Red Team: Max Sandbox

The tools installed in the sandbox that Red Team scans run in: 142 tools on Kali Linux Rolling, with the source and exact version of each.

The tools installed in the sandbox that Red Team scans run in: 142 tools on Kali Linux Rolling, with the source and exact version of each.

At a glance

PropertyValue
Sandbox1.2.30-MAX
Base systemKali GNU/Linux Rolling 2026.3
Image size~13.9 GB
Tools142, of which 44 were added in this release
Built2026-10-11 · supersedes max-1.2.20
Python (agent environment)3.13.15
Python (system)3.14.7
Gogo1.26.8
Node.jsv24.21.0

How to read this inventory

Each entry shows the tool name, a one-line summary, a description, where it was installed from, the exact version in the sandbox image, the command to run it, and a link to the upstream project. Tools marked New were added in this sandbox release. See Tool Inventory for the list of source types.

Note: Tools with the version unpinned or pinned clone are built from the upstream project's source when the sandbox image is built, and the repository history is not kept. The same build on a different day can contain different code, so these are the only tools without a fixed version to audit.

Network & port scanning

Find live hosts and open ports, identify the services behind them, and track how an exposed surface changes between runs.

nmap

Network exploration tool and security scanner

The standard for host discovery, port scanning, service and version detection, and OS fingerprinting. The Nmap Scripting Engine (NSE) extends it with scripts for vulnerability checks, authentication testing and deeper service enumeration. In the Cyrion sandbox the binary holds cap_net_raw, so SYN scans and OS detection run without root.

nmap -sV -sC -p- --min-rate 1000 -oA scan target.example.com

masscan

Asynchronous, internet-scale TCP port scanner

Uses its own TCP/IP stack and asynchronous transmission to scan very large address ranges far faster than nmap. Its syntax is deliberately close to nmap's, and it writes grepable, XML, JSON or list output. Best used to find open ports across wide ranges, then hand the hits to nmap for service detail.

masscan 203.0.113.0/24 -p80,443,8080 --rate 1000 -oJ masscan.json

massdns

High-performance DNS stub resolver

Resolves very large lists of domain names in bulk against a set of recursive resolvers. Without special tuning it can sustain over 350,000 lookups per second on public resolvers, which makes brute-forcing subdomains and validating huge candidate lists practical.

massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt

naabu

Fast port scanner written in Go

ProjectDiscovery's port scanner, supporting SYN and CONNECT scans. It reads hosts from arguments, files or stdin and emits clean host:port lines, so it slots directly in front of httpx or nmap in a reconnaissance pipeline.

naabu -host example.com -top-ports 100 -silent

rustscan

Ultra-fast port scanner, 65,000 ports in seconds

Scans the entire TCP port range in seconds using an adaptive engine, then hands open ports to nmap for service and version detection. Used as the fast first pass before a focused nmap run.

rustscan -a example.com -- -sV

ncat

Feature-packed networking utility (Nmap's netcat)

Reads and writes data across networks from the command line. Supports TCP, UDP, SCTP, SSL, IPv4 and IPv6, listen mode, port relaying and proxy chaining.

ncat -lvnp 4444

ndiff

Utility to compare Nmap scan results

Compares two Nmap XML scans and reports what changed: hosts that appeared or went down, ports opened or closed, and service or OS changes.

ndiff before.xml after.xml

Subdomain & DNS reconnaissance

Map an organisation's hostnames from passive sources, DNS records, brute force and ASN/CIDR mapping, then check for takeover conditions.

subfinder

Passive subdomain discovery tool

Queries dozens of passive sources, including certificate transparency logs, search engines and public DNS datasets, to enumerate valid subdomains without sending traffic to the target.

subfinder -d example.com -silent -o subs.txt

amass

In-depth attack surface mapping and external asset discovery

OWASP Amass performs DNS enumeration and network mapping using passive sources, active probing, brute forcing and name alterations, storing results in a graph that links hostnames to IPs, netblocks and ASNs.

amass enum -passive -d example.com -o amass.txt

assetfinder

Find domains and subdomains related to a given domain

A fast, lightweight tool that pulls related hostnames from public sources such as certificate transparency, composing cleanly with other recon tools.

assetfinder --subs-only example.com

dnsx

Fast and multi-purpose DNS toolkit

Runs DNS queries (A, AAAA, CNAME, MX, NS, TXT and more) against a list of hosts with wildcard filtering and DNS brute forcing. It is the link between subdomain discovery and httpx probing.

