CLI Tools
Command line utilities
gmgn-portfolio
by GMGNAI
Analyze any crypto wallet by address — holdings, realized/unrealized P&L, win rate, trading history, performance stats, specific token balance, and tokens created by a developer wallet (with ATH market cap and DEX graduation status) via GMGN API on Solana, BSC, Base, or Ethereum. Use when user asks about a wallet's holdings, P&L, win rate, what tokens a dev has launched, the highest ATH token a dev ever created, or wants a wallet report to decide whether to copy-trade or follow.
acl-abuse
by blacklanternsecurity
Exploits misconfigured Active Directory ACLs for privilege escalation. Covers GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, targeted Kerberoasting via SPN manipulation, shadow credentials (msDS-KeyCredentialLink → PKINIT), and AdminSDHolder persistence.
av-edr-evasion
by blacklanternsecurity
Bypass antivirus and EDR detection for payload delivery during exploitation. Covers custom payload compilation (mingw C, Go), AMSI bypass, shellcode alternatives, and ETW patching. Route here when an agent reports a payload was quarantined, blocked, or detected by endpoint protection.
credential-dumping
by blacklanternsecurity
Extracts credentials from Active Directory: DCSync replication, NTDS.dit database extraction, SAM hive dump, Azure AD Connect (ADSync) credential extraction, LAPS passwords (legacy + Windows LAPS), gMSA passwords (KDS root key + GoldenGMSA), dMSA exploitation (BadSuccessor CVE-2025-21293), and DSRM credentials.
command-injection
by blacklanternsecurity
Guide OS command injection exploitation during authorized penetration testing.
windows-service-dll-abuse
by blacklanternsecurity
Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.
linux-file-path-abuse
by blacklanternsecurity
Exploit writable critical files, NFS misconfigurations, shared library hijacking, and privileged group membership (docker, lxd, disk, adm, video, staff) for Linux privilege escalation. Use when a user belongs to a privileged group or has write access to sensitive files or paths.
context7-cli
by Mic92
Fetch up-to-date library documentation from Context7. Use for getting code examples and API docs for any library.
weather-cli
by Mic92
Get weather forecasts. Use for current weather/multi-day forecasts worldwide.
lean4
by cameronfreer
"Use when editing .lean files, seeing type mismatch/sorry/failed to synthesize instance/axiom warnings, lake build errors, or searching mathlib for theorem proofs."
container-escapes
by blacklanternsecurity
Container escape, Docker breakout, and Kubernetes exploitation.
kerberos-delegation
by blacklanternsecurity
Exploits Kerberos delegation misconfigurations for privilege escalation and lateral movement in Active Directory. Covers Unconstrained Delegation (TGT harvesting via coercion), Constrained Delegation (S4U2Self + S4U2Proxy with SPN swapping), and Resource-Based Constrained Delegation (RBCD via writable machine accounts).
file-upload-bypass
by blacklanternsecurity
Guide file upload restriction bypass during authorized penetration testing.
password-spraying
by blacklanternsecurity
Performs password spraying against authentication services with lockout-safe techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA, and any service with username/password auth. Service-agnostic — the orchestrator passes target services and spray intensity tier.
trust-attacks
by blacklanternsecurity
Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation. Covers trust enumeration (nltest, PowerView, BloodHound), SID history injection (child domain to forest root via golden/diamond ticket with extra SIDs), inter-realm TGT forging using trust keys, cross-forest trust abuse (SID filtering bypass, RBCD, Kerberoasting via trust account), and PAM trust exploitation (shadow principals in bastion forests).
linux-cron-service-abuse
by blacklanternsecurity
Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.
adcs-persistence
by blacklanternsecurity
Establishes persistence and exploits weak certificate mapping in AD CS. Covers ESC9 (no security extension), ESC10 (weak certificate mapping), ESC12-15 (YubiHSM, issuance policy, altSecIdentities, application policies), Golden Certificate (forge with stolen CA key), certificate theft (DPAPI/CAPI/CNG), and account persistence via certificate mapping.
pivoting-tunneling
by blacklanternsecurity
Network pivoting, port forwarding, and tunneling through compromised hosts to reach internal networks.
gpo-abuse
by blacklanternsecurity
Exploits Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. Covers GPO enumeration (GPOHound, BloodHound, PowerView), exploitation via immediate tasks, logon scripts, and registry modifications (SharpGPOAbuse, PowerGPOAbuse, pyGPOAbuse, GroupPolicyBackdoor), SYSVOL/NETLOGON logon script poisoning, and GPP password extraction.
pass-the-hash
by blacklanternsecurity
Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket for lateral movement.
orchestrator
by blacklanternsecurity
USE THIS SKILL when the user provides a target or list of targets (IPs, hostnames, URLs, subnets) and asks to attack, pentest, hack, scan, assess, or test them. ALSO USE THIS SKILL when the user references an existing engagement — resuming, continuing, picking up, checking status, or asking about next steps. Trigger phrases: "attack X", "pentest X", "hack X", "scan X", "start testing X", "pop X", "CTF target X", "engage X", "these targets", "resume engagement", "pick it up", "continue testing", "next steps", "where were we", "resuming", "advise next steps", "what should we do next", "engagement status". This is the entry point for all multi-phase penetration tests — handles recon, attack surface mapping, vulnerability chaining, and routes to technique skills for exploitation. Do NOT use when the user names a specific single technique (e.g., "run kerberoasting against X").
lfi
by blacklanternsecurity
Guide Local File Inclusion (LFI) and Remote File Inclusion (RFI) exploitation during authorized penetration testing.
windows-token-impersonation
by blacklanternsecurity
Exploit Windows token privileges for local privilege escalation to SYSTEM.
ajp-ghostcat
by blacklanternsecurity
Exploit Apache JServ Protocol (AJP) misconfigurations and Ghostcat (CVE-2020-1938) for file read and remote code execution on Apache Tomcat. Use when port 8009 is open or AJP connector is exposed.