13.8K ·GitHub
What is this?
GTFOBins is a curated list of Unix-like executables that can be abused to bypass local security restrictions in misconfigured systems — for example, binaries a restricted user can turn into a root shell.
GTFOBins is a curated list of Unix-like executables that can be abused to bypass local security restrictions in misconfigured systems — for example, binaries a restricted user can turn into a root shell.Is this a tool I install and run, or a site I look things up on?It is a reference website, not software — there is nothing to install; you just browse the entries at gtfobins.org.
It is a reference website, not software — there is nothing to install; you just browse the entries at gtfobins.org.Say I land a low-privilege shell on a server — how does GTFOBins help me from there?Enumerate which binaries your user can execute, look each name up on the site, and follow the documented abuse technique — typically spawning a root shell or copying files out.
Enumerate which binaries your user can execute, look each name up on the site, and follow the documented abuse technique — typically spawning a root shell or copying files out.What kind of misconfiguration actually makes these binaries dangerous?One that lets a low-privileged user run a program with more power than intended — most famously sudo rules that run a standard binary as root. A listing alone does not mean a box is vulnerable; the exposure exists only where such a user can actually execute the binary.
One that lets a low-privileged user run a program with more power than intended — most famously sudo rules that run a standard binary as root. A listing alone does not mean a box is vulnerable; the exposure exists only where such a user can actually execute the binary.Is it built for attackers or for defenders?Both — it is tagged for red teams doing post-exploitation and for blue teams, who can audit their own sudo rules and permissions for binaries that could be abused this way.
Both — it is tagged for red teams doing post-exploitation and for blue teams, who can audit their own sudo rules and permissions for binaries that could be abused this way.Does this apply only on Linux, or on other systems too?It targets Unix-like systems — Linux and Unix are the project's own stated focus areas; Windows executables are not covered.
It targets Unix-like systems — Linux and Unix are the project's own stated focus areas; Windows executables are not covered.What does a single entry on the site actually show?Each entry documents concrete ways to abuse that binary — spawning an interactive shell, reading or writing files, or opening bind and reverse shells; bind-shell, reverse-shell and exfiltration are literally among the project's own topics.
Each entry documents concrete ways to abuse that binary — spawning an interactive shell, reading or writing files, or opening bind and reverse shells; bind-shell, reverse-shell and exfiltration are literally among the project's own topics.Does the list include every binary on a Unix system?No — it is curated, so only executables with a known way to bypass local security restrictions get an entry; ordinary harmless binaries are not listed.
No — it is curated, so only executables with a known way to bypass local security restrictions get an entry; ordinary harmless binaries are not listed.Is the project still actively maintained?Yes — it has been around since 2018, is not archived, and has gathered over 13.7k stars on GitHub.
Yes — it has been around since 2018, is not archived, and has gathered over 13.7k stars on GitHub.What are similar projects?hacker-roadmap, PayloadsAllTheThings, Claude-Red, fsociety, Decepticon, PowerSploit, bug-bounty-hunting-prompts, Red-Teaming-Toolkit
hacker-roadmap, PayloadsAllTheThings, Claude-Red, fsociety, Decepticon, PowerSploit, bug-bounty-hunting-prompts, Red-Teaming-ToolkitWhich topics is it in?post-exploitation, exploitation, privilege-escalation, redteam, pentest, bypass, static-site, offensive-security, unix, yaml, pentesting, hacking
post-exploitation, exploitation, privilege-escalation, redteam, pentest, bypass, static-site, offensive-security, unix, yaml, pentesting, hacking