Execute ANY command on the Kali server without restrictions. Full root access, no timeout limits (default 1 hour).

Args: command: The command to execute (can be any shell command, pipes, chains, etc.) timeout: Timeout in seconds (default: 3600 = 1 hour) cwd: Optional working directory for the command background: If True, run fire-and-forget — returns immediately with a task_id

Returns: Command output with stdout, stderr, return_code, execution_time. When background=True, returns immediately with a task_id instead.

Execute a command with real-time streaming output via SSE (text/event-stream). Posts to api/command with streaming=True. Useful for long-running commands like nmap, nuclei, fuzzing.

Args: command: The command to execute timeout: Timeout in seconds (default: 3600 = 1 hour)

Returns: Streaming output collected in real-time with all events

Check the health status of the Kali API server.

Returns: Server health information

Get comprehensive network information for the Kali Linux system.

Returns: Network information including interfaces, IP addresses, routing table, etc.

Send text input to any active interactive session (msfconsole, SSH, mysql, python REPL, shell, etc.). This is a generic primitive that works with ANY session type managed by the backend — it is not limited to Metasploit.

Use this together with read_output() to have a full interactive conversation with a long-running process:

1. Start a session (e.g. via msf_session_create or zebbern_exec with background=True)

2. send_input(session_id, "some command\n")

3. read_output(session_id) to collect the response

Args: session_id: The session identifier returned when the session was created. input_text: The text to send to the session's stdin. Include a trailing newline (\n) if the target process expects one. session_type: Hint for the backend on how to handle the session. 'auto' (default) lets the backend detect the type. Other values: 'msfconsole', 'ssh', 'shell', 'mysql', 'python'.

Returns: dict with at minimum: - success (bool): whether the input was accepted - session_id (str): echo of the session targeted - error (str, optional): present only on failure

Read / poll output from any active interactive session by its ID. Works with msfconsole, SSH, mysql, python REPL, shell, or any other session type managed by the backend.

Typical workflow:

1. send_input(session_id, "whoami\n")

2. read_output(session_id, timeout=5) -> returns the command's output

The backend will wait up to timeout seconds for new output before returning whatever is available (which may be empty if the process has not produced anything yet).

Args: session_id: The session identifier to read from. timeout: Maximum seconds the backend should wait for new output before returning (default: 5). Use a higher value for slow commands (e.g. nmap, compilation). lines: Maximum number of output lines to return (default: 100). Older lines are trimmed first when the buffer exceeds this.

Returns: dict with at minimum: - success (bool): whether the read succeeded - output (str): the collected output text - session_id (str): echo of the session targeted - lines_returned (int): number of lines in output - error (str, optional): present only on failure

Start a reverse shell listener on the specified port.

Args: port: Port to listen on (default: 4444) session_id: Optional session identifier (auto-generated as shell_{port} if empty) listener_type: Type of listener - 'netcat' or 'pwncat' (default: netcat) auto_upgrade: Automatically attempt TTY upgrade on connection (default: False)

Returns: Session ID and listener status

Execute a command in an active reverse shell session.

Args: session_id: The session ID (e.g., 'shell_4444') command: Command to execute on the target timeout: Command timeout in seconds

Returns: Command output from the target system

Send a payload command to trigger a reverse shell connection in a non-blocking way.

Executes the payload in a background thread to avoid blocking the server. Waits then returns session status to verify the connection was established.

Args: session_id: The session ID of the reverse shell listener payload_command: The payload command to execute (e.g., curl with reverse shell) timeout: Timeout for the payload execution in seconds (default: 10) wait_seconds: Seconds to wait before checking session status (default: 5)

Returns: Payload execution status and session info

Get the status of reverse shell sessions.

Args: session_id: Optional specific session ID to check (if empty, shows all sessions)

Returns: Status information for reverse shell sessions

Stop a reverse shell session.

Args: session_id: The session ID to stop

Returns: Stop operation result

Upload content directly to the target via reverse shell.

Args: session_id: The reverse shell session ID content: Base64 encoded content to upload remote_file: Path where to save the file on the target method: Upload method (base64) encoding: Content encoding (utf-8, binary)

Download file content from target via reverse shell and return as base64.

Args: session_id: The reverse shell session ID remote_file: Path to the file on the target method: Download method (base64, cat)

Generate reverse shell payloads for manual execution on targets.

