lolbas

Search gtfobins and lolbas files from your terminal

Offline command line lookup utility for GTFOBins (https://github.com/GTFOBins/GTFOBins.github.io), LOLBAS (https://github.com/LOLBAS-Project/LOLBAS), WADComs (https://wadcoms.github.io), and HijackLibs (https://hijacklibs.net/).

Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques

goLoL is a Windows host scanner with dual support for LOLBAS binaries and LOLDrivers. It lists LOLBAS techniques runnable at your current privilege level (with MITRE ATT&CK mappings) and can scan local .sys files for vulnerable/malicious LOLDrivers hash matches.

Backdoor Visual Studio project files with custom shellcode, which executes whenever the project is opened or built.

Living off the Land (LOL) attack techniques, tools, and defender resources

A post-exploitation toolkit to simulate the weaponization and detection of native Windows binaries based on LOLBas framework.

Exfiltrate data with DNS queries. Based on CertUtil and NSLookup.

Offensive File Transfer Techniques — hands-on study notes on moving files to and from a target during an engagement across every channel: HTTP/SMB/FTP/TFTP/WebDAV, netcat/socat, scp/rsync, LOLBAS/GTFOBins, base64 no-egress, Meterpreter, plus detection. CC BY 4.0.

Webscrapper written in python3 to show lolbas in a terminal.

A C2 server designed to run within Electron applications.

A unified, interactive reference for Living Off The Land Binaries (LOLBAS & GTFOBins). Features a dynamic payload builder (LHOST/LPORT), real-time search, MITRE ATT&CK mapping, and auto-updates from official sources.

Collection of LOL items from these popular opensource projects: LOLBAS, GTFOBins, WADComs, and PayloadAllTheThings

Русскоязычная адаптация проекта LOLBAS: 400+ техник «Living off the Land» в Excel, Markdown и JSON. Структурировано по категориям, с привязкой к MITRE ATT&CK, путями, привилегиями и методами обнаружения.

lowest-common denominator binaries

Post-ex techniques and attack surface exploration of Microsoft Copilot

ssh.exe is available in windows 10 / server 2019 by default, let's LOLBAS it up!

🦝 Self-contained reverse shell generator — zero dependencies, single HTML file. Syntax highlighting, animated diagrams, shell obfuscation, LotL techniques & more.

Powershell script that checks if a list of executables contains potential living of the land binaries or scripts.

Living off the Land LOLBins MCP Server — 59 composite tools for LOL binary intelligence across 10 catalogs (GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, LOLESXi, LOTP, LOLC2, LOFLCAB, WADComs)