00^:DÆMONBins
DÆMONBINS
the Off-the-Land Almanac
GTFOBins, LOLBAS, WADComs and LOOBins, with DÆMON's command references. Filter by access, environment and execution context. Configure templates and keep useful commands close.
01^:By platform
02^:The collections
GTFOBins
Unix binaries abused to break out of restricted shells, read/write files, and escalate via SUID, sudo, and capabilities.
Browse GTFOBins →LOLBAS
Windows living-off-the-land binaries, scripts, and libraries — signed and built-in tools for execution, download, and AWL bypass.
Browse LOLBAS →WADComs
Offensive tools and commands for Windows and Active Directory, indexed by what access you already hold.
Browse WADComs →LOOBins
Native macOS binaries, with upstream use cases, paths, detection references and explicit compatibility notes.
Browse LOOBins →DÆMON
Authored command references for Windows, Active Directory, containers and cloud administration. Verification and prerequisites are recorded per entry.
Browse DÆMON →03^:How it is assembled
Five sources, one index
How the catalog is assembled. Each collection is ingested from its own repository at a pinned commit, every entry is expanded into individual techniques, and all of them land in one index that carries ATT&CK mapping and detection guidance with each entry.
test.local,
john / password123 — in the same spirit as GTFOBins, LOLBAS, WADComs and
MITRE ATT&CK. For authorized testing, CTFs, detection engineering and education only. Know your scope.
GTFOBins, LOLBAS, WADComs and LOOBins are GPL-3.0 projects; this merged work is GPL-3.0. See credits & licenses.