Args: local_ip: Your local IP address that the target should connect back to local_port: Local port to connect back to (default: 4444) payload_type: Type of payload (bash, python, nc, php, powershell, perl) encoding: Encoding format (plain, base64, url, hex)

Returns: Generated payload in various formats ready for manual execution

List available payload templates and encoders for msfvenom.

Returns: List of template names and available encoders

Generate a payload using msfvenom.

Args: lhost: Your IP address for callback lport: Port for callback (default: 4444) template: Use a predefined template (e.g., 'windows_meterpreter_reverse_tcp') payload: Metasploit payload string (ignored if template specified) format_type: Output format - exe, elf, raw, ps1, etc. encoder: Encoder to use (e.g., 'x86/shikata_ga_nai') iterations: Number of encoding iterations bad_chars: Characters to avoid in payload (e.g., '\x00\x0a\x0d') nops: Number of NOP sled bytes to prepend (default: 0) output_name: Custom output filename (auto-generated if empty)

Returns: Generated payload info including base64 content for small payloads

List all generated payloads.

Start HTTP server to host generated payloads for download.

Args: port: Port for the hosting server (default: 8888)

Returns: Server URL for downloading payloads

Stop the payload hosting server.

Generate reverse shell one-liner commands.

Args: lhost: Your IP address for callback lport: Port for callback (default: 4444) shell_type: Type of shell - bash, python, nc, php, powershell, perl, ruby, or 'all'

Returns: One-liner command(s) ready to copy-paste

Search for exploits using searchsploit.

Args: query: Search term (service name, CVE, software version, etc.) exact: Use exact matching (default: False)

Returns: List of matching exploits with EDB IDs

Analyze nmap scan output and suggest exploits for discovered services.

Args: nmap_output: Raw nmap scan output text

Returns: Exploit suggestions grouped by service/port

Get exploit suggestions for a specific service.

Args: service: Service name (e.g., 'apache', 'openssh', 'vsftpd') version: Version string (optional, e.g., '2.3.4', '8.4p1')

Returns: List of suggested exploits

Get full details and source code for an exploit.

Args: edb_id: Exploit-DB ID number

Returns: Exploit metadata and source code

Copy an exploit to a working directory for modification.

Args: edb_id: Exploit-DB ID number destination: Directory to copy to (default: /tmp)

Returns: Path to copied exploit file

Create a new persistent Metasploit (msfconsole) session.

Returns: Session ID to use with other msf_session_* tools

Execute a command in an existing Metasploit session.

Args: session_id: The session ID from msf_session_create command: The Metasploit command to execute (e.g., "use exploit/...", "set RHOSTS ...", "run") timeout: Command timeout in seconds (default: 300) read_delay: Seconds to wait before reading output for slow-responding commands (default: 2)

Returns: Command output and status

List all active Metasploit sessions.

Destroy a specific Metasploit session.

Args: session_id: The session ID to destroy

Destroy all active Metasploit sessions.

Execute an Nmap scan against a target.

Args: target: Target IP, hostname, or CIDR range scan_type: Nmap scan type flags (default: -sV) ports: Port specification (e.g., '80,443' or '1-1024') additional_args: Extra nmap arguments output_format: Output format — 'normal', 'xml', or 'grepable' (default: normal). When 'xml', adds -oX - for structured XML output.

Execute Nikto web server scanner.

Args: target: Target URL or IP additional_args: Extra nikto arguments tuning: Nikto scan tuning options (e.g., '1' for interesting file, '2' for misconfiguration) output_format: Output format (e.g., 'htm', 'csv', 'xml', 'txt')

Execute ssh-audit to analyze SSH server security configuration.

Args: target: Target hostname or IP port: SSH port (default: 22) timeout: Connection timeout in seconds scan_type: Scan type (ssh1, ssh2) policy_file: Path to policy file on Kali additional_args: Extra arguments

Execute Gobuster to find directories, DNS subdomains, or virtual hosts.

Args: url: Target URL mode: Gobuster mode (dir, dns, vhost, fuzz) wordlist: Wordlist path on Kali additional_args: Extra gobuster arguments threads: Number of concurrent threads (default: 10) extensions: File extensions to search for, comma-separated (e.g., 'php,html,txt') status_codes: Positive status codes to match, comma-separated (e.g., '200,301,302')

Execute WPScan WordPress vulnerability scanner.

