# RTExit — Available Tools Reference
# Verified working in rtexit-kali Docker container

> All commands run as: `docker exec rtexit-kali bash -c "COMMAND"`

---

## How to Use Tools

```bash
# Enter the container shell
docker exec -it rtexit-kali bash

# Or run a single command
docker exec rtexit-kali bash -c "nmap -sV TARGET"
```

---

## Phase 1 — Scanning & Recon ✅ 36/36

| Tool | Command | Use Case |
|------|---------|----------|
| nmap | `nmap` | Port scanning |
| masscan | `masscan` | Fast mass scanning |
| zmap | `zmap` | Internet-scale scanning |
| rustscan | `rustscan` | Fast port scanner |
| nuclei | `nuclei` | Vulnerability scanning |
| ffuf | `ffuf` | Web fuzzing |
| gobuster | `gobuster` | Directory brute-force |
| feroxbuster | `feroxbuster` | Recursive brute-force |
| subfinder | `subfinder` | Subdomain enumeration |
| amass | `amass` | OSINT + subdomain enum |
| gau | `gau` | URL discovery |
| katana | `katana` | Web crawling |
| x8 | `x8` | Hidden parameter discovery |
| subzy | `subzy` | Subdomain takeover |

---

## Phase 2 — Web Application ✅ 34/34

| Tool | Command | Use Case |
|------|---------|----------|
| sqlmap | `sqlmap` | SQL injection |
| ghauri | `ghauri` | Advanced SQLi |
| tplmap | `tplmap` | SSTI detection |
| dalfox | `dalfox` | XSS scanning |
| jwt_tool | `jwt_tool` | JWT attacks |
| semgrep | `semgrep` | Source code analysis |
| checkov | `checkov` | IaC misconfiguration |
| gitleaks | `gitleaks` | Secret scanning |
| git-dumper | `git-dumper` | Exposed .git dump |
| syft | `syft` | SBOM generation |
| grype | `grype` | Vulnerability scan |
| wpscan | `wpscan` | WordPress scanning |
| graphql-cop | `graphql-cop` | GraphQL security |
| gf | `gf` | Grep patterns for XSS/SQLi/SSRF/RCE in URLs |
| linkfinder | `linkfinder` | Discover endpoints/APIs in JS files |
| secretfinder | `secretfinder` | Extract secrets/tokens from JS files |
| corsy | `corsy` | CORS misconfiguration scanner |

---

## Phase 3 — Active Directory ✅ 52/52

| Tool | Command | Use Case |
|------|---------|----------|
| impacket-secretsdump | `impacket-secretsdump` | Credential dump |
| impacket-psexec | `impacket-psexec` | Remote execution |
| impacket-GetUserSPNs | `impacket-GetUserSPNs` | Kerberoasting |
| certipy | `certipy` | ADCS attacks |
| evil-winrm | `evil-winrm` | WinRM shell |
| bloodhound-python | `bloodhound-python` | AD graph |
| kerbrute | `kerbrute` | User enumeration |
| netexec | `netexec` | Network enumeration |
| crackmapexec | `crackmapexec` | Alias → netexec |
| responder | `responder` | NTLM capture |
| mitm6 | `mitm6` | IPv6 MITM |
| coercer | `coercer` | Auth coercion |
| bloodyAD | `bloodyAD` | AD attacks |

---

## Phase 4 — Cloud ✅ 37/37

| Tool | Command | Use Case |
|------|---------|----------|
| aws | `aws` | AWS CLI |
| pacu | `pacu` | AWS exploitation |
| enumerate-iam | `enumerate-iam` | IAM enumeration |
| awswhoami | `awswhoami` | AWS identity check |
| cloudfox | `cloudfox` | Cloud privilege paths |
| s3scanner | `s3scanner` | S3 bucket scanner |
| prowler | `prowler` | AWS/Azure/GCP audit |
| az | `az` | Azure CLI |
| azcopy | `azcopy` | Azure data exfil |
| kubectl | `kubectl` | Kubernetes |
| helm | `helm` | Helm charts |
| kube-bench | `kube-bench` | K8s CIS benchmark |
| cdk | `cdk` | Container escape |
| trivy | `trivy` | Container vuln scan |
| checkov | `checkov` | IaC scanning |

