redhound-arsenal

Use and weaponize the PayloadsAllTheThings payload library for web application penetration testing and CTF engagements. Use when the user needs injection payloads, bypass techniques, or exploitation strings for SQL injection, XSS, command injection, SSRF, XXE, SSTI, CSRF, LFI/RFI, directory traversal, authentication bypass, or deserialization attacks. Covers payload selection, real-world delivery with Burp Suite and curl, WAF bypass, chaining vulnerabilities, and reporting. Source: https://github.com/swisskyrepo/PayloadsAllTheThings

Operate the Aircrack-ng WiFi security suite for wireless network assessment. Use when performing WEP, WPA, or WPA2 cracking, capturing 4-way handshakes, executing PMKID attacks, injecting deauth frames, performing ARP replay attacks, or analyzing wireless traffic. Covers airmon-ng (monitor mode), airodump-ng (capture/scan), aireplay-ng (deauth/fake auth/ARP replay), aircrack-ng (cracking), airdecap-ng, packetforge-ng, besside-ng, WPS attacks with reaver, hashcat integration with -m 22000, and evil twin concepts for authorized wireless penetration testing engagements.

Build, extend, and operate Amass — the OWASP attack surface mapping tool for subdomain enumeration, ASN/org discovery, and DNS intelligence. Use when performing external reconnaissance, passive or active subdomain enumeration, certificate transparency analysis, ASN mapping, or tracking changes in an attack surface. Use when the user asks about subdomain discovery, passive DNS, API key integration, graph visualization, Amass config files, or comparing Amass with subfinder. Covers installation, all subcommands, config, data sources, brute force, resolvers, and visualization.

Reverse engineer Android APKs using Apktool. Use when decoding APKs to smali and resources, rebuilding modified APKs, bypassing certificate pinning, injecting Frida gadgets, analyzing AndroidManifest.xml for attack surface, modifying network security config, or performing combined static analysis with jadx. Covers installation, decode/rebuild workflow, framework management, smali code structure, APK signing, manifest analysis, certificate pinning bypass, Frida gadget injection, and integration with jadx for full decompilation.

Operate Arjun — an HTTP parameter discovery tool that finds hidden GET, POST, JSON, and XML parameters in web endpoints through intelligent wordlist-based bruteforcing. Use when mapping an application's attack surface, discovering undocumented API parameters, or preparing targets for fuzzing with ffuf, SQLMap, or XSStrike. Covers installation, GET/POST/JSON/XML modes, Burp import, custom wordlists, threading, output formats, and integration into a full web application testing workflow.

Build, extend, and operate Autopsy — the open-source digital forensics platform built on The Sleuth Kit. Use when conducting DFIR investigations, analyzing disk images, performing file carving, keyword searching, email analysis, or building forensic case files. Use when the user asks about dead-box forensics, memory analysis integration, timeline analysis, hash verification, ingest modules, or generating forensic reports. Covers installation, case creation, data sources, ingest modules, analysis techniques, and investigation methodology.

Operate AutoRecon — a multi-threaded network reconnaissance tool that automatically runs appropriate enumeration tools based on detected services. Use during OSCP labs, CTF initial enumeration, or real-world external/internal network pentests to automate the discovery phase. Covers installation, target specification, port scan profiles, per-service tool execution, custom plugins, output structure, concurrency controls, and a full OSCP/CTF enumeration workflow.

Operate BeEF (Browser Exploitation Framework) — a penetration testing tool that hooks browsers via a JavaScript payload and enables command-and-control of hooked browsers through a web UI and REST API. Use when demonstrating XSS impact, conducting browser-based attacks, chaining with Metasploit for post-exploitation, testing social engineering scenarios, or researching browser security. Covers installation (Docker, source), hook delivery, control panel, command modules (network, keylogger, social engineering, phishing, tunneling), REST API, custom modules, and attack methodology.