Args: url: Target WordPress URL additional_args: Extra wpscan arguments api_token: WPScan API token for vulnerability data lookups enumerate: Enumeration options (e.g., 'vp' for vulnerable plugins, 'u' for users) output_format: Output format — 'cli', 'json', or 'cli-no-colour' (default: cli)

Execute SQLmap SQL injection scanner.

Args: url: Target URL with parameter(s) data: POST data string additional_args: Extra sqlmap arguments technique: SQL injection techniques to test (e.g., 'BEUSTQ') level: Level of tests to perform, 1-5 (default: 1) risk: Risk of tests to perform, 1-3 (default: 1) dbs: Enumerate DBMS databases (default: False) tables: Enumerate DBMS database tables (default: False) dump: Dump DBMS database table entries (default: False)

Execute Hydra password cracking tool.

Args: target: Target IP or hostname service: Service to attack (ssh, ftp, http-get, etc.) username: Single username username_file: Path to username list on Kali password: Single password password_file: Path to password list on Kali additional_args: Extra hydra arguments tasks: Number of parallel connection threads (default: 16) wait: Timeout in seconds for each connection attempt (default: 32) port: Target port override (default: 0 means use service default)

Execute John the Ripper password cracker.

Args: hash_file: Path to hash file on Kali wordlist: Wordlist path format_type: Hash format (e.g., 'NT', 'md5crypt', 'raw-sha256') additional_args: Extra john arguments

Execute Enum4linux Windows/Samba enumeration tool.

Args: target: Target IP additional_args: Enum4linux flags (default: -a for all)

Execute Subfinder for subdomain enumeration.

Args: target: Target domain additional_args: Extra subfinder arguments

Execute httpx for HTTP probing.

Args: target: Target URL, domain, or IP additional_args: Extra httpx arguments

Discover hidden HTTP parameters using Arjun.

Args: url: Target URL method: HTTP method (GET, POST, JSON) headers: Custom headers as key:value pairs, comma-separated wordlist: Custom wordlist path on Kali (default: Arjun built-in) delay: Delay between requests in seconds (default: 0) threads: Number of concurrent threads (default: 2) include: Only test these parameters (comma-separated) exclude: Skip these parameters (comma-separated)

Execute Fierce for DNS reconnaissance.

Args: domain: Target domain additional_args: Extra fierce arguments

Execute byp4xx for 403 bypass testing.

Args: url: Target URL returning 403 method: HTTP method additional_args: Extra arguments

Execute Subzy for subdomain takeover detection.

Args: target: Target domain or file with subdomains additional_args: Extra subzy arguments

Execute Assetfinder for asset discovery.

Args: domain: Target domain additional_args: Extra assetfinder arguments

Execute waybackurls to fetch URLs from Wayback Machine.

Args: domain: Target domain additional_args: Extra arguments

Execute Masscan for fast port scanning across large IP ranges.

Masscan is an internet-scale port scanner capable of scanning the entire internet in under 6 minutes. It produces SYN packets asynchronously, making it significantly faster than traditional scanners for large target ranges.

Args: target: Target IP, CIDR range, or hostname (e.g., '10.0.0.0/24') ports: Port specification (default: '1-65535' for full range). Supports ranges ('1-1024'), lists ('80,443,8080'), or mixed ('22,80,443,8000-9000'). rate: Packets per second (default: 1000). Higher values scan faster but may overwhelm the network or trigger IDS. Common values: 1000 (safe), 10000 (moderate), 100000 (aggressive). additional_args: Extra masscan arguments (e.g., '--banners' to grab service banners)

Example usage: tools_masscan(target='192.168.1.0/24', ports='80,443,8080', rate=5000) tools_masscan(target='10.0.0.1', ports='1-1024') tools_masscan(target='172.16.0.0/16', ports='22,80,443', rate=10000, additional_args='--banners')

Execute Katana for web crawling with JavaScript parsing support.

Katana is a next-generation crawling and spidering framework that supports headless browsing and JavaScript rendering, allowing it to discover endpoints hidden behind client-side routing and dynamically generated content.

Args: url: Target URL to crawl (e.g., 'https://example.com') depth: Maximum crawl depth (default: 3). Higher values discover more pages but take longer. js_crawl: Enable JavaScript crawling/rendering (default: True). When enabled, Katana uses a headless browser to execute JS and discover dynamically loaded endpoints. scope: Regex pattern to restrict crawl scope (e.g., '.*.example.com'). Empty string means no scope restriction. additional_args: Extra katana arguments (e.g., '-H "Authorization: Bearer token"')

Example usage: tools_katana(url='https://example.com') tools_katana(url='https://target.com', depth=5, js_crawl=True) tools_katana(url='https://app.example.com', scope='.*.example.com', additional_args='-H "Cookie: session=abc"')

Execute sslscan to test SSL/TLS ciphers and certificate configuration.

