GTFOBins/GTFOBins.github.io resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

13590 stars · 1673 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

GTFOBins is a curated, community-maintained dataset and reference website of Unix-like executables that can be abused to bypass local security restrictions in misconfigured systems. Each entry documents techniques such as spawning shells, escalating privileges, and transferring files, exposed both as a browsable site and a JSON API.

Use cases

• find ways to break out of a restricted shell
• look up sudo privilege escalation techniques for a binary
• identify SUID binaries that can spawn a root shell
• find commands for file transfer during post-exploitation
• audit a Linux system for dangerous binary capabilities
• learn defensive hardening by checking which binaries are abusable
• generate reverse shell one-liners from available executables

When to choose

• you are doing red team post-exploitation on Unix-like systems
• you are a blue teamer auditing sudo/SUID/capability misconfigurations
• you need a machine-readable (JSON) database of binary abuse techniques
• you want a quick reference during CTFs or security training

When to avoid

• you need Windows equivalents (use LOLBAS instead)
• you are looking for actual software exploits or vulnerabilities in programs
• you need automated scanning rather than a manual reference
• you need macOS-specific techniques beyond generic Unix binaries

Facets

dataset · maturity active

security penetration-testing documentation security penetration-testing operating-systems developer-tools self-hosted post-exploitation privilege-escalation reverse-shell bind-shell redteam blueteam suid sudo living-off-the-land yaml-dataset static-site linux web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="GTFOBins/GTFOBins.github.io")