Operate and script Bettercap — a comprehensive network attack and monitoring framework. Use when working with bettercap/bettercap, when the user needs to perform ARP spoofing, DNS spoofing, SSL stripping, credential sniffing, WiFi attacks (deauth, handshake capture, evil twin), BLE enumeration, HID injection, or man-in-the-middle workflows. Covers installation, interactive REPL, caplets, all major modules, REST API, web UI, and comparison with Ettercap.

Build, extend, and operate Binwalk — a fast, easy-to-use tool for analyzing, reverse engineering, and extracting firmware images. Use when the user asks about firmware analysis, embedded file extraction, entropy analysis, IoT security research, or hardware hacking. Covers installation, signature scanning, file extraction, recursive extraction, entropy analysis, custom magic signatures, supported formats (squashfs, cramfs, jffs2, LZMA, gzip, and more), firmware modification workflow, filesystem extraction, and firmware version diffing.

Operate BloodHound and BloodHound Community Edition (CE) for Active Directory attack path analysis. Use when performing AD penetration testing, enumerating domain trusts, identifying Kerberoastable users, finding paths to Domain Admin, or analyzing ACL-based attack paths. Covers CE vs Legacy architecture, Docker installation, SharpHound and BloodHound.py collection, data ingestion, built-in queries, custom Cypher queries, edge semantics (MemberOf, HasSession, AdminTo, GenericAll, WriteDACL, DCSync), and attack path execution workflows.

Operate Burp Suite Community and Professional for web application penetration testing. Use when intercepting HTTP/S traffic, fuzzing parameters, testing authentication bypasses, scanning for vulnerabilities, or performing advanced web application assessments. Covers proxy setup, Intercept, Repeater, Intruder (all attack types), Scanner, Sequencer, Decoder, Comparer, Logger, Collaborator, BApp Store extensions (Autorize, Param Miner, JWT Editor, Turbo Intruder, ActiveScan++), scope control, session handling, macros, REST API, and Bambda filters.

Build, extend, and operate CeWL — a custom wordlist generator that spiders websites and extracts unique words for use in password attacks. Use when the user needs to create target-specific wordlists from web content, extract email addresses or metadata from sites, or build a password attack pipeline using CeWL → rules → hashcat/john/hydra. Covers installation, depth control, word filtering, email extraction, metadata parsing, proxy and authentication options, and full password attack methodology integration.

Operate Chainsaw — a fast Windows event log (EVTX) analysis tool with Sigma rule integration for rapid threat hunting and incident response. Use when analyzing Windows event logs for lateral movement, credential access, persistence, execution, or defense evasion artifacts. Covers installation (cargo, releases), hunt mode with Sigma rules, search mode, dump mode, supported formats (EVTX, JSON), output formats (ASCII table, CSV, JSON), writing custom detection rules, key detection categories, and incident response triage workflows.

Build, operate, and chain Chisel — a fast TCP/UDP tunnel over HTTP/HTTPS written in Go. Use when working with jpillora/chisel, when the user needs to tunnel traffic through firewalls, set up reverse tunnels from compromised hosts, create SOCKS proxies for pivoting, or forward ports across NAT boundaries. Covers installation, server/client setup, forward and reverse tunnels, SOCKS proxy, authentication, TLS, fingerprinting, multi-hop pivoting, and comparison with SSH tunneling and ligolo-ng.

Operate Commix — an automated OS command injection exploitation tool that detects and exploits command injection vulnerabilities in web parameters, cookies, and headers. Use when testing for OS command injection in GET/POST parameters, cookies, HTTP headers, or when manual injection is confirmed and automation is needed for shell access. Covers installation, injection techniques (results-based, time-based, file-based), shell access, tamper scripts, authentication, proxy, and command injection testing methodology.