cat subs.txt | dnsx -silent -a -resp

alterx

Pattern-based subdomain wordlist generator

Generates subdomain permutations from patterns and words found in known hostnames, resolved afterward with dnsx or massdns to find hosts passive sources miss.

alterx -l subs.txt -silent | dnsx -silent

asnmap

Map an organisation to its autonomous system and CIDR ranges

Resolves a domain, organisation or IP to its autonomous system number and returns the CIDR blocks that AS announces, expanding a single hostname into an organisation's whole address space.

asnmap -d example.com -silent

dnsrecon

DNS enumeration and reconnaissance script

Checks every name server for zone transfers, enumerates standard records, tests for wildcard resolution, performs reverse lookups, and brute forces hostnames with a wordlist.

dnsrecon -d example.com -t std

dnsenum

Multithreaded DNS information enumerator

Collects host and mail server addresses, attempts zone transfers, scrapes Google for additional hostnames, brute forces subdomains and reverse-looks-up discovered netblocks.

dnsenum --enum example.com

fierce

DNS reconnaissance tool for locating non-contiguous IP space

Finds the target domain's name servers and attempts a zone transfer, then falls back to hostname brute forcing and probes the surrounding IP space for related hosts.

fierce --domain example.com

subzy

Subdomain takeover vulnerability checker

Checks subdomains for dangling DNS records that point at unclaimed third-party services, matching responses against a maintained fingerprint set.

subzy run --targets subs.txt

subjack

Subdomain takeover tool written in Go

Checks subdomains for takeover conditions through dangling CNAMEs and service fingerprints, using an older fingerprint format kept for existing playbooks.

subjack -w subs.txt -t 50 -ssl -o takeovers.txt

uncover

Query internet-wide scan engines without touching the target

Searches Shodan, Censys, Fofa and similar engines for hosts matching a query, surfacing exposed infrastructure with zero packets sent to the target.

uncover -q 'org:"Example Corp"' -silent

whois

Client for the WHOIS directory service

Looks up registration, ownership, registrar and name-server data for domains and IP ranges, useful for scoping and attribution.

whois example.com

Web content discovery & crawling

Probe live web services, crawl them, fuzz for hidden paths and parameters, and recover historical URLs and JavaScript endpoints.

httpx

Fast and multi-purpose HTTP toolkit

Probes large host lists over HTTP/HTTPS and reports status codes, titles, content length, redirects and detected technologies at scale.

cat subs.txt | httpx -silent -title -status-code -tech-detect

katana

Next-generation crawling and spidering framework

Crawls web applications in standard and headless-browser modes, follows JavaScript-referenced endpoints, and extracts links, forms and file paths.

katana -u https://example.com -d 3 -jc -silent

ffuf

Fast web fuzzer written in Go

Replaces a FUZZ keyword anywhere in a request with wordlist entries and filters responses by status, size or regex. Covers content discovery, vhost discovery and parameter fuzzing.

ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,301,403

feroxbuster

Fast, recursive content discovery tool written in Rust

Brute-forces directories and files and automatically recurses into the ones it finds, with wildcard handling and resumable scans.

feroxbuster -u https://example.com -w wordlist.txt -x php,txt

gobuster

Directory, DNS and virtual-host brute-forcing tool

A Go brute-forcer with modes for directories, DNS subdomains, virtual hosts and cloud storage buckets.

gobuster dir -u https://example.com -w wordlist.txt

dirsearch

Advanced web path scanner

A mature path brute-forcer with extension handling, recursion, status filtering and multiple report formats.

dirsearch -u https://example.com -e php,html,js

gospider

Fast web spider written in Go

Crawls a site and extracts URLs, forms, JavaScript files, subdomains and S3 buckets from page content and responses.

gospider -s https://example.com -d 2 -c 10

hakrawler

Simple, fast crawler for endpoint and asset discovery

Reads starting URLs from stdin and prints discovered links, scripts and forms, a minimal crawler stage for shell pipelines.

