DΛΣMӨП

05 · Credits

Credits & Licenses

DÆMONBins is a merge of three public, GPL-3.0 living-off-the-land references. All three are licensed under the GNU GPL-3.0, so this combined dataset and site are a single GPL-3.0 work. Every technique row shows its source, and per-tool pages link back to the upstream entry.

GTFOBins

Unix binaries abused to break out of restricted shells, read/write files, and escalate via SUID, sudo, and capabilities.

// provenance · GTFO

  • Upstream: github.com/GTFOBins/GTFOBins.github.io
  • Created by: Emilio Pinna (@norbemi) & contributors
  • License: GPL-3.0
  • Merged at commit: acd5246
  • Rows here: 2125
  • What changed: Every full binary is expanded per function × example × context into individual technique rows; SUID / sudo / capabilities contexts also flag Privilege Escalation; `inherit` entries resolve their `from:` binary to union the inherited capabilities.

LOLBAS

Windows living-off-the-land binaries, scripts, and libraries — signed and built-in tools for execution, download, and AWL bypass.

// provenance · LOL

  • Upstream: github.com/LOLBAS-Project/LOLBAS
  • Created by: Oddvar Moe (@oddvarmoe) & contributors
  • License: GPL-3.0
  • Merged at commit: 7aca936
  • Rows here: 481
  • What changed: Each command becomes a row carrying its Category → unified capability, Full_Path, MITRE id, and the flattened Detection (Sigma / Splunk / Elastic / IOC). HonorableMentions are skipped, matching upstream validation.

WADComs

Offensive tools and commands for Windows and Active Directory, indexed by what access you already hold.

// provenance · WAD

  • Upstream: github.com/WADComs/WADComs.github.io
  • Created by: John Woodman (@JohnWoodman15) & contributors
  • License: GPL-3.0
  • Merged at commit: a864cd1
  • Rows here: 100
  • What changed: The 100 upstream entries are ingested verbatim from the Jekyll collection; attack_types map to unified capabilities while every original label is kept, and AD scope is derived from the services/items each entry declares.

DÆMON additions

Authored here — modern 2024–2026 tradecraft the three upstreams lack, plus 134 fact-checked Windows/AD additions. Every entry carries a canonical reference.

// provenance · DMN

  • Authored by: DÆMON (DAEMON-404)
  • License: GPL-3.0 — contributed under the same license as the upstreams, keeping the collection a single GPL-3.0 work.
  • Rows here: 179 (badged NEW, filterable under Source = DÆMON)
  • Provenance rule: the 134 Windows/AD additions were transcribed and fact-checked; the modernization backlog documents only real, publicly-referenced commands, each with a canonical source. No fabricated commands.

This site

Built with Astro and Pagefind, themed with Rosé Pine, in the visual language of daemon-sec.xyz. Full licensing is in THIRD_PARTY_NOTICES.md; the site is licensed GPL-3.0.

For authorized testing, CTFs, detection engineering and education only. Know your scope. If any upstream author would prefer a change, open an issue on the site repository and it will be honoured.