Build, extend, and operate Crunch — a wordlist generator for creating custom character-set and pattern-based wordlists for password attacks. Use when the user needs to generate wordlists by character set, length range, custom patterns, or permutations. Covers installation, character set syntax, built-in charset files, pattern mode with placeholders, output to file, piping to hashcat/john/hydra, compression options, output limiting, start and end string control, permutation mode, and integration with password cracking methodology.

Use CyberChef for data encoding, decoding, encryption, deobfuscation, and transformation workflows. Use when the user needs to decode Base64/hex payloads, decrypt malware strings, deobfuscate PowerShell or JavaScript, parse certificates, extract IOCs, or chain complex data transformations. Covers the recipe concept, key operations, chaining, the Magic auto-detect feature, CLI usage (cc), self-hosting via Docker, API automation, URL-shareable recipes, and real-world malware deobfuscation and CTF workflows.

Build, extend, and operate Evil-WinRM — a WinRM shell designed for pentesting Windows environments. Use when the user asks about Evil-WinRM, Windows remote management shells, pass-the-hash over WinRM, uploading/downloading files to Windows targets, loading PowerShell scripts or C# DLLs in memory, bypassing AMSI, or post-exploitation workflows on Windows hosts. Covers installation, basic and advanced connection options, pass-the-hash, SSL mode, file transfer, script/DLL loading, AMSI bypass, logging, Docker usage, proxychains, and full post-exploitation workflow.

Deploy and operate Evilginx2 — an adversary-in-the-middle phishing framework that captures session tokens and cookies to bypass MFA. Use when working with kgretzky/evilginx2, when the user needs to set up a phishing page using a built-in or custom phishlet, configure DNS and TLS, create and manage lures, capture and extract session cookies from victim logins, or build custom phishlets for new targets. Covers installation, phishlet concepts, full deployment workflow, session extraction, DNS/TLS configuration, and detection/defense awareness.

Search and use ExploitDB and searchsploit — the largest public archive of exploits, shellcode, and papers maintained by Offensive Security. Use when working with offensive-security/exploitdb, when the user needs to find public exploits for a CVE or software version, use searchsploit CLI on Kali, examine or mirror exploit code, parse nmap XML for matching exploits, query the Google Hacking Database (GHDB), update the local database, or integrate findings into Metasploit. Covers searchsploit flags, reading exploits safely, modification for targets, and GHDB usage.

Operate and interpret EyeWitness — a web, RDP, and VNC screenshot tool for rapid visual triage of large attack surfaces. Use when conducting external or internal network assessments, processing nmap or Nessus output to quickly identify high-value web services, or building target triage workflows for large scope engagements. Covers installation (Docker, pip, source), input modes (file, nmap XML, Nessus XML), protocol support (HTTP/HTTPS, RDP, VNC), report generation, active scanning, and integration with recon pipelines.

Operate Feroxbuster — a fast, recursive content discovery tool written in Rust for brute-forcing files, directories, and endpoints against web servers. Use when performing web content enumeration, finding hidden paths, discovering API endpoints, or recursively walking directory structures. Covers installation, wordlists, extensions, filtering, recursion, rate limiting, output formats, auto-tune, scan resumption, and comparison with ffuf, gobuster, and dirsearch.

Operate ffuf (Fuzz Faster U Fool) — an extremely fast web fuzzer written in Go. Use when the user needs to brute-force web directories, discover virtual hosts, fuzz GET/POST parameters, headers, or subdomains, or when the user asks about ffuf, directory brute forcing, web fuzzing, or content discovery. Covers installation, all filtering and matching flags, multiple wordlist positions (FUZZ, custom keywords), VHOST discovery, parameter fuzzing, recursion, output formats, rate limiting, authentication (cookies, headers), custom wordlists, and integration with SecLists.

Operate Frida — a dynamic instrumentation toolkit for hooking and modifying running processes. Use when performing runtime analysis of desktop or mobile applications, bypassing SSL pinning or root detection, hooking native/Java/Objective-C functions, reversing mobile apps (Android/iOS), or automating instrumentation with Objection. Covers installation, JavaScript API (Interceptor, Module, Memory, NativeFunction), frida-trace, RPC exports, Objection integration, Android/iOS setup with frida-server, and end-to-end mobile app pentesting workflows.

