05 · Credits

Credits & Licenses

DÆMONBins combines four public, GPL-3.0 command references. All four are licensed under the GNU GPL-3.0, so this combined dataset and site are a single GPL-3.0 work. Every technique row shows its source, and per-tool pages link back to the upstream entry.

LOOBins

Native macOS binaries, with upstream use cases, paths, detection references and explicit compatibility notes.

// provenance · ORCHARD

  • Upstream: github.com/infosecB/LOOBins
  • Created by: Brendan Chamberlain (@infosecB) & contributors
  • License: GPL-3.0
  • Merged at commit: 399e3c4bdddb55c7dc49beb20bfe43490eac1184
  • Rows here: 183
  • What changed: Each upstream macOS use case becomes a separate command record. Original names, descriptions, paths and detection references are retained. Tactics outside the catalog capability vocabulary remain in nativeCategory. Imported examples are not labelled as lab tested.

GTFOBins

Unix binaries abused to break out of restricted shells, read/write files, and escalate via SUID, sudo, and capabilities.

// provenance · GTFO

  • Upstream: github.com/GTFOBins/GTFOBins.github.io
  • Created by: Emilio Pinna (@norbemi) & contributors
  • License: GPL-3.0
  • Merged at commit: acd5246
  • Rows here: 2125
  • What changed: Every full binary is expanded per function × example × context into individual technique rows; SUID / sudo / capabilities contexts also flag Privilege Escalation; `inherit` entries resolve their `from:` binary to union the inherited capabilities.

LOLBAS

Windows living-off-the-land binaries, scripts, and libraries — signed and built-in tools for execution, download, and AWL bypass.

// provenance · LOL

  • Upstream: github.com/LOLBAS-Project/LOLBAS
  • Created by: Oddvar Moe (@oddvarmoe) & contributors
  • License: GPL-3.0
  • Merged at commit: 7aca936
  • Rows here: 481
  • What changed: Each command becomes a row carrying its Category → unified capability, Full_Path, MITRE id, and the flattened Detection (Sigma / Splunk / Elastic / IOC). HonorableMentions are skipped, matching upstream validation.

WADComs

Offensive tools and commands for Windows and Active Directory, indexed by what access you already hold.

// provenance · WAD

  • Upstream: github.com/WADComs/WADComs.github.io
  • Created by: John Woodman (@JohnWoodman15) & contributors
  • License: GPL-3.0
  • Merged at commit: a864cd1
  • Rows here: 100
  • What changed: The 100 upstream entries are ingested verbatim from the Jekyll collection; attack_types map to unified capabilities while every original label is kept, and AD scope is derived from the services/items each entry declares.

DÆMON additions

Authored command references for Windows, Active Directory, containers and cloud administration. Verification and prerequisites are recorded per entry.

// provenance · DMN

  • Authored by: DÆMON (DAEMON-404)
  • License: GPL-3.0 — contributed under the same license as the upstreams, keeping the collection a single GPL-3.0 work.
  • Rows here: 196 (labelled DÆMON, filterable under Source = DÆMON; authorship does not indicate recency)
  • Provenance rule: the 134 Windows/AD additions were transcribed and fact-checked; the modernization backlog documents only real, publicly-referenced commands, each with a canonical source. No fabricated commands.

This site

GTFOBins commands carry Linux compatibility until their exact macOS syntax and context are checked. Native macOS references come from LOOBins. “Documentation checked” means the cited documentation was reviewed; “Upstream reference” means imported reference material. Neither label claims a successful lab run.

Built with Astro andPagefind, themed withRosé Pine, in the visual language of daemon-sec.xyz. Full licensing is in THIRD_PARTY_NOTICES.md; the site is licensedGPL-3.0.

For authorized testing, CTFs, detection engineering and education only. Know your scope. If any upstream author would prefer a change, open an issue on the site repository and it will be honoured.