Tools — Master Hub

All tool documentation lives under Sheet/Tools/, grouped by what you’re trying to do — not by individual command.

How to use: Pick your phase → open the category hub → drill into the specific tool note.

Fresh Kali / missing tool?Installation - Kali Setup (per-tool) · Install Download and Run (how-to: git, .deb, PATH)


📌 Folder Map

FolderWhen to useHub
Linux ToolsShell on Linux, parse output, transfer files, stegoLinux Tools
ReconScanning, directory brute, web enum, SQLi automationRecon
Active DirectoryKerberos, NTLM capture, BloodHound, cred attacks on ADActive Directory
Remote AccessSSH, WinRM, RDP, pivoting, FTPRemote Access
Password AttacksCrack hashes, spray/brute loginsPassword Attacks
DatabaseMySQL, MSSQL, Postgres, Redis, MongoDB, OracleDatabase
ImpacketWindows protocol scripts — shells, dumps, Kerberos, relayImpacket
MetaSploitmsfconsole, msfvenom, meterpreter, payloadsMetaSploit
SMBSMB enum, shares, CrackMapExec, rpcclientSMB
CloudAWS CLI — S3/MinIO, custom endpointsCloud
Installation - Kali Setupapt / pip / git install commands for all toolsInstallation - Kali Setup
Install Download and RunHow to install anything — .deb, clone, PATH, pip .Install Download and Run

📌 OSCP Phase → Tools

RECON          →  [[Nmap]]  [[RustScan]]  [[searchsploit]]  [[Gobuster]]  [[ffuf]]  [[CMSeeK - cmseek]]  [[Burp Suite]]  [[DNS (dig & host)]]  [[ldapsearch]]  [[snmpwalk]]  [[Kerbrute]]
WEB EXPLOIT    →  [[SQLMap]]  [[Burp Suite]]  [[Curl]]
CREDS / AD     →  [[Responder]]  [[Kerberoast]]  [[Rubeus]]  [[Certipy & Certify]]  [[SharpHound]]  [[RustHound]]  [[bloodyAD]]  [[PowerSploit]]  [[PowerView]]  [[Impacket]]  [[Hashcat]]
ACCESS         →  [[SSH]]  [[evil-winrm]]  [[xfreerdp]]  [[Netcat]]  [[Penelope]]  [[rlwrap]]
PIVOT          →  [[Chisel]]  [[SSH]]  (see [[Tunneling]])
LINUX BOX      →  [[Text Processing]]  [[find]]  [[grep]]  [[OpenSSL]]  [[exiftool]]  [[File Transfer]]  [[Privesc Tools]]
DATABASE       →  [[Database]]
CLOUD / S3     →  [[AWS CLI]]

ToolCategory
NmapRecon
RustScanRecon (fast port scan)
searchsploitRecon
GobusterRecon
CMSeeK - cmseekRecon (CMS detection)
ffufRecon
Burp SuiteRecon / Web
SQLMapRecon / Web
ImpacketAD / Lateral
evil-winrmRemote Access
HashcatPassword Attacks
HydraPassword Attacks
CeWLPassword Attacks (site spider wordlist)
Text ProcessingLinux Tools
Pipelines & ChainingLinux Tools
ResponderActive Directory
KerberoastActive Directory
RubeusActive Directory (Windows Kerberos)
Certipy & CertifyActive Directory (AD CS)
PidginRecon (XMPP / 5222)
ldapsearchRecon (LDAP / 389)
File TransferLinux Tools (move payloads)
Git & GitHubLinux Tools — exposed .git, git log, GitHub OSINT
OpenSSLLinux Tools (TLS, certs, passwd, crypto)
exiftoolLinux Tools (metadata / EXIF)
pypykatzActive Directory (offline LSASS parser)
Privesc ToolsPost-Exploitation (LinPEAS/WinPEAS)
Restricted Shell EscapePost-Exploitation (rbash / vi escape)
SharpHoundActive Directory (BloodHound collector — Windows)
RustHoundActive Directory (BloodHound collector — Rust/Linux)
bloodyADActive Directory (LDAP write / ACL abuse)
krb5-userActive Directory (kinit, kpasswd — port 464)
PowerSploitPowerShell offensive framework (PowerView, PowerUp)
PowerViewActive Directory PS enum (Recon)
PowerUpWindows local privesc (PowerShell)
PowerUpSQLMSSQL attack toolkit (Lateral movement)
PenelopeRemote Access (shell handler — prefer over rlwrap nc)
rlwrapLinux Tools (shell listener)
AWS CLICloud (S3/MinIO buckets)
PowerShell CmdletsCommands (PS hub)
snmpwalkRecon (SNMP / 161)
Mail (SMTP POP3 IMAP)Recon (SMTP/POP3/IMAP)
BeanShooterRecon / Exploit (JMX / 1099)
nbtscanRecon (NetBIOS / 137-139)