Build, extend, and operate GDB with GEF (GDB Enhanced Features) for binary exploit development, reverse engineering, and vulnerability research. Use when debugging ELF/PE/Mach-O binaries, developing heap or stack exploits, analyzing memory layout, building ROP chains, or integrating GDB with pwntools. Use when the user asks about GEF commands (vmmap, heap, checksec, pattern, xinfo, rop, canary), heap exploitation helpers, breakpoints, memory examination, or comparing GEF with PEDA and pwndbg.

Install, configure, and operate Ghidra for binary reverse engineering. Use when the user needs to analyze executables, firmware, or malware with Ghidra; when performing static analysis, decompilation, function analysis, or patching; when scripting Ghidra with Java or Python (Jython/PyGhidra); when running headless batch analysis; or when comparing Ghidra workflows to IDA Pro or radare2. Covers installation, CodeBrowser navigation, decompiler, data types, debugging, plugin development, and CTF workflows. Source: https://github.com/NationalSecurityAgency/ghidra

Operate and configure Gitleaks — a SAST/secret-detection tool that scans git repositories, commit histories, and staged changes for leaked credentials, API keys, tokens, and private keys. Use when working with gitleaks/gitleaks, when the user needs to audit a repository for secrets, set up pre-commit hooks, integrate into CI/CD pipelines, write custom detection rules, or establish baselines to suppress known findings. Covers installation, detect/protect modes, .gitleaks.toml configuration, custom rules, allowlists, output formats, and CI/CD integration.

Use and operate Gobuster — a fast directory/file, DNS subdomain, virtual host, fuzzing, S3, and GCS brute-forcing tool written in Go. Use when enumerating web directories and files, discovering subdomains via DNS brute force, finding virtual hosts, fuzzing URL parameters, or testing cloud storage buckets. Covers all modes (dir, dns, vhost, fuzz, s3, gcs, tftp), global flags, performance tuning, authentication, proxy support, wildcard detection, wordlist selection with SecLists, output formats, and comparison with ffuf, feroxbuster, and dirsearch. GitHub: https://github.com/OJ/gobuster (13.6k stars).

Operate and apply GTFOBins — the curated list of Unix binaries exploitable for privilege escalation, file operations, shell spawning, and capability abuse. Use when performing Linux/Unix privilege escalation, post-exploitation enumeration, SUID/sudo/capabilities exploitation, or when the user needs to leverage a specific binary to escape restricted shells, read protected files, or gain a root shell. Covers all GTFOBins categories, key binary techniques, SUID enumeration, sudo -l parsing, capabilities exploitation, and integration with LinPEAS/LinEnum output.

Operate hashcat — the world's fastest CPU/GPU-based password recovery tool. Use when cracking password hashes obtained during a pentest, CTF, or red team engagement, when the user asks about offline password cracking, hash identification, rule-based attacks, mask attacks, combinator attacks, or integrating hashcat with secretsdump/mimikatz output. Covers installation with GPU drivers, all attack modes (-a 0/1/3/6/7), hash types (-m), rule engines, mask charsets, potfile management, session control, brain server, distributed cracking, and end-to-end AD credential cracking workflows.

Build, extend, and operate Havoc C2 — a modern command-and-control framework featuring the Demon agent. Use when deploying Havoc on red team engagements, when the user needs to set up a teamserver, generate implants, configure listeners, or execute post-exploitation tasks. Covers installation, teamserver profiles, client setup, Demon agent generation, HTTP/HTTPS listeners, agent command reference, BOF integration, process injection, token manipulation, .NET execution, and comparison with Sliver and Cobalt Strike.