  • Source: go
  • Version: v0.0.0-20260805040537-52a16fe61bd1
  • Command: hakrawler
  • Upstream project
echo https://example.com | hakrawler -d 2

gau

Fetch known URLs from public archives

Collects every known URL for a domain from AlienVault OTX, the Wayback Machine, Common Crawl and URLScan.

gau --subs example.com

waybackurls

Fetch the URLs the Wayback Machine knows about a domain

Prints archived URLs from the Internet Archive for a domain, recovering removed endpoints and legacy parameters.

echo example.com | waybackurls

paramspider

Mine parameters from web archives

Collects archived URLs carrying query parameters and replaces values with a placeholder, ready for fuzzers and scanners.

paramspider -d example.com

arjun

HTTP parameter discovery suite

Finds hidden GET, POST, JSON and XML parameters by sending large batches of candidate names and observing response changes.

arjun -u https://example.com/endpoint

LinkFinder

Discover endpoints in JavaScript files

Parses JavaScript from a URL, file or page and extracts endpoints and parameters with a regex engine.

linkfinder -i https://example.com/app.js -o cli

JS-Snooper

JavaScript reconnaissance helper

A shell helper that mines JavaScript for endpoints and secrets, run alongside LinkFinder and SecretFinder.

jsniper.sh

JavaScript reconnaissance shell script

A shell helper for JavaScript reconnaissance that pulls interesting data out of a target's script files.

Web vulnerability scanning

Template-driven and signature-based scanners, plus fingerprinting tools that identify the technology and filtering in front of an application.

nuclei

Fast, customizable scanner driven by YAML templates

Sends template-defined requests across HTTP, DNS, TCP, SSL and more and matches responses against declarative conditions, covering CVEs, misconfigurations, exposed panels and default credentials. Templates refresh when the image is built.

nuclei -u https://example.com -severity high,critical

nikto

Web server scanner

Tests web servers for dangerous files, outdated software and insecure configuration, giving fast baseline coverage.

nikto -h https://example.com

wapiti

Black-box web application vulnerability scanner

Crawls a site then fuzzes the forms and parameters it finds, covering SQL/XPath injection, XSS, file disclosure, command execution, SSRF, XXE and CRLF injection.

wapiti -u https://example.com -m sql,xss

whatweb

Web technology fingerprinting scanner

Identifies CMSes, frameworks, JS libraries, analytics and embedded devices with a large plugin set, at configurable aggression levels.

whatweb -a 3 https://example.com

wpscan

WordPress vulnerability scanner

Detects the WordPress version, installed themes and plugins, and enumerates users, matched against the WPScan vulnerability database.

wpscan --url https://example.com --enumerate vp,vt,u

wafw00f

Web Application Firewall fingerprinting tool

Sends probe requests and analyses responses to identify which WAF or CDN sits in front of a site, which shapes payload choice for later tests.

wafw00f https://example.com

jaeles

Signature-based web application testing framework

Runs YAML signatures describing requests, payloads and detection logic, making it quick to encode a new check or reproduce a published vulnerability.

  • Source: go
  • Version: v0.0.0-20260620125341-d40305ffe42a
  • Command: jaeles
  • Upstream project
jaeles scan -s cves -u https://example.com

retire

Scanner for known-vulnerable JavaScript libraries

retire.js detects JavaScript libraries and Node modules with known vulnerabilities by comparing version fingerprints against a maintained advisory repository.

retire --path ./app

Injection & exploitation

Detect and prove injection flaws, run full exploit chains with Metasploit, and capture out-of-band interactions for blind cases.

sqlmap

Automatic SQL injection and database takeover tool

Detects and exploits boolean, error, time-based, UNION and stacked-query injection, and can enumerate databases, dump data, read files and, in some configurations, run commands on the database host.

sqlmap -u "https://example.com/item?id=1" --batch --risk 2 --level 3

ghauri

Advanced SQL injection detection and exploitation tool

Detects boolean, error, time-based and stacked-query injection and enumerates databases, complementing sqlmap with an independent implementation.

ghauri -u "https://example.com/item?id=1" --batch

commix

Automated OS command injection and exploitation tool

Tests parameters, headers and cookies for command injection using classic, time-based and file-based techniques, and can open a pseudo-shell on a vulnerable target.

commix --url="https://example.com/ping?ip=INJECT_HERE" --batch

SSTImap

Server-side template injection detection and exploitation

Detects template injection in engines such as Jinja2, Twig and Freemarker and, where possible, escalates it to file access or remote code execution — a direct RCE path.

sstimap -u "https://example.com/page?name=test"

nosqli

NoSQL injection scanner

Scans for MongoDB and CouchDB injection by sending crafted operators and boolean/timing payloads.

