor — _{forensics, memory-dump, metadata}
• Disk Clone and ISO Image Acquire — _{forensics, binary}
• Toolsley — _{reference, online-service, forensics}
• Volatility 3 (Memory Forensics) — _{forensics, memory-dump, malware-analysis}
• Binwalk (Firmware Analysis) — _{forensics, binary, reversing}
• pspy (Process Monitor — No Root) — _{forensics, post-exploitation, enumeration}
• ExifTool (Metadata) — _{forensics, metadata, image, document}
• Foremost (File Carving) — _{forensics, binary}
• Eric Zimmerman's Tools — _{reference, forensics, online-service}
• MalwareBazaar (Sample Database) — _{online-service, reference, malware-analysis}

📦 Payload creation tools

• The FatRat — _{payload, reverse-shell, apk, c2}
• Stitch — _{payload, c2, reverse-shell, persistence}
• Venom Shellcode Generator — _{payload, reverse-shell, c2}
• Mob-Droid — _{payload, mobile, apk, reverse-shell}
• msfvenom (Payload Generator) — _{payload, reverse-shell, c2, apk}
• LOLBAS (Living Off The Land Binaries) — _{reference, payload, post-exploitation}

🧰 Exploit framework

• RouterSploit — _{network, iot, exploitation, scanner}
• Commix — _{web, exploitation, payload}
• Metasploit Framework — _{exploitation, post-exploitation, payload, c2, scanner}
• SearchSploit (Exploit-DB CLI) — _{exploitation, recon, reference}
• Exploit-DB (Online Archive) — _{online-service, reference, exploitation}
• Metasploit Unleashed (Free Course) — _{learning, reference, exploitation}

🔁 Reverse engineering tools

• Androguard — _{reversing, apk, mobile, malware-analysis}
• Apk2Gold — _{reversing, apk, mobile}
• JadX — _{reversing, apk, mobile}
• Ghidra (NSA Reverse Engineering) — _{reversing, binary, malware-analysis}
• Radare2 (RE Framework) — _{reversing, binary}
• apktool (APK Decode/Rebuild) — _{reversing, apk, mobile}
• GDB (GNU Debugger) — _{reversing, binary}
• binutils (strings / objdump / readelf) — _{reversing, binary}
• crackmes.one (RE Practice) — _{reference, learning, reversing}
• Malware Unicorn RE101 (Workshop) — _{reference, learning, reversing, malware-analysis}

⚡ DDOS Attack Tools

• DDoS — _{ddos, network, web}
• SlowLoris — _{ddos, web}
• UFOnet — _{ddos, web, network}
• SaphyraDDoS — _{ddos, web}
• hping3 (Packet Crafter / Flooder) — _{ddos, network}
• slowhttptest (Slow-HTTP DoS Tester) — _{ddos, web}
• OWASP Denial of Service Cheat Sheet — _{ddos, web, reference}

🖥 Remote Administrator Tools (RAT)

• Villain (Reverse Shell / C2 Manager) — _{c2, reverse-shell, post-exploitation, payload}
• hoaxshell (HTTP(S) PowerShell Reverse Shell) — _{reverse-shell, c2, payload, post-exploitation}
• Merlin (cross-platform C2) — _{c2, post-exploitation, reference}
• Covenant (.NET C2) — _{c2, post-exploitation, reference}

🧪 XSS Attack Tools

• DalFox (Finder of XSS) — _{web, xss, scanner, fuzzing}
• XSS Payload Generator — _{web, xss, payload}
• Advanced XSS Detection Suite — _{web, xss, scanner, fuzzing}
• kxss (Reflection Finder) — _{web, xss, scanner, recon}
• PortSwigger — XSS Labs — _{learning, web, xss, reference}
• PayloadsAllTheThings — XSS Injection — _{cheatsheet, reference, xss, web}

🖼 Steganography Tools

• SteganoHide — _{steganography, image, forensics}
• Stegseek (fast steganography cracker) — _{steganography, hash-crack, bruteforce}
• stegseek (fast steghide cracker) — _{steganography, bruteforce, password-attack, image}
• zsteg (PNG/BMP LSB detector) — _{steganography, image, forensics}
• outguess (JPEG stego) — _{steganography, image, forensics}
• ExifTool (metadata reader) — _{steganography, metadata, image, forensics}
• Aperi'Solve (all-in-one image stego) — _{steganography, image, online-service, reference}
• StegOnline (in-browser LSB explorer) — _{steganography, image, online-service}
• Futureboy Stegano decoder — _{steganography, online-service, reference}
• stego-toolkit (Docker kit + checklist) — _{steganography, reference, cheatsheet}

