// ~/tools
Toolkit
Small utilities you reach for constantly during labs, CTFs, and assessments. Everything runs client-side, so it is safe to paste data from an engagement.
beginnerStart here
Everyday converters and references you will use in every lab.
- $ ./encodeEncoder / DecoderChain Base64, URL, hex, HTML entity, and ROT13 transforms into a recipe and watch the output update live.opens in new tab ↗
- $ ./hashidHash IdentifierPaste a hash to get its likely type and the matching Hashcat and John the Ripper modes.opens in new tab ↗
- $ ./ipcalcSubnet CalculatorTurn CIDR notation into network, broadcast, usable host range, mask, and host count.opens in new tab ↗
- $ ./dig --explainDNS LookupLook up any domain or URL and get its records plus a plain-English read on mail security, DNSSEC, hosting, and third-party services.opens in new tab ↗
- $ ./hashgenHash GeneratorCompute MD5, SHA-1, SHA-256, SHA-384, SHA-512, and HMAC-SHA256 of any text as you type.opens in new tab ↗
- $ ./epochTimestamp ConverterConvert Unix seconds, milliseconds, ISO dates, and Windows FILETIME or AD timestamps in both directions.opens in new tab ↗
- $ ./baseNumber Base ConverterDecimal, hex, binary, and octal side by side, plus two's complement, byte swapping, and ASCII.opens in new tab ↗
- $ ./chmod --explainChmod CalculatorFlip permission bits or type an octal mode to see the symbolic form, including setuid, setgid, and sticky.opens in new tab ↗
- $ ./passgenPassword Generator & StrengthGenerate unbiased random passwords and estimate how long any password survives real cracking rigs.opens in new tab ↗
- $ ./ports --lookupPort ReferenceSearchable list of common ports with what each service is and what to check first when you find it open.opens in new tab ↗
- $ ./urlparseURL InspectorBreak a URL into parts the way a browser does and flag disguised hosts, embedded credentials, and redirect parameters.opens in new tab ↗
intermediateLevel up
Analyzers for web defenses, tokens, mail, and classic ciphers.
- $ ./jwt --inspectJWT DecoderDecode a JSON Web Token's header and claims, see expiry in plain English, and flag risky settings.opens in new tab ↗
- $ ./headers --gradeSecurity Header GraderPaste HTTP response headers and get a grade, with specific fixes for every missing or weak header.opens in new tab ↗
- $ ./csp --auditCSP AnalyzerPaste a Content-Security-Policy and find unsafe sources, bypassable allowlists, and missing directives.opens in new tab ↗
- $ ./mailtraceEmail Header AnalyzerTrace a message's route, read SPF, DKIM, and DMARC verdicts, and spot the signs of spoofing and phishing.opens in new tab ↗
- $ ./xor --bruteCipher WorkbenchBrute-force Caesar and single-byte XOR with English scoring, and run repeating-key XOR and Vigenère.opens in new tab ↗
advancedFor seasoned operators
Scoring and low-level decoding for reporting and deep inspection.
- $ ./cvss --scoreCVSS 3.1 CalculatorScore a finding from its base metrics or paste a vector string. Uses the official CVSS 3.1 equations.opens in new tab ↗
- $ ./x509 --decodeCertificate DecoderDecode a PEM certificate's subject, SANs, validity, key, and extensions by parsing the raw ASN.1 in your browser.opens in new tab ↗