---

## Phase 5 — Mobile Testing ✅ 55/55

| Tool | Command | Use Case |
|------|---------|----------|
| adb | `adb` | Android debugging |
| apktool | `apktool` | APK decompile/repackage |
| jadx | `jadx` | Java/Kotlin decompiler |
| dex2jar | `d2j-dex2jar` | DEX to JAR |
| baksmali | `baksmali` | Disassemble DEX → smali |
| smali | `smali` | Assemble smali → DEX (patching) |
| bytecode-viewer | `bytecode-viewer` | Multi-decompiler GUI (jar at `/opt/bytecode-viewer/bytecode-viewer.jar`) |
| apkid | `apkid` | Packer/obfuscator/protector detection |
| quark-engine | `quark` | Android malware behavior analysis |
| frida | `frida` | Dynamic instrumentation |
| frida-ps | `frida-ps` | List processes |
| frida-trace | `frida-trace` | Function tracing |
| objection | `objection` | Runtime manipulation (SSL/root/jailbreak bypass) |
| fridump3 | `fridump3` | Memory dump via frida |
| setup-frida-server | `setup-frida-server` | Auto-setup frida-server on device |
| ssl-pinning-bypass | `/opt/frida-scripts/ssl-pinning-bypass.js` | Universal SSL pinning bypass (OkHttp/TrustManager/Conscrypt) |
| root-bypass | `/opt/frida-scripts/root-bypass.js` | Root detection bypass (RootBeer/su/magisk) |
| jwt-hook | `/opt/frida-scripts/jwt-hook.js` | JWT/Auth header interceptor |
| intent-monitor | `/opt/frida-scripts/intent-monitor.js` | Android Intent + deeplink monitor |
| extract-secrets | `/opt/frida-scripts/extract-secrets.js` | Runtime SharedPrefs/crypto key/SQLite extractor |
| dump-all-traffic | `/opt/frida-scripts/dump-all-traffic.js` | HTTP/S traffic hooker |
| reflutter | `reflutter` | Flutter SSL pinning bypass + repack |
| apk-mitm | `apk-mitm` | Automated SSL pinning bypass |
| uber-apk-signer | `uber-apk-signer` | APK signing after patching |
| apkleaks | `apkleaks` | APK secret/key scanning |
| androguard | `androguard` | Deep APK static analysis |
| trufflehog3 | `trufflehog3` | Secret scanning |
| drozer | `drozer` | Android component exploitation (IPC/intent/content provider) |
| drozer-agent.apk | `/opt/drozer/drozer-agent.apk` | Install on device |
| hermes-dec | `hermes-dec` | React Native Hermes bytecode decompile |
| hbctool | `hbctool` | Hermes bytecode tool |
| monodis | `monodis` | Xamarin/Mono analysis |
| js-beautify | `js-beautify` | JS deobfuscation |
| qrcode | `qrcode` | QR code generation |
| msfvenom | `msfvenom` | Mobile payload generation |
| apkeep | `apkeep` | Download APKs from Google Play / APKPure |
| ipatool | `ipatool` | Download IPA from App Store |
| ssh | `ssh` | iOS device access (jailbroken) |
| bleak | `bleak` (python) | BLE scanning |
| crackle | `/opt/crackle` | BLE crack |

### APK Full Pipeline (One Command)
| Tool | Command | Use Case |
|------|---------|----------|
| apk-analyze | `apk-analyze app.apk [out_dir]` | Full static analysis: APKiD + apkleaks + jadx + androguard + quark |
| apk-repackage | `apk-repackage app.apk [--network-all] [--debuggable] [--add-frida]` | Decompile → patch → align → sign → ready to install |
| apk-dump-data | `apk-dump-data com.pkg [out_dir]` | Extract app databases/SharedPrefs/files (root or run-as) |
| apksigner | `apksigner sign --ks key.jks app.apk` | Google's official APK signer |
| zipalign | `zipalign -v 4 in.apk out.apk` | Required alignment before signing |
| keytool | `keytool -genkeypair -keystore debug.jks` | Generate signing keystore |