🏢 Active Directory Tools

• BloodHound (AD Attack Paths) — _{active-directory, enumeration, lateral-movement, credentials}
• NetExec — nxc (Network Pentesting) — _{active-directory, network, enumeration, credentials, password-attack}
• Impacket (Network Protocol Tools) — _{active-directory, credentials, network, lateral-movement, kerberos}
• Responder (LLMNR/NBT-NS Poisoner) — _{active-directory, credentials, mitm, sniffing, network, poisoning, relay}
• Certipy (AD Certificate Abuse) — _{active-directory, credentials, privesc, enumeration, adcs}
• Kerbrute (Kerberos Brute Force) — _{active-directory, bruteforce, password-attack, enumeration, credentials, kerberos}
• ldapdomaindump (AD LDAP Dumper) — _{active-directory, enumeration, credentials}
• Coercer (Authentication Coercion) — _{active-directory, relay, privesc, credentials}
• PCredz (Credential Extractor) — _{active-directory, credentials, sniffing, pcap, kerberos}
• The Hacker Recipes (AD) — _{reference, active-directory, learning}

☁ Cloud Security Tools

• Prowler (Cloud Security Scanner) — _{cloud, scanner, vuln-scan}
• ScoutSuite (Multi-Cloud Auditing) — _{cloud, scanner, enumeration}
• Pacu (AWS Exploitation Framework) — _{cloud, exploitation, post-exploitation}
• Trivy (Container/K8s Scanner) — _{scanner, vuln-scan, cloud}
• Checkov (IaC Misconfig Scanner) — _{cloud, scanner, vuln-scan}
• HackTricks Cloud (cloud pentest playbook) — _{reference, cloud, learning}
• flaws.cloud (AWS Security Challenge) — _{learning, cloud, online-service}

📱 Mobile Security Tools

• MobSF (Mobile Security Framework) — _{mobile, apk, vuln-scan, scanner, malware-analysis}
• Frida (Dynamic Instrumentation) — _{mobile, reversing, malware-analysis}
• Objection (Mobile Runtime Exploration) — _{mobile, reversing}
• adb (Android Debug Bridge) — _{mobile, apk}
• OWASP MAS (Mobile App Security) — _{mobile, reference, learning}
• Frida CodeShare — _{mobile, reversing, online-service, reference}

✨ Other tools

• MySMS — _{payload, mobile, apk}
• HatCloud(Bypass CloudFlare for IP) — _{recon, network, dns}
• Hash Buster — _{hash-crack, lookup, online-service, credentials}
• Sherlock — _{osint, recon, enumeration}
• SocialScan | Username or Email — _{osint, recon, email, enumeration}
• Pixload — _{payload, steganography, image}
• Gospider — _{web, crawler, recon}
• Terminal Multiplexer — _{cheatsheet, reference}
• Crivo — _{network, recon}
• CyberChef (Cyber Swiss-Army Knife) — _{reference, online-service}

🔑 Password / Hash Cracking

• hashcat (GPU hash cracker) — _{hash-crack, password-attack, bruteforce}
• John the Ripper (jumbo) — _{hash-crack, password-attack}
• hydra (Network Login Cracker) — _{bruteforce, password-attack, credentials, network}
• CrackStation (online lookup) — _{hash-crack, online-service, lookup}
• hashes.com (hash identifier + lookup) — _{hash-crack, online-service, lookup}
• CyberChef (the cyber swiss-army knife) — _{online-service, reference}
• GTFOBins (unix binary abuse) — _{privesc, reference, cheatsheet}

---

Adding a tool

Most tools are one YAML entry in src/hackingtool/catalog/ — no Python. See CONTRIBUTING.md for the entry format, the tag taxonomy, and the checks your PR has to pass (make check).

Can't find what you need? Ask the console: /find <what you're trying to do> searches the catalog first, then GitHub, and shows real maintained repos with the reason each was ranked. See HOW-TO-USE.md.