Sslscan probes a target's SSL/TLS service to enumerate supported cipher suites, protocol versions, and certificate details. Useful for identifying weak ciphers, expired certificates, and misconfigured TLS deployments.

Args: target: Target hostname or IP to scan (e.g., 'example.com') port: TLS port to connect to (default: 443) additional_args: Extra sslscan arguments (e.g., '--no-colour' or '--show-certificate')

Example usage: tools_sslscan(target='example.com') tools_sslscan(target='10.0.0.5', port=8443) tools_sslscan(target='mail.example.com', port=993, additional_args='--show-certificate')

Query crt.sh certificate transparency logs for passive subdomain enumeration.

Searches Certificate Transparency (CT) logs via crt.sh to discover subdomains that have had TLS certificates issued for them. This is a passive reconnaissance technique that does not send any traffic to the target domain itself.

Args: domain: Target domain to search (e.g., 'example.com') include_expired: Include expired certificates in results (default: False). When True, results may contain historical subdomains that are no longer active but once held valid certificates.

Example usage: tools_crtsh(domain='example.com') tools_crtsh(domain='target.org', include_expired=True)

Capture a screenshot of a web page using gowitness.

Uses a headless Chrome browser to render and screenshot web pages. Useful for visual reconnaissance, documenting findings, and identifying web technologies from page appearance.

Args: url: Target URL to screenshot (e.g., 'https://example.com') threads: Number of concurrent screenshot threads (default: 4) resolution: Browser viewport resolution as WIDTHxHEIGHT (default: '1280x720') additional_args: Extra gowitness arguments

Example usage: tools_gowitness(url='https://example.com') tools_gowitness(url='https://target.org', threads=8, resolution='1920x1080')

Perform advanced subdomain enumeration using OWASP Amass.

Amass performs network mapping of attack surfaces and external asset discovery using open-source information gathering and active reconnaissance techniques.

Args: domain: Target domain for subdomain enumeration (e.g., 'example.com') mode: Enumeration mode — 'passive' for OSINT-only or 'active' for DNS resolution and zone transfers (default: 'passive') additional_args: Extra amass arguments

Example usage: tools_amass(domain='example.com') tools_amass(domain='target.org', mode='active')

Search the NVD (NIST National Vulnerability Database) for CVEs.

Query by keyword (e.g., 'Apache Log4j'), specific CVE ID (e.g., 'CVE-2021-44228'), or product name. Returns CVSS scores, descriptions, references, and weakness classifications.

Args: keyword: Search keyword — product name, library, or description text (e.g., 'OpenSSH', 'Apache Struts', 'buffer overflow') cve_id: Specific CVE identifier to look up (e.g., 'CVE-2021-44228'). When provided, keyword is ignored. results_per_page: Number of results to return (1-100, default 20)

Example usage: cve_search(keyword='Log4j') cve_search(cve_id='CVE-2021-44228') cve_search(keyword='OpenSSH', results_per_page=50)

Check a specific software package for known vulnerabilities using OSV.dev.

Queries the Open Source Vulnerabilities database to find all known CVEs and security advisories affecting a package. Supports version-specific queries across all major ecosystems.

Args: package: Package name (e.g., 'lodash', 'django', 'openssl') version: Specific version to check (e.g., '4.17.20'). If omitted, returns all known vulnerabilities for any version. ecosystem: Package ecosystem — 'npm', 'PyPI', 'Maven', 'Go', 'crates.io', 'NuGet', 'Packagist', 'RubyGems', 'Debian', 'Alpine', etc. If omitted, OSV auto-detects.

Example usage: cve_package_audit(package='lodash', version='4.17.20', ecosystem='npm') cve_package_audit(package='django', ecosystem='PyPI') cve_package_audit(package='openssl')

Start a persistent SSH session to a target host.

Args: target: Target hostname or IP username: SSH username (default: root) password: SSH password (if using password auth) key_file: Path to SSH private key file (if using key auth) port: SSH port (default: 22) session_id: Optional session identifier (auto-generated if empty)

Returns: Session ID and connection status

Execute a command in an active SSH session.

