00 ^: DÆMONBins

DÆMONBINS

Name: DÆMONBins technique index
Creator: DÆMON
License: https://www.gnu.org/licenses/gpl-3.0.html

the Off-the-Land Almanac

GTFOBins, LOLBAS and WADComs — merged, resynced, and extended with DÆMON's fact-checked modern tradecraft. One filterable catalog, mapped to MITRE ATT&CK.

Open the catalog or press /

2,885Techniques

842Tools

179DÆMON new

NIXGTFOBins

WINLOLBAS

ADWADComs

NEWDÆMON

01SUID · sudo

02AWL Bypass

03ADCS · ESC

04Coercion

gtfo2125 techniques/

lolbas481 techniques/

wadcoms100 upstream/

daemon179 authored here/

mitreATT&CK mapped/

gplGPL-3.0/

01 ^: By platform

2,306 Linux

744 Windows

890 macOS

217 ActiveDirectory

02 ^: The four decks

01 · GTFO 2125

GTFOBins

Unix binaries abused to break out of restricted shells, read/write files, and escalate via SUID, sudo, and capabilities.

Browse GTFOBins →

02 · LOL 481

LOLBAS

Windows living-off-the-land binaries, scripts, and libraries — signed and built-in tools for execution, download, and AWL bypass.

Browse LOLBAS →

03 · WAD 100

WADComs

Offensive tools and commands for Windows and Active Directory, indexed by what access you already hold.

Browse WADComs →

04 · DMN 179

DÆMON

Authored here — modern 2024–2026 tradecraft the three upstreams lack, plus 134 fact-checked Windows/AD additions. Every entry carries a canonical reference.

Browse DÆMON →

Scope

Everything here is placeholder-only reference material — lab IPs, test.local, john / password123 — in the same spirit as GTFOBins, LOLBAS, WADComs and MITRE ATT&CK. For authorized testing, CTFs, detection engineering and education only. Know your scope.

GTFOBins, LOLBAS and WADComs are each GPL-3.0; this merged work is GPL-3.0. See credits & licenses.