### Database & Data Analysis
| Tool | Command | Use Case |
|------|---------|----------|
| sqlite3 | `sqlite3 app.db .dump` | Query/dump SQLite databases extracted from app |
| strings | `strings *.db \| grep -i pass` | Extract readable strings from binary DB files |
| realm-hook | `/opt/frida-scripts/games/realm-hook.js` | Hook Realm DB reads/writes + capture encryption key |
| firebase-admin | `python3 -c 'import firebase_admin'` | Firebase database/auth security testing |

### Server & Backend Testing
| Tool | Command | Use Case |
|------|---------|----------|
| httpx | `httpx -l endpoints.txt -json` | Probe API endpoints discovered from APK |
| nuclei | `nuclei -u https://api.target.com -t mobile/` | Scan backend API for vulnerabilities |
| protoc | `protoc --decode_raw < packet.bin` | Decode unknown Protobuf packets |
| blackboxprotobuf | `python3 -c 'import blackboxprotobuf'` | Auto-decode Protobuf without .proto file |
| websocat | `websocat ws://game-server:443/ws` | Interactive WebSocket client for game traffic |

### Game & App Hacking — Frida Scripts
| Tool | Command | Use Case |
|------|---------|----------|
| unity-il2cpp-hook | `/opt/frida-scripts/games/unity-il2cpp-hook.js` | Patch Unity IL2CPP values using dump.cs offsets |
| custom-engine-hook | `/opt/frida-scripts/games/custom-engine-hook.js` | Auto-detect custom engine, dump exports, hook native offsets |
| memory-patch | `/opt/frida-scripts/games/memory-patch.js` | scan/scan2/patchAll/freeze — Cheat Engine style |
| anti-cheat-bypass | `/opt/frida-scripts/games/anti-cheat-bypass.js` | Bypass GameGuardian/debugger/emulator/speed detection |
| iap-bypass | `/opt/frida-scripts/games/iap-bypass.js` | Google Play Billing bypass + SharedPrefs purchase flags |
| online-game-traffic | `/opt/frida-scripts/games/online-game-traffic.js` | WebSocket/UDP/TCP/HTTP game packet interceptor |
| realm-hook | `/opt/frida-scripts/games/realm-hook.js` | Realm database dump + encryption key capture |
| license-bypass | `/opt/frida-scripts/license-bypass.js` | LVL/DRM bypass: Google Play license, sig check, trial expiry |

### Crack / Patch Pipeline
| Tool | Command | Use Case |
|------|---------|----------|
| apk-crack | `apk-crack app.apk --full` | Remove license/LVL/sig checks/IAP gates via smali patching |
| apk-crack | `apk-crack app.apk --license` | Patch Google Play License Verification only |
| apk-crack | `apk-crack app.apk --iap` | Patch isPremium/isPurchased/isUnlocked methods → true |
| apk-crack | `apk-crack app.apk --sig` | Patch signature verification → always passes |

### Custom Engine Reverse Engineering
| Tool | Command | Use Case |
|------|---------|----------|
| game-reverse | `game-reverse com.game.pkg /workspace/out/` | Pull APK → detect engine → extract .so → symbol scan → Ghidra prep |
| readelf | `readelf -s main_lib.so \| grep gold` | List symbols in .so (if not stripped) |
| nm | `nm -D main_lib.so \| grep -i coin` | Dynamic symbol table |
| strings | `strings main_lib.so \| grep -i gold` | Find string references (API URLs, function names) |
| r2 | `r2 -A main_lib.so` → `afl~gold` | Find functions containing "gold" in disassembly |
| ghidra | `ghidra` → open .so → search string refs | Full decompile + pseudocode for any function |
| lief | `python3 -c 'import lief; b=lief.parse("lib.so")'` | Parse/modify ELF binary programmatically |
| patchelf | `patchelf --replace-needed oldlib.so newlib.so app` | Patch ELF dependencies |

### Game RE Tools
| Tool | Command | Use Case |
|------|---------|----------|
| il2cppdumper | `il2cppdumper libil2cpp.so global-metadata.dat out/` | Unity IL2CPP → dump.cs with all offsets |
| UnityPy | `python3 -c 'import UnityPy'` | Extract Unity assets (textures/audio/scripts) |
| scanmem | `scanmem -p PID` | Memory scanner (Cheat Engine equivalent) |
| dotnet | `dotnet --version` | .NET 6+8 runtimes for Il2CppDumper + .NET tools |
| dnfile | `python3 -c 'import dnfile'` | .NET PE analysis (Mono Unity games) |
| capstone | `python3 -c 'import capstone'` | Disassembly engine (ARM/x86/MIPS) |
| keystone | `python3 -c 'import keystone'` | Assembly engine — craft custom shellcode/patches |
| lief | `python3 -c 'import lief'` | ELF/PE/Mach-O parsing + binary patching |
| pwntools | `python3 -c 'from pwn import *'` | CTF/exploit dev: ROP chains, shellcode, binary analysis |

### Root Emulator Setup
| Script | Use Case |
|--------|----------|
| `.\setup-root-avd.ps1` | Create root-capable AVD (Google APIs, no Play Store) |
| `.\setup-root-avd.ps1 -Start` | Create + start immediately |
| `adb root && adb shell` | Enable root shell (only on google_apis AVD) |
| `.\android-bridge.ps1` | Connect Docker container to emulator |

---

## Phase 6 — C2 & Post-Exploitation ✅ 34/35

| Tool | Command | Use Case |
|------|---------|----------|
| msfconsole | `msfconsole` | Metasploit framework |
| msfvenom | `msfvenom` | Payload generation |
| sliver-client | `sliver-client` | Sliver C2 client |
| Empire | `/opt/Empire` | PowerShell Empire C2 |
| Villain | `/opt/Villain` | Shell handler C2 |
| PoshC2 | `/opt/PoshC2` | PowerShell C2 |
| chisel | `chisel` | TCP tunneling |
| ligolo-proxy | `ligolo-proxy` | Layer 3 tunneling |
| ligolo-agent | `ligolo-agent` | Ligolo agent |
| socat | `socat` | Port forwarding |
| proxychains4 | `proxychains4` | Proxy chains |
| iodine | `iodine` | DNS tunneling |
| dnscat2 | `/opt/dnscat2` | DNS C2 |
| ScareCrow | `/opt/ScareCrow` | EDR evasion payload |
| donut-shellcode | `donut-shellcode` | Shellcode generator |
| Veil | `/opt/Veil` | AV evasion payloads |
| macro_pack | `/opt/macro_pack` | Office macro payloads |
| SysWhispers3 | `/opt/SysWhispers3` | Direct syscall evasion |
| pypykatz | `pypykatz` | Mimikatz in Python |
| DeathStar | `/opt/DeathStar` | AD automated pwn |
| DonPAPI | `/opt/DonPAPI` | DPAPI credential dump |
| bloodyAD | `bloodyAD` | AD attacks |
| evil-winrm | `evil-winrm` | WinRM shell |
| netexec | `netexec` | Network execution |
| crackmapexec | `crackmapexec` | Alias → netexec |
| impacket-wmiexec | `impacket-wmiexec` | WMI execution |
| impacket-psexec | `impacket-psexec` | PSExec |
| impacket-smbexec | `impacket-smbexec` | SMB execution |
| pyrdp | `pyrdp` (python) | RDP MITM |
| atomic-red-team | `/opt/atomic-red-team` | Purple team tests |
| caldera | `/opt/caldera` | MITRE CALDERA |

---

## Phase 7 — OSINT & Intelligence ✅ 26/27

| Tool | Command | Use Case |
|------|---------|----------|
| theHarvester | `theHarvester` | Email/domain recon |
| h8mail | `h8mail` | Email breach lookup |
| holehe | `holehe` | Email account discovery |
| maigret | `maigret` | Username OSINT |
| socialscan | `socialscan` | Username/email availability |
| sherlock | `sherlock` | Username across platforms |
| shodan | `shodan` | Internet-wide scanning |
| censys | `censys` (python) | Certificate/host search |
| duckduckgo-search | `ddgs` (python) | OSINT search |
| ipinfo | `ipinfo` (python) | IP intelligence |
| gitleaks | `gitleaks` | Code secret scanning |
| trufflehog | `trufflehog` | Deep secret scanning |
| git-dumper | `git-dumper` | Exposed .git dump |
| PyGithub | python module | GitHub API access |
| gau | `gau` | URL discovery |
| waybackurls | `waybackurls` | Wayback URLs |
| recon-ng | `/opt/recon-ng` | OSINT framework |
| spiderfoot | `spiderfoot` | Automated OSINT |
| whois | `whois` | Domain registration |
| dnsrecon | `dnsrecon` | DNS recon |
| dnsenum | `dnsenum` | DNS enumeration |
| fierce | `fierce` | DNS brute-force |
| nbtscan | `nbtscan` | NetBIOS scan |
| CrossLinked | `/opt/CrossLinked` | LinkedIn OSINT |

