| Discover listeners and identify the applications behind them | Full TCP coverage; identify applications on the ports found. | Discover TCP ports with SYN or connect scans |
| AutoRecon | Quick/full TCP discovery and selected service follow-up with a small inspectable profile. | Network scanning and inline profile |
| Nmap UDP | Keep UDP results and ambiguous silence separate from TCP. | Probe UDP and resolve ambiguous silence |
| smbclient | List shares, then read files in the accepted identity. | Enumerate SMB/RPC shares, files and identities |
| SMBMap | Map share rights and retrieve one useful file. | Enumerate SMB/RPC shares, files and identities |
| enum4linux-ng | Collect SMB/RPC candidates with anonymous or known credentials. | Enumerate SMB/RPC shares, files and identities |
| snmpwalk | Query an observed community/version for configuration leads. | Extract configuration and process information through SNMP |
| dig | Resolve names and test authorized zone-transfer conditions. | Expand names through DNS records and zone transfers |
| impacket-mssqlclient | Inspect SQL Server login, grants and enabled operations. | Use SQL Server rights, impersonation and command facilities |
| curl | Replay the real host, method, cookie and input. | Establish scheme, host, redirects and request state |
| Gobuster | Discover paths after measuring a missing-path response. | Discover directories and files with controlled response filtering |
| ffuf | Fuzz one boundary in a valid request; preserve its session. | Map parameters, API methods, objects and writable properties |
| Burp Suite | Capture and compare normal requests before modifying inputs. | Map functions, roles and normal requests manually |
| Investigate confirmed WordPress components and configuration | Use only after confirming WordPress and relevant components. | Use WordPress component evidence and authorized administration features |
| curl request tests | Prove the command/parser effect before choosing a session. | Prove visible or blind operating-system command injection |
| Recover a password with a format-matched Hashcat job | Select the identified artifact format and feasible candidate strategy. | Recover passwords with feasible dictionary, rule and mask attacks |
| John the Ripper | Extract a supported verifier, recover offline, then validate access. | Recover passwords with feasible dictionary, rule and mask attacks |
| RunasCs | Use known plaintext credentials from an existing Windows shell. | Validate known passwords and context-specific reuse |
| SearchSploit | Find and inspect a PoC matching the exact feature/configuration. | Match a public exploit to the actual component and configuration |
| Python venv | Separate local runtime/dependency errors from target rejection. | Audit a PoC and reproduce its interpreter/dependency environment |
| GCC | Match process architecture, ABI and required libraries. | Compile and minimally adapt an existing native or memory-corruption PoC |
| SCP | Move files when authenticated SSH is the reachable channel. | Copy files through an authenticated SSH service |
| Python HTTP server | Transfer a reviewed artifact over a reachable HTTP leg. | Transfer over HTTP using Linux or Windows clients |
| PTY / stty | Stabilize an existing command session; retain the original channel. | Repair a limited Linux terminal |
| LinPEAS | Early Linux candidate collection, followed by exact-object checks. | Use enumeration tools to generate manually testable candidates |
| pspy | Observe transient privileged consumers and their real commands. | Control a script, binary or configuration consumed by a privileged job/service |
| GTFOBins | Match the exact binary, rule and privilege-preserving mode. | Use an allowed sudo operation to cross a privilege boundary |
| getcap / capabilities | Connect an effective file capability to an available operation. | Use a file capability that enables a specific privileged operation |
| winPEAS | Early Windows candidate collection; inspect out.txt. | Turn automated Windows findings into manually verified candidates |
| Seatbelt | Choose a focused system or current-user survey. | Turn automated Windows findings into manually verified candidates |
| PrivescCheck | Check permissions in the current token, with readable reports. | Turn automated Windows findings into manually verified candidates |
| LaZagne | Recover supported application stores in the accessible user context. | Recover Windows application, history and stored-credential artifacts |
| SharpHound / BloodHound CE | Collect compatible graph data and validate the useful edge. | Collect focused BloodHound data and validate an attack path |
| NetExec | Validate domain identity and service-specific authorization. | Establish domain identity, DC, DNS, time and route |
| Investigate domain objects and rights with PowerView | Inspect directory objects/rights from the current Windows context. | Enumerate directory objects with native, LDAP and PowerView approaches |
| AD surface helpers | Automatically collect scoped LDAP/current-host evidence and summarize candidate clues with manual prerequisite checks; -Preview is optional. | Enumerate directory objects with native, LDAP and PowerView approaches |
| Impacket Kerberos tools | Use the matching identity, SPN and ticket-request prerequisites. | Request a selected service ticket for offline service-account recovery |
| Inspect and use Kerberos material in the intended logon context | Inventory ticket contexts before using a selected ticket. | Inventory, convert and import tickets in the correct logon context |
| Investigate certificate enrollment and authentication conditions | Inspect AD CS prerequisites before a certificate-based transition. | Conditional: validate an AD CS enrollment-to-authentication path |
| Open a remote command session through verified WinRM rights | Use when the accepted identity has WinRM authorization. | Use WinRM, WinRS or PowerShell remoting |
| Impacket WMI | Use a permitted WMI/RPC path with the matching authentication material. | Execute through WMI or native CIM over DCOM |
| Validate and use an authorized remote desktop session | Check remote interactive rights and preserve the current session. | Obtain an authorized RDP interactive session |
| SSH forwards | Choose the listening side and destination leg explicitly. | Forward a selected service through an SSH client-side listener |
| Reach internal services through an HTTP-based Chisel tunnel | Use a reverse transport when the pivot can reach your listener. | Use a reverse Chisel SOCKS or fixed TCP tunnel |
| Route an internal subnet through a Ligolo-ng agent | Route only the intended internal prefixes through the working agent. | Route a selected internal subnet through Ligolo-ng |
| ProxyChains-NG | Use compatible TCP clients through a verified SOCKS listener. | Use ProxyChains, native SOCKS clients and SSH jump paths appropriately |
| Metasploit handler | Match payload transport, architecture and listener; inspect framework limits. | Pair staged payloads with the correct handler and session lifecycle |
| PowerShell | Distinguish parsing, policy, runtime and process architecture failures. | Distinguish PowerShell policy, language mode and protected execution layers |
| file / readelf | Check format and ABI before changing a payload. | Match an artifact to its executable consumer and runtime |
| Native identity proof | Record host/identity and the exact capability change. | Capture state-transition, proof and exploit-adaptation evidence |