Args: session_id: The SSH session ID command: Command to execute on the remote host timeout: Command timeout in seconds (default: 60)

Returns: Command output from remote host

Check the status of an SSH session.

Args: session_id: The SSH session ID to check

Stop/disconnect an SSH session.

Args: session_id: The SSH session ID to stop

List all active SSH sessions.

Upload content directly to a remote host via SSH (no local temp files).

Args: session_id: The SSH session ID content: Base64-encoded content to upload remote_path: Destination path on the remote host encoding: Content encoding (utf-8, binary)

Download file content from a remote host via SSH as base64.

Args: session_id: The SSH session ID remote_path: Path to the file on the remote host

Estimate file transfer time over SSH.

Args: file_size_bytes: File size in bytes operation: Transfer operation type (upload, download)

Returns: Estimated transfer time and recommendations

Upload content to the Kali server filesystem.

Args: content: Base64-encoded file content remote_path: Destination path on the Kali server encoding: Content encoding (utf-8, binary) verify_checksum: Compute and send SHA256 checksum for integrity verification

Download file content from the Kali server as base64.

Args: remote_path: Path to file on the Kali server verify_checksum: Verify SHA256 checksum if provided by the server

Returns: File content encoded as base64

Upload content to a target via an active session (SSH or reverse shell).

Args: session_id: Active session ID content: Base64-encoded file content remote_path: Destination path on the target method: Transfer method (ssh, reverse_shell) encoding: Content encoding (utf-8, binary) verify_checksum: Compute and send SHA256 checksum for integrity verification

Download file content from a target via an active session.

Args: session_id: Active session ID remote_path: Path to file on the target method: Transfer method (ssh, reverse_shell) verify_checksum: Verify SHA256 checksum if provided by the server

Returns: File content encoded as base64

Fingerprint a URL to detect technologies, frameworks, and CMS.

Args: url: Target URL to fingerprint

Returns: Detected technologies, headers, and server information

Detect Web Application Firewall (WAF) on a target URL.

Args: url: Target URL to test for WAF

Returns: WAF detection results

Analyze HTTP response headers for security posture.

Args: url: Target URL to check headers

Returns: Header analysis with security ratings

Introspect a GraphQL endpoint to discover schema, types, and queries.

Args: url: GraphQL endpoint URL

Fuzz a GraphQL endpoint for vulnerabilities.

Args: url: GraphQL endpoint URL query: Specific query to fuzz (auto-generated from schema if empty) depth: Fuzzing depth (default: 3)

Analyze a JWT token for weaknesses.

Args: token: The JWT token string to analyze

Returns: Decoded header/payload, algorithm analysis, and potential vulnerabilities

Attempt to crack a JWT token's signing secret.

Args: token: The JWT token to crack wordlist: Path to wordlist on the Kali server

Fuzz an API endpoint with various payloads.

Args: url: Target API endpoint URL method: HTTP method (GET, POST, PUT, DELETE) parameters: Comma-separated parameter names to fuzz wordlist: Custom wordlist path (default: built-in) headers: Custom headers as key:value pairs, comma-separated

Test API rate limiting controls.

Args: url: Target API endpoint requests_count: Number of requests to send (default: 100) method: HTTP method (default: GET)

Test for authentication bypass vulnerabilities.

Args: url: Target API endpoint method: HTTP method headers: Custom headers as key:value pairs

Fuzz using ffuf for content discovery and parameter brute-forcing.

Args: url: Target URL with FUZZ keyword (e.g., http://target/FUZZ) wordlist: Wordlist path on Kali server method: HTTP method mc: Match HTTP status codes (comma-separated) headers: Custom headers (key:value, comma-separated) data_str: POST data with FUZZ keyword

Scan API endpoints using Kiterunner for route discovery.

Args: url: Target base URL wordlist: Custom wordlist or kiterunner routes file

Run Nuclei templates against API endpoints.

Args: url: Target URL tags: Nuclei template tags (default: api) severity: Filter by severity (critical, high, medium, low)

Run a Postman/Newman collection against API endpoints.

Args: collection: Path to Postman collection JSON file environment: Path to Postman environment JSON file

Check which AD tools are available on the Kali server.

Run BloodHound data collection against an Active Directory domain.

Args: domain: Target AD domain (e.g., corp.local) username: Domain username password: Domain password dc_ip: Domain Controller IP (auto-detected if empty) collection_method: Collection method (all, