# RTExit Tool Reference

Use tools only inside the authorized scope and record commands through the autodoc workflow.

## Planning and Reporting

| Tool | Purpose | Notes |
|---|---|---|
| Markdown | Engagement docs and reports | Keep evidence links relative to `_rtexit-output/docs/` |
| Python 3 | Automation scripts | Used by config resolver, tracker, autodoc |
| Pandoc | Report conversion | Optional for PDF/DOCX export |

## Reconnaissance

| Tool | Purpose | Notes |
|---|---|---|
| Amass | Passive/active asset discovery | Respect active mode authorization |
| Subfinder | Passive subdomain discovery | Good first-pass inventory |
| httpx | HTTP probing | Capture title, status, tech, TLS |
| Nmap | Network and service discovery | Stage scans and obey rate limits |
| Nuclei | Template-based validation | Review templates before running |
| Shodan/Censys | Internet exposure search | Passive external visibility |

## Web and API

| Tool | Purpose | Notes |
|---|---|---|
| Burp Suite | Proxy, repeater, scanner, evidence | Save project files per engagement |
| OWASP ZAP | Proxy/scanner alternative | Useful for baseline scans |
| ffuf | Content and parameter discovery | Use scoped wordlists and rate limits |
| sqlmap | SQL injection validation | Use only with explicit approval |
| jwt-cli/jq | Token and JSON inspection | Do not forge production tokens |

## Mobile and Desktop

### Static Analysis
| Tool | Command | Purpose |
|---|---|---|
| apktool | `apktool d app.apk -o out/` | Decompile APK → smali + resources |
| jadx | `jadx -d output/ app.apk` | Java/Kotlin decompiler |
| baksmali | `baksmali d classes.dex -o smali/` | Disassemble DEX → smali |
| smali | `smali a smali/ -o patched.dex` | Reassemble smali → DEX (patching) |
| apkid | `apkid app.apk` | Detect packer/obfuscator/protector |
| quark-engine | `quark -a app.apk` | Malware behavior + MITRE ATT&CK |
| apkleaks | `apkleaks -f app.apk` | Hardcoded secrets/keys/endpoints |
| androguard | `androguard analyze app.apk` | Deep APK static analysis |
| bytecode-viewer | `bytecode-viewer` | Multi-decompiler GUI (jadx+cfr+procyon) |
| dex2jar | `d2j-dex2jar app.apk` | DEX → JAR for jd-gui |

### Dynamic / Runtime
| Tool | Command | Purpose |
|---|---|---|
| frida | `frida -U -f com.target.app -l script.js --no-pause` | Dynamic instrumentation |
| objection | `objection -g com.target.app explore` | Runtime SSL/root/jailbreak bypass |
| fridump3 | `fridump3 -U com.target.app -o dump/` | Full memory dump |
| drozer | `drozer console connect` | IPC/intent/content-provider exploitation |

### Frida Scripts Library (`docker/frida-scripts/`)
| Script | Purpose |
|---|---|
| `ssl-pinning-bypass.js` | OkHttp3 + TrustManager + Conscrypt + NetworkSecurityConfig |
| `root-bypass.js` | RootBeer + magisk + su + PackageManager detection |
| `extract-secrets.js` | SharedPrefs + crypto keys + SQLite + JWT at runtime |
| `jwt-hook.js` | Authorization headers + API keys + Base64 JWT |
| `intent-monitor.js` | Intents + deeplinks + ContentProvider + Broadcasts |
| `dump-all-traffic.js` | HTTP/S requests via HttpURLConnection + OkHttp3 + WebView |

### SSL Pinning Bypass
| Tool | Command | Purpose |
|---|---|---|
| apk-mitm | `apk-mitm app.apk` | Automated SSL pinning bypass + repack |
| reflutter | `reflutter app.apk` | Flutter SSL pinning bypass |
| uber-apk-signer | `uber-apk-signer -a patched.apk` | Sign APK after patching |

### Downloaders
| Tool | Command | Purpose |
|---|---|---|
| apkeep | `apkeep -a com.target.app -d google-play ./` | Download APK from Google Play |
| ipatool | `ipatool download -b com.target.app` | Download IPA from App Store |

### Desktop / .NET
| Tool | Purpose |
|---|---|
| dnSpy/ILSpy | .NET inspection |
| monodis | Xamarin/Mono assembly analysis |

## Cloud and Infrastructure

| Tool | Purpose | Notes |
|---|---|---|
| AWS CLI | AWS inventory and validation | Use read-only roles where possible |
| Azure CLI | Azure inventory and validation | Respect tenant boundaries |
| gcloud | GCP inventory and validation | Use scoped projects |
| ScoutSuite/Prowler | Cloud posture review | Validate findings manually |
| kubectl | Kubernetes review | Use scoped kubeconfig |

