# GTFOBins

[GTFOBins](https://gtfobins.org/) is a community-maintained reference cataloguing legitimate Unix binaries that can be coerced into doing security-relevant things they weren't designed for: spawning shells, escalating privileges, transferring files, reading restricted files, writing arbitrary content, escaping restricted shells, binding ports, and post-exploitation tasks. Joint effort by Emilio Pinna ([@norbemi](https://x.com/norbemi)) and Andrea Cardaci ([@cyrus_and](https://x.com/cyrus_and)) with hundreds of contributors via [GitHub PRs](https://github.com/GTFOBins/GTFOBins.github.io).

Around 400+ binaries are catalogued — anything from common tools (`awk`, `find`, `vim`, `nmap`, `python`, `bash`) to packaged utilities (`docker`, `kubectl`, `ansible-playbook`, `terraform`, `aws`, `gcloud`), language interpreters (`perl`, `ruby`, `lua`, `node`), build tools (`make`, `cmake`, `gcc`, `cargo`), and increasingly modern entries (`opencode`, `codex`, `claude`-adjacent tooling). Each binary's page lists the specific abuse functions it supports and the syntax to invoke them.

## How GTFOBins is used

The standard workflow:

1. Attacker has a shell on a target with limited capabilities — restricted shell, sudo for one specific binary, SUID bit on something unexpected, or a Docker container with a permissive entrypoint.
2. Look up the available binaries on GTFOBins.
3. Find the function that matches the constraint (e.g. "we have sudo on `find`, what can we do?" → `sudo find . -exec /bin/sh ; -quit`).
4. Use the well-documented technique to escape the restriction.

Sysadmins use the same database in reverse: when granting `sudo` or `SUID` access to any binary, check GTFOBins first to see what implicit capabilities ship along with it. The repository functions as a bidirectional security primitive — attacker reference and defender checklist for the same technique catalog.

## What's not on GTFOBins

The site is explicit that it's **not a list of exploits**. The binaries aren't vulnerable per se — they do exactly what they were designed to do. GTFOBins documents how their *intended* functions can be repurposed when the attacker has constrained access. Filing it under "exploits" would be wrong; this is configuration-level abuse, not memory corruption.

Also out of scope: Windows binaries (see [LOLBAS](https://lolbas-project.github.io/) for the Windows equivalent), application-layer attacks, network protocols, and exploits requiring memory corruption or kernel bugs. The catalog is strictly about command-line invocation patterns of legitimate binaries.

## Project structure and APIs

- **Web UI** — searchable table at gtfobins.org with per-binary detail pages
- **JSON API** — `https://gtfobins.org/api.json` for programmatic consumption (a primary input to red-team tooling like [GTFOBLookup](https://github.com/nccgroup/GTFOBLookup))
- **MITRE ATT&CK Navigator integration** — `https://mitre-attack.github.io/attack-navigator/#layerURL=https://gtfobins.org/mitre.json` maps techniques to ATT&CK tactics
- **GitHub repository** — pull requests welcome; new binaries and new functions for existing binaries land via PR

## Why it lasts

The GTFOBins page list is one of the longest-running, highest-quality crowdsourced security references on the open web. It's small enough that a single maintainer can review every PR, large enough to be authoritative, and structured uniformly enough that automated tooling can ingest it. The MIT-license + JSON API combination makes it composable into red-team tools, CTF training material, sysadmin checklists, and security curricula. The structure explains the staying power — the format imposes enough discipline (one binary, one set of functions, one syntax block per function) that contributions don't drift.

## Coverage in the wiki

- [[living-off-the-land]] — the broader concept this catalog instantiates

## Related

- [[long-lived-keys]] — the key-management half of the same threat space (long-lived credentials, residual auth tokens)
- [[supply-chain-security]] — adjacent: defense surface for the build-and-deploy chain rather than runtime command execution

URL: <https://gtfobins.org/> — also <https://github.com/GTFOBins/GTFOBins.github.io>