nosqli scan -t https://example.com/login

dalfox

Parameter analysis and XSS scanning tool

Mines parameters and tests with context-aware payloads, including blind XSS callbacks, with pipe mode for pipelines.

dalfox url "https://example.com/search?q=test"

XSStrike

Advanced XSS detection suite

Combines a payload generator, fuzzer and crawler with a context analyser that crafts payloads for the exact reflection point, plus WAF and DOM XSS detection.

xsstrike -u "https://example.com/search?q=test" --crawl

Gxss

Reflected-parameter checker

Injects a marker into each URL parameter and reports which parameters reflect and which special characters survive unfiltered.

  • Source: go
  • Version: v0.0.0-20240804155857-8ee938bf4ead
  • Command: Gxss
  • Upstream project
cat urls.txt | Gxss -c 100 -p Xss

crlfuzz

CRLF injection scanner

Tests URLs for CRLF injection (response splitting and header injection) using multiple encodings and injection points.

crlfuzz -u "https://example.com/"

smuggler

HTTP request smuggling tester

Probes for desynchronisation between front-end and back-end servers using CL.TE, TE.CL and TE.TE variants.

smuggler -u https://example.com

SSRFmap

Automatic SSRF fuzzer and exploitation tool

Takes a captured request and a vulnerable parameter, then uses modules to read files, scan internal ports and reach cloud metadata through the server-side request.

ssrfmap -r request.txt -p url -m readfiles

metasploit-framework

Exploitation and post-exploitation framework

The standard framework for developing and running exploits, with a large module library of exploits, payloads, auxiliary scanners and post-exploitation modules. msfconsole and msfvenom are both on PATH.

msfconsole -q -x "use exploit/..."

interactsh-client

Out-of-band interaction capture client

Registers a unique callback domain and listens for DNS, HTTP, SMTP and other interactions — how blind SSRF, blind XSS and XXE are detected (OAST).

interactsh-client -v

API, GraphQL & auth

Fingerprint GraphQL engines, test JSON Web Tokens and find secrets exposed in client-side code.

graphw00f

GraphQL server engine fingerprinting tool

Identifies which GraphQL engine a server runs, which decides whether introspection abuse, query batching or alias overloading applies.

graphw00f -d -t https://example.com/graphql

jwt_tool

Toolkit for testing, tampering and cracking JSON Web Tokens

Decodes tokens, tests for known weaknesses (alg none, key confusion, weak secrets, kid/jku injection) and forges modified tokens.

jwt_tool <token>

SecretFinder

Find sensitive data in JavaScript files

Scans JavaScript for API keys, tokens and credentials using regular expressions, and can crawl all the scripts on a page.

secretfinder -i https://example.com/app.js -o cli

TLS & crypto

Audit protocol versions, cipher suites and certificates, and harvest hostnames from certificates at scale.

sslscan

Fast SSL/TLS cipher suite and protocol scanner

Lists the protocols, cipher suites and certificate details a service accepts, flagging weak and deprecated options.

sslscan example.com:443

testssl

Test TLS/SSL encryption on any port

A comprehensive TLS audit covering protocols, ciphers, forward secrecy, certificate validity, security headers and known vulnerabilities such as Heartbleed and ROBOT.

testssl https://example.com

sslyze

Scriptable SSL/TLS configuration analyser

Analyses cipher suites, certificate validation, session resumption and known flaws, with machine-readable JSON output for automation.

sslyze example.com:443

tlsx

Fast and configurable TLS grabber

Performs TLS handshakes across many hosts and extracts certificate fields including SANs and CNs that expose additional hostnames.

tlsx -u example.com -san -cn -silent

Password cracking & brute force

Offline and online credential attacks against captured hashes and live login forms.

hydra

Fast network login brute-forcer

Attempts authentication against more than 50 protocols, including SSH, RDP, HTTP forms, FTP and SMB, using credential lists with parallel connections.

hydra -L users.txt -P passwords.txt ssh://target

john

Offline password hash cracking (Jumbo)

Cracks password hashes offline using wordlists, rules and brute force across a very wide range of formats; the Jumbo build adds extra format and feature support.