---

## Phase 11 — Specialist ✅ 30/31

| Tool | Command | Use Case |
|------|---------|----------|
| gophish | `gophish` | Phishing campaigns |
| evilginx2 | `evilginx2` | Reverse proxy phishing |
| SET | `/opt/setoolkit` | Social engineering |
| king-phisher | `/opt/king-phisher` | Phishing server |
| CredSniper | `/opt/CredSniper` | Credential harvesting |
| o365spray | `o365spray` | O365 password spray |
| phishery | `/opt/phishery` | Word doc macros |
| openocd | `openocd` | JTAG/UART debug |
| flashrom | `flashrom` | Flash chip read/write |
| avrdude | `avrdude` | AVR programming |
| minicom | `minicom` | Serial terminal |
| pyserial | python module | Serial communication |
| pyModbusTCP | python module | SCADA/Modbus |
| bleak | python module | BLE IoT attacks |
| steghide | `steghide` | Steganography |
| binwalk | `binwalk` | Firmware extraction |
| exiftool | `exiftool` | Metadata analysis |
| zsteg | `zsteg` | PNG/BMP stego |
| stegsolve | `stegsolve` | Image stego analysis |
| stegoveritas | `stegoveritas` | Multi-format stego |
| outguess | `/opt/outguess` | Stego tool |
| garak | `garak` | LLM vulnerability scanner |
| promptfoo | `promptfoo` | Prompt injection testing |
| openai | python module | OpenAI API |
| anthropic | python module | Anthropic API |
| langchain | python module | LLM chains |
| beef-xss | `beef-xss` | Browser exploitation |
| SecLists | `/opt/SecLists` | Wordlist collection |
| atomic-red-team | `/opt/atomic-red-team` | Purple team tests |

---

## Phase 10 — Network & WiFi ✅ 36/39

| Tool | Command | Use Case |
|------|---------|----------|
| tcpdump | `tcpdump` | Packet capture |
| tshark | `tshark` | Wireshark CLI |
| netsniff-ng | `netsniff-ng` | Fast packet analyzer |
| arpwatch | `arpwatch` | ARP monitoring |
| bettercap | `bettercap` | MITM framework |
| ettercap | `ettercap` | MITM attacks |
| arpspoof | `arpspoof` | ARP poisoning |
| dsniff | `dsniff` | Password sniffing |
| sslstrip | `sslstrip` | SSL downgrade |
| mitmproxy | `mitmproxy` | HTTP/S proxy |
| ncat | `ncat` | Netcat enhanced |
| socat | `socat` | Port forwarding |
| hping3 | `hping3` | Packet crafting |
| proxychains4 | `proxychains4` | Proxy chains |
| macchanger | `macchanger` | MAC spoofing |
| aircrack-ng | `aircrack-ng` | WEP/WPA crack |
| airmon-ng | `airmon-ng` | Monitor mode |
| airodump-ng | `airodump-ng` | WiFi capture |
| aireplay-ng | `aireplay-ng` | Deauth/replay |
| wifite | `wifite` | Automated WiFi attack |
| hcxdumptool | `hcxdumptool` | PMKID capture |
| hcxpcapngtool | `hcxpcapngtool` | PMKID convert |
| hostapd-wpe | `hostapd-wpe` | Evil Twin AP |
| ubertooth-util | `ubertooth-util` | Bluetooth sniff |
| bleak | python module | BLE scanning |
| crackle | `/opt/crackle` | BLE crack |
| sipvicious | `svmap` | SIP scanning |
| rtpbreak | `rtpbreak` | RTP sniffing |
| iodine | `iodine` | DNS tunneling |
| dnscat2 | `/opt/dnscat2` | DNS C2 |
| ptunnel-ng | `ptunnel-ng` | ICMP tunneling |
| responder | `responder` | NTLM capture |
| mitm6 | `mitm6` | IPv6 MITM |
| impacket-ntlmrelayx | `impacket-ntlmrelayx` | NTLM relay |