Operate and pipeline httpx — a fast, multi-purpose HTTP toolkit by ProjectDiscovery for probing live web services at scale. Use when working with projectdiscovery/httpx, when the user needs to identify live hosts from a list, extract status codes, page titles, tech stacks, web server banners, content lengths, or response times. Covers installation, all major flags, output formats, matching/filtering, favicon hashing, custom headers, rate limiting, and integration in the subfinder → httpx → nuclei reconnaissance pipeline.

Operate and tune Hydra (thc-hydra) — the fast, parallelized online password brute-forcing tool supporting 50+ protocols. Use when performing credential attacks against SSH, FTP, HTTP forms, RDP, SMB, MySQL, MSSQL, VNC, SNMP, LDAP, POP3, IMAP, SMTP, and more. Covers all major flags, http-form-post syntax, thread tuning, proxy routing, combo file usage, integration with CeWL/SecLists/crunch/Burp, and operational opsec considerations for authorized penetration testing engagements.

Use and operate Impacket — a collection of Python classes for working with network protocols, essential for Active Directory attacks and lateral movement. Use when performing AD enumeration, credential dumping (SAM, LSA, NTDS.dit, DCSync), remote code execution via SMB/WMI/DCOM, Kerberoasting, AS-REP Roasting, NTLM relay attacks, Golden/Silver ticket forgery, or MSSQL attacks. Covers installation, all major example scripts, authentication methods, and complete AD attack chains. GitHub: https://github.com/fortra/impacket (15.6k stars).

Decompile and reverse engineer Android APK, DEX, AAR, and JAR files using JADX (skylot/jadx, 43k+ stars). Use when performing mobile application security assessments, hunting for hardcoded secrets/API keys, analyzing AndroidManifest.xml for exported components, reverse engineering API calls, or preparing for dynamic analysis with Frida. Covers jadx CLI and jadx-gui, output structure, deobfuscation options, Smali vs Java output, Gradle export, thread tuning, secret/key hunting workflows, and integration with Frida for dynamic analysis following static review.

Build, extend, and operate John the Ripper — a fast password cracking tool supporting hundreds of hash types. Use when cracking password hashes, extracting hashes from archives or documents, performing wordlist or rule-based attacks, or recovering credentials during a penetration test. Covers community vs jumbo builds, supported formats, auto-detect, wordlist mode, rule sets (Jumbo, KoreLogic, All), incremental mode, mask mode, *2john extraction utilities, session management, potfile, and comparison with Hashcat.

Operate Katana — the next-generation web crawling and spidering framework by ProjectDiscovery. Use when the user needs to enumerate web application endpoints, discover JavaScript files and API paths, extract forms, emails, or parameters, or when the user asks about Katana, web crawling, or spidering for bug bounty or pentesting. Covers installation (Go install, Docker), standard and headless Chrome crawling modes, depth and scope control, field extraction, output filtering, JavaScript parsing, automatic form filling, rate limiting, custom headers, and integration with the ProjectDiscovery tool chain (subfinder, httpx, nuclei).

Operate Kerbrute — a Kerberos-based Active Directory enumeration and brute force tool that performs user enumeration, password spraying, and credential brute force via Kerberos pre-authentication without triggering traditional LDAP lockout mechanisms. Use during Active Directory assessments for username enumeration, safe password spraying, and credential testing. Covers installation (Go, releases), user enumeration, password spraying cadence, brute force, DC targeting, verbose output, output files, and integration with BloodHound and NetExec AD attack workflows.

Operate Ligolo-ng — an advanced tunneling and pivoting framework using TUN interfaces to route traffic through compromised hosts without SOCKS proxies or proxychains. Use when pivoting into internal networks during penetration tests, setting up multi-hop tunnels (double pivoting), forwarding ports, or replacing chisel/SSH tunneling in your post-exploitation workflow. Covers installation, TUN interface setup, proxy/agent architecture, starting tunnels, adding routes, double pivoting, port forwarding, multiple sessions, and comparison with alternative pivoting tools.