  • Source: apt
  • Version: 1.9.0-Jumbo-1+git20211102-0kali11
  • Command: john
  • Upstream project
john --wordlist=rockyou.txt hashes.txt

hashcat

GPU-accelerated password recovery

The fastest widely used hash-cracking tool, using GPU acceleration across dictionary, mask, rule-based and combinator attack modes against hundreds of hash types.

hashcat -m 1000 -a 0 hashes.txt rockyou.txt

hashid

Identify the hash type before you crack it

Examines a hash string and lists the algorithms it is likely to be, so john or hashcat can be pointed at the right mode.

hashid '5f4dcc3b5aa765d61d8327deb882cf99'

name-that-hash

Hash identification with ranked, confidence-scored guesses

Identifies likely hash algorithms for a string and ranks them by probability, with built-in hashcat and john mode numbers for each guess. Installs as the nth binary.

nth -t '5f4dcc3b5aa765d61d8327deb882cf99'

Active Directory & Windows

Enumerate and attack Windows domains: SMB, LDAP, Kerberos, AD CS and credential relay.

netexec

Swiss-army knife for SMB, WinRM, LDAP and MSSQL

The actively maintained successor to CrackMapExec (binary nxc). Authenticates and executes across Windows networks over SMB, WinRM, LDAP and MSSQL, with modules for spraying, enumeration and lateral movement.

nxc smb targets.txt -u user -p pass --shares

crackmapexec

SMB/AD swiss-army knife (legacy)

The original SMB/Active Directory post-exploitation tool. Upstream development has ended in favour of netexec; kept so existing playbooks keep working.

crackmapexec smb targets.txt -u user -p pass

enum4linux-ng

Structured SMB/LDAP enumeration

A rewrite of enum4linux that pulls users, groups, shares, policies and OS information over SMB and LDAP, with clean structured output.

enum4linux-ng -A target

enum4linux

SMB/Windows enumeration (original)

The original Perl implementation of SMB enumeration against Windows and Samba hosts, superseded by enum4linux-ng but kept for compatibility.

enum4linux -a target

impacket-scripts

The Impacket suite of Windows protocol attack scripts

Scripts built on the Impacket library covering credential dumping (secretsdump), remote execution (psexec, wmiexec) and relay attacks (ntlmrelayx), speaking SMB, MSRPC and Kerberos directly.

secretsdump.py domain/user:pass@target

certipy-ad

Active Directory Certificate Services abuse

Enumerates and exploits AD CS misconfigurations across the ESC1 through ESC16 escalation techniques, which let a low-privileged account escalate to domain admin through a certificate template flaw.

certipy-ad find -u user@domain -p pass -dc-ip 10.0.0.1

bloodhound.py

BloodHound attack-path collector for Linux

Collects AD sessions, group memberships, ACLs and trusts and exports them for the BloodHound graph, revealing the shortest path from a foothold to Domain Admin. Installs as bloodhound-python.

bloodhound-python -u user -p pass -d domain -c All

kerbrute

Kerberos pre-authentication user enumeration and spraying

Enumerates valid AD usernames and password-sprays against Kerberos pre-authentication, far quieter than an equivalent SMB attempt.

kerbrute userenum -d domain users.txt

responder

LLMNR/NBT-NS/mDNS poisoner and credential capture

Answers name-resolution broadcasts on the local network, impersonating the requested host, and captures the authentication attempts that follow.

responder -I eth0 -wd

mitm6

IPv6 and WPAD takeover for Windows networks

Exploits Windows' default preference for IPv6 by answering DHCPv6 requests, giving a man-in-the-middle position that pairs with ntlmrelayx.

mitm6 -d domain.local

evil-winrm

Post-authentication WinRM shell

An interactive shell over Windows Remote Management once credentials or a hash have been obtained, with file transfer and in-memory assembly loading.

evil-winrm -i target -u user -p pass

smbclient

SMB share access client

An FTP-like client for browsing, uploading and downloading files from SMB/CIFS shares.

smbclient //target/share -U user

smbmap

SMB share enumeration and permission mapping

Lists accessible SMB shares and read/write permissions for a given set of credentials across a list of hosts.

smbmap -H target -u user -p pass

ldapdomaindump

Dump Active Directory information over LDAP

Connects to a domain controller over LDAP and exports users, groups, computers and trusts into HTML and JSON reports.

ldapdomaindump -u DOMAIN\\user -p pass dc-ip

Cloud security

Audit cloud account posture and, once credentials are obtained, enumerate and exploit what they can reach.

prowler

Multi-cloud security posture assessment

Runs hundreds of checks against AWS, Azure, GCP and Kubernetes accounts covering CIS benchmarks, encryption, exposed storage and IAM misconfiguration, reporting pass or fail per check.

prowler aws

scoutsuite

Multi-cloud security auditing

Collects configuration data across AWS, Azure, GCP and other clouds and builds a browsable report that highlights risky settings, complementing prowler's checklist model with a broader inventory view.

scout aws

pacu

AWS exploitation framework

Where prowler and ScoutSuite answer whether an AWS account is misconfigured, Pacu answers what an attacker can do with a given set of credentials: privilege escalation, persistence and lateral movement against live accounts.

pacu

cloudfox

AWS post-exploitation enumeration

Given a set of AWS credentials, maps the account's attack surface quickly: roles, permissions, public resources and likely privilege-escalation paths.

cloudfox aws all-checks

s3scanner

Open S3 bucket discovery and enumeration

Checks candidate bucket names for existence and public accessibility, and lists the contents of any bucket that is open.

s3scanner scan --buckets-file names.txt

trivy

Container, filesystem, IaC and dependency scanner

A single scanner covering container images, filesystems, Terraform, Kubernetes manifests and Dockerfiles for known CVEs and misconfigurations.

trivy image myapp:latest

Secrets, SAST & supply chain

Static analysis, git-history and dependency scanning, with live verification of leaked credentials.

trufflehog

Find, verify and analyse leaked credentials

Scans repositories, filesystems and other sources for secrets with hundreds of detectors, verifying candidates against the live service so only working credentials are flagged.

trufflehog git https://github.com/org/repo --only-verified

gitleaks

Git-history-aware secret scanning

Scans git commit history, not just the working tree, for hardcoded secrets using a large rule set — a different hit set from trufflehog's live-verification approach.

gitleaks detect --source ./repo

semgrep

Lightweight multi-language static analysis

Pattern-based static analysis that matches code structure rather than text, with security rule sets across many languages.

semgrep --config auto ./src

bandit

Security linter for Python code

Parses Python into an AST and checks for hard-coded passwords, unsafe deserialisation, shell injection and weak cryptography.

bandit -r ./app -ll

syft

Software bill of materials generator

Catalogs every package and library inside a container image, filesystem or archive into an SBOM, which feeds dependency-CVE scanning.

syft packages ./app -o cyclonedx-json

osv-scanner

Dependency vulnerabilities from the OSV database

Matches lockfiles and SBOMs against the Open Source Vulnerabilities database, often surfacing CVEs a single-source scanner misses.

osv-scanner -L package-lock.json

eslint

Pluggable JavaScript linter

Identifies problematic patterns in JavaScript and TypeScript; security-focused plugins add checks for dangerous constructs.

eslint .

jshint

JavaScript static analysis tool

Detects errors and potential problems in JavaScript source, including undeclared variables and risky constructs.

jshint ./app.js

js-beautify

JavaScript beautifier

Re-indents and reformats minified JavaScript so it can be read before review.

js-beautify app.min.js -o app.js

Mobile — Android

Decompile, repackage, instrument and statically analyse Android applications.

apktool

Decode and rebuild Android APK resources

Reverses an APK almost to its original form, decoding compiled resources and Smali bytecode for editing and rebuilding.

apktool d app.apk

jadx

DEX-to-Java decompiler

Decompiles Android DEX bytecode back into readable Java source, with GUI and CLI modes for reading application logic directly.

jadx -d out app.apk

dex2jar

Convert Android DEX bytecode to JAR

Converts .dex files into standard .jar files so application logic can be opened with ordinary Java decompilers.

d2j-dex2jar app.apk

smali / baksmali

DEX assembler and disassembler

Disassembles DEX bytecode into human-readable Smali for direct inspection and reassembles edited Smali back into DEX.

baksmali d classes.dex -o out/

apksigner

APK signature verification and signing

Verifies whether an APK signature is valid for a given Android API level, and signs rebuilt APKs for installation.

apksigner sign --ks keystore.jks app.apk

zipalign

Align APK resources for runtime efficiency

Aligns uncompressed APK data on 4-byte boundaries, required before a rebuilt APK can install and run correctly.

zipalign -v 4 app.apk app-aligned.apk

adb

Android Debug Bridge

The standard client-server tool for talking to an Android device or emulator: installing apps, pulling files, reading logs and opening a shell.

adb install app.apk

fastboot

Bootloader-level Android device interaction

Talks to an Android device's bootloader rather than its running OS, for flashing partitions during device-level testing.

fastboot devices

androguard

Static analysis library and CLI for APK/DEX

A Python library and CLI for parsing Android applications: permissions, components, call graphs and cross-references.

androguard analyze app.apk

apkid

Identify packers, obfuscators and anti-analysis tricks

Fingerprints the compilers, packers and anti-debugging techniques used to build an APK, shaping how much static analysis can be trusted before dynamic analysis is needed.

apkid app.apk

apkleaks

Hardcoded secrets and endpoints in a decompiled APK

Decompiles an APK via jadx and scans the output for API keys, tokens and internal endpoints left in the compiled code.

apkleaks -f app.apk

mobsfscan

Mobile-focused static analysis

A semgrep-based analyser tuned for mobile code, covering insecure storage, weak cryptography and platform misconfigurations. Shares the semgrep environment.

mobsfscan ./app-source

frida-tools

Dynamic instrumentation and runtime hooking

Injects a JavaScript engine into a running process to hook functions, trace calls and modify behaviour at runtime, on Android, iOS and desktop targets.

frida -U -f com.example.app -l hook.js

objection

Runtime mobile exploration without a jailbreak or root

A Frida-powered toolkit that automates bypassing SSL pinning and root/jailbreak detection, dumping keychains, and exploring an app's memory interactively.

objection -g com.example.app explore

Mobile — iOS

Install, inspect and interact with iOS applications and devices over USB.

libimobiledevice-utils

iOS device communication utilities

Command-line utilities for talking to iOS devices over USB: reading device info, streaming syslog and running diagnostics without a jailbreak.

idevice_id -l

ideviceinstaller

Install, list and remove iOS apps over USB

Manages application packages on a connected iOS device for installing a build under test or removing it afterward.

ideviceinstaller -i app.ipa

libplist-utils

Convert between binary and XML property lists

Converts Apple property list files between binary and XML, needed because many iOS configuration files are binary plists.

plistutil -i Info.plist -o Info.xml

libusbmuxd-tools

USB multiplexing daemon for iOS devices

Provides the USB multiplexing layer that lets multiple tools talk to a connected iOS device over one USB connection.

iproxy 2222 22

Reverse engineering & exploit development

Binary analysis, debugging and proof-of-concept construction for native code found during a scan.

ghidra

Full decompiler and reverse-engineering suite

A complete static reverse-engineering platform with a decompiler covering dozens of architectures, for deep analysis of native binaries and firmware.

analyzeHeadless project_dir project_name -import binary

radare2

Reverse engineering framework

A scriptable framework for disassembly, debugging, patching and binary diffing across many architectures and file formats.

r2 -A ./binary

binwalk

Firmware extraction and embedded-file carving

Scans a binary blob for known file signatures and extracts embedded filesystems and executables — the standard first step when analysing firmware from IoT and embedded targets.

binwalk -e firmware.bin

pwntools

CTF and exploit-development primitives for Python

A Python library for building proof-of-concept exploits: packing data, talking to remote sockets, interacting with local processes and constructing ROP chains. Installed into the agent virtual environment so it is importable by the agents that build findings' proof of concept.

python3 -c "from pwn import *; r = remote('target',1234); print(r.recvline())"

gdb

GNU Debugger

The standard native debugger on Linux: runs a binary under control, sets breakpoints, inspects memory and analyses crashes.

gdb -q ./binary

Wireless

Capture and attack Wi-Fi networks. Needs a monitor-mode-capable wireless adapter passed into the sandbox.

aircrack-ng

Wireless network capture and WEP/WPA-PSK cracking suite

Covers every stage of a Wi-Fi assessment: monitor-mode capture, deauthentication and key recovery against WEP and WPA/WPA2-PSK handshakes. Requires a monitor-mode-capable wireless adapter passed into the sandbox.

  • Source: apt
  • Version: 1:1.7+git20230807.4bf83f1a-3
  • Command: airodump-ng
  • Upstream project
airodump-ng wlan0mon

Proxy & traffic interception

The intercepting proxy that records and replays traffic during a scan.

caido-cli

Web security auditing proxy

The primary intercepting proxy. Records and replays HTTP traffic, runs supervised for the sandbox lifetime, with its CA certificate imported at build time.

