Use and weaponize the PayloadsAllTheThings payload library for web application penetration testing and CTF engagements. Use when the user needs injection payloads, bypass techniques, or exploitation strings for SQL injection, XSS, command injection, SSRF, XXE, SSTI, CSRF, LFI/RFI, directory traversal, authentication bypass, or deserialization attacks. Covers payload selection, real-world delivery with Burp Suite and curl, WAF bypass, chaining vulnerabilities, and reporting. Source: https://github.com/swisskyrepo/PayloadsAllTheThings
Operate the Aircrack-ng WiFi security suite for wireless network assessment. Use when performing WEP, WPA, or WPA2 cracking, capturing 4-way handshakes, executing PMKID attacks, injecting deauth frames, performing ARP replay attacks, or analyzing wireless traffic. Covers airmon-ng (monitor mode), airodump-ng (capture/scan), aireplay-ng (deauth/fake auth/ARP replay), aircrack-ng (cracking), airdecap-ng, packetforge-ng, besside-ng, WPS attacks with reaver, hashcat integration with -m 22000, and evil twin concepts for authorized wireless penetration testing engagements.
Build, extend, and operate Amass — the OWASP attack surface mapping tool for subdomain enumeration, ASN/org discovery, and DNS intelligence. Use when performing external reconnaissance, passive or active subdomain enumeration, certificate transparency analysis, ASN mapping, or tracking changes in an attack surface. Use when the user asks about subdomain discovery, passive DNS, API key integration, graph visualization, Amass config files, or comparing Amass with subfinder. Covers installation, all subcommands, config, data sources, brute force, resolvers, and visualization.
Reverse engineer Android APKs using Apktool. Use when decoding APKs to smali and resources, rebuilding modified APKs, bypassing certificate pinning, injecting Frida gadgets, analyzing AndroidManifest.xml for attack surface, modifying network security config, or performing combined static analysis with jadx. Covers installation, decode/rebuild workflow, framework management, smali code structure, APK signing, manifest analysis, certificate pinning bypass, Frida gadget injection, and integration with jadx for full decompilation.
Operate Arjun — an HTTP parameter discovery tool that finds hidden GET, POST, JSON, and XML parameters in web endpoints through intelligent wordlist-based bruteforcing. Use when mapping an application's attack surface, discovering undocumented API parameters, or preparing targets for fuzzing with ffuf, SQLMap, or XSStrike. Covers installation, GET/POST/JSON/XML modes, Burp import, custom wordlists, threading, output formats, and integration into a full web application testing workflow.
Build, extend, and operate Autopsy — the open-source digital forensics platform built on The Sleuth Kit. Use when conducting DFIR investigations, analyzing disk images, performing file carving, keyword searching, email analysis, or building forensic case files. Use when the user asks about dead-box forensics, memory analysis integration, timeline analysis, hash verification, ingest modules, or generating forensic reports. Covers installation, case creation, data sources, ingest modules, analysis techniques, and investigation methodology.
Operate AutoRecon — a multi-threaded network reconnaissance tool that automatically runs appropriate enumeration tools based on detected services. Use during OSCP labs, CTF initial enumeration, or real-world external/internal network pentests to automate the discovery phase. Covers installation, target specification, port scan profiles, per-service tool execution, custom plugins, output structure, concurrency controls, and a full OSCP/CTF enumeration workflow.
Operate BeEF (Browser Exploitation Framework) — a penetration testing tool that hooks browsers via a JavaScript payload and enables command-and-control of hooked browsers through a web UI and REST API. Use when demonstrating XSS impact, conducting browser-based attacks, chaining with Metasploit for post-exploitation, testing social engineering scenarios, or researching browser security. Covers installation (Docker, source), hook delivery, control panel, command modules (network, keylogger, social engineering, phishing, tunneling), REST API, custom modules, and attack methodology.