---

## Phase 9 — Binary Analysis & RE ✅ 40/40

| Tool | Command | Use Case |
|------|---------|----------|
| gdb | `gdb` | Debugger |
| pwndbg | `/opt/pwndbg` | GDB enhanced |
| GEF | `/root/.gef-*.py` | GDB enhanced features |
| radare2 | `radare2` / `r2` | Disassembler/debugger |
| ghidra | `ghidra` | Decompiler |
| objdump | `objdump` | Binary disassembly |
| binwalk | `binwalk` | Firmware analysis |
| pwntools | python module | CTF exploit dev |
| ROPgadget | `ROPgadget` | ROP chain builder |
| ropper | `ropper` | ROP gadget finder |
| nasm | `nasm` | Assembler |
| capstone | python module | Disassembly engine |
| keystone | python module | Assembly engine |
| unicorn | python module | Emulation engine |
| angr | python module | Binary analysis framework |
| floss | `floss` | String extraction |
| afl-fuzz | `afl-fuzz` | Coverage fuzzer |
| radamsa | `radamsa` | Mutation fuzzer |
| boofuzz | python module | Network fuzzer |
| yara | `yara` | Pattern matching |
| yara-rules | `/opt/yara-rules` | Rule collection |
| volatility3 | python module | Memory forensics |
| foremost | `foremost` | File carving |
| bulk_extractor | `bulk_extractor` | Digital forensics |
| exiftool | `exiftool` | Metadata extraction |
| sleuthkit | `fls`, `icat` | Disk forensics |

---

## Phase 8 — Passwords & Credentials ✅ 27/28

| Tool | Command | Use Case |
|------|---------|----------|
| hashcat | `hashcat` | GPU hash cracking |
| john | `john` | CPU hash cracking |
| ophcrack | `ophcrack` | Windows LM/NTLM crack |
| hydra | `hydra` | Online brute-force |
| medusa | `medusa` | Online brute-force |
| ncrack | `ncrack` | Network auth cracking |
| patator | `patator` | Multi-purpose brute-force |
| kerbrute | `kerbrute` | Kerberos password spray |
| netexec | `netexec` | SMB/LDAP spray |
| cewl | `cewl` | Custom wordlist generator |
| crunch | `crunch` | Wordlist generator |
| cupp | `cupp` | Profile-based wordlist |
| impacket-GetUserSPNs | `impacket-GetUserSPNs` | Kerberoasting |
| impacket-GetNPUsers | `impacket-GetNPUsers` | AS-REP Roasting |
| impacket-ticketer | `impacket-ticketer` | Golden/Silver ticket |
| impacket-getST | `impacket-getST` | Service ticket |
| pypykatz | `pypykatz` | LSASS dump parse |
| impacket-secretsdump | `impacket-secretsdump` | SAM/NTDS dump |
| impacket-samrdump | `impacket-samrdump` | SAM enumeration |
| rockyou.txt | `/opt/SecLists/Passwords/Leaked-Databases/rockyou.txt` | Password list |
| pycryptodome | python module | Crypto operations |
| hashpumpy | python module | Hash length extension |
| sympy | python module | Math/crypto |
| gmpy2 | python module | Arbitrary precision math |
| ecdsa | python module | Elliptic curve crypto |

---

## ⚠️ NOT in Container

| Tool | Alternative |
|------|------------|
| ScoutSuite | `docker run rossja/ncc-scoutsuite` or `prowler` |
| Havoc C2 | Run on host machine (GUI required) |
| Cobalt Strike | Commercial — not included |
| Certify.exe | Windows binary — deploy to target |
| Rubeus.exe | Windows binary — deploy to target |

---

## Wordlists Location

```
/opt/SecLists/
├── Discovery/DNS/                    → subdomains
├── Discovery/Web-Content/            → directories
├── Passwords/Leaked-Databases/       → rockyou.txt
├── Usernames/Names/                  → names.txt
└── Fuzzing/                          → payloads
```
