GTFOBins

GTFOBins is a community-maintained reference cataloguing legitimate Unix binaries that can be coerced into doing security-relevant things they weren't designed for: spawning shells, escalating privileges, transferring files, reading restricted files, writing arbitrary content, escaping restricted shells, binding ports, and post-exploitation tasks. Joint effort by Emilio Pinna (@norbemi) and Andrea Cardaci (@cyrus_and) with hundreds of contributors via GitHub PRs.

Around 400+ binaries are catalogued — anything from common tools (awk, find, vim, nmap, python, bash) to packaged utilities (docker, kubectl, ansible-playbook, terraform, aws, gcloud), language interpreters (perl, ruby, lua, node), build tools (make, cmake, gcc, cargo), and increasingly modern entries (opencode, codex, claude-adjacent tooling). Each binary's page lists the specific abuse functions it supports and the syntax to invoke them.

How GTFOBins is used

The standard workflow:

1. Attacker has a shell on a target with limited capabilities — restricted shell, sudo for one specific binary, SUID bit on something unexpected, or a Docker container with a permissive entrypoint.
2. Look up the available binaries on GTFOBins.
3. Find the function that matches the constraint (e.g. "we have sudo on find, what can we do?" → sudo find . -exec /bin/sh ; -quit).
4. Use the well-documented technique to escape the restriction.

Sysadmins use the same database in reverse: when granting sudo or SUID access to any binary, check GTFOBins first to see what implicit capabilities ship along with it. The repository functions as a bidirectional security primitive — attacker reference and defender checklist for the same technique catalog.

What's not on GTFOBins

The site is explicit that it's not a list of exploits. The binaries aren't vulnerable per se — they do exactly what they were designed to do. GTFOBins documents how their intended functions can be repurposed when the attacker has constrained access. Filing it under "exploits" would be wrong; this is configuration-level abuse, not memory corruption.

Also out of scope: Windows binaries (see LOLBAS for the Windows equivalent), application-layer attacks, network protocols, and exploits requiring memory corruption or kernel bugs. The catalog is strictly about command-line invocation patterns of legitimate binaries.

Project structure and APIs

• Web UI — searchable table at gtfobins.org with per-binary detail pages
• JSON API — https://gtfobins.org/api.json for programmatic consumption (a primary input to red-team tooling like GTFOBLookup)
• MITRE ATT&CK Navigator integration — https://mitre-attack.github.io/attack-navigator/#layerURL=https://gtfobins.org/mitre.json maps techniques to ATT&CK tactics
• GitHub repository — pull requests welcome; new binaries and new functions for existing binaries land via PR

Why it lasts

The GTFOBins page list is one of the longest-running, highest-quality crowdsourced security references on the open web. It's small enough that a single maintainer can review every PR, large enough to be authoritative, and structured uniformly enough that automated tooling can ingest it. The MIT-license + JSON API combination makes it composable into red-team tools, CTF training material, sysadmin checklists, and security curricula. The structure explains the staying power — the format imposes enough discipline (one binary, one set of functions, one syntax block per function) that contributions don't drift.

Coverage in the wiki

• living-off-the-land — the broader concept this catalog instantiates

Related

• long-lived-keys — the key-management half of the same threat space (long-lived credentials, residual auth tokens)
• supply-chain-security — adjacent: defense surface for the build-and-deploy chain rather than runtime command execution

URL: https://gtfobins.org/ — also https://github.com/GTFOBins/GTFOBins.github.io