OSINT

Gather public intelligence about a target without touching its infrastructure.

theHarvester

Email, subdomain and host harvester

Gathers emails, names, subdomains and URLs from public sources such as search engines and certificate transparency, passively.

theHarvester -d example.com -b crtsh

recon-ng

Full-featured web reconnaissance framework

A modular framework with workspaces, a database of discovered assets and installable recon modules.

recon-ng -w example

shodan

Command-line client for the Shodan search engine

Queries Shodan for exposed hosts, open ports and known vulnerabilities for an IP or filter, without scanning the target directly.

shodan host 203.0.113.10

vulnx

ProjectDiscovery CVE and exploit intelligence lookup

Looks up vulnerability records by CVE ID or filter and returns severity and exploit information for prioritising findings.

vulnx id CVE-2024-3094

Stealth & anonymity

Route traffic through Tor for assessments that need to minimise the target's visibility into where requests come from.

tor

Onion-routing network client

Routes traffic through the Tor network for anonymised connections, with a SOCKS proxy preconfigured on the standard local port.

tor

torsocks

Transparently route a command's traffic through Tor

Wraps a command so all of its network connections are transparently routed through the local Tor SOCKS proxy.

torsocks curl https://example.onion

proxychains4

Chain a command's connections through one or more proxies

Forces TCP connections through a chain of SOCKS or HTTP proxies, preconfigured here to use the local Tor SOCKS5 proxy.

proxychains4 nmap -sT target

Pipeline glue & utilities

Small tools that join the rest together: dedupe, reshape, search and parallelise tool output.

anew

Append lines from stdin to a file, skipping duplicates

Appends only lines not already in the target file and prints the new ones, deduping across runs without breaking a pipeline.

cat new.txt | anew seen.txt

unfurl

Pull out the parts of URLs

Parses URLs and prints selected parts or formatted combinations, turning a URL list into parameter and path wordlists.

cat urls.txt | unfurl --unique domains

qsreplace

Replace query-string values

Replaces every query-string value in a URL list with one you supply, turning it into an injection corpus.

cat urls.txt | qsreplace FUZZ

jq

Command-line JSON processor

Filters, transforms and reshapes JSON with a compact query language.

curl -s https://example.com/api | jq ".items[].id"

ripgrep

Fast recursive search tool

Searches file trees with regular expressions at high speed, respecting ignore files by default.

rg -n "api[_-]?key" ./src

parallel

Run shell commands in parallel

Runs many jobs concurrently across CPU cores, replacing slow sequential loops over host or URL lists.

cat hosts.txt | parallel -j 10 nmap -F {}

tmux

Terminal multiplexer

Keeps shell sessions alive in detachable windows and panes so long-running work survives a disconnect.

tmux new -s scan

Runtimes & languages

The interpreters and toolchains the sandbox needs to build and run the tools above.

python3 (venv)

Python interpreter for the agent environment

The interpreter the agents run, in a virtual environment with system site-packages disabled.

python3 --version

python3 (system)

Kali system Python

Kali's own interpreter, used by its packages. Libraries installed through apt python3-* packages land here and are not importable from the agent environment.

/usr/bin/python3 --version

go

Go toolchain

The compiler and tools used to build and install Go-based security tools.

go version

node

Node.js runtime

The JavaScript runtime behind npm-installed tools such as eslint, jshint, retire and js-beautify.

node --version

java

Java runtime required by Android and RE tooling

The JDK that jadx, apktool and, on the Red Team sandbox, Ghidra run on.

java -version

poetry

Python dependency manager

Pinned dependency manager for the agent runtime.

poetry --version

What Red Team adds over Hacker

Red Team includes everything in Hacker: Pro Sandbox plus:

AreaAdditional tools
Cloud securityprowler, scoutsuite, pacu, cloudfox, s3scanner, trivy
Reverse engineeringghidra, a full decompiler suite alongside radare2
Wirelessaircrack-ng (needs a monitor-mode-capable wireless adapter passed into the sandbox)

Known issues

Four git-installed tools in the current Red Team image are not runnable as commands today: paramspider, xsstrike, ssrfmap and secretfinder. Each is marked with a warning below. The fix has already shipped in the Hacker sandbox and is queued for the next Red Team image rebuild. Every other tool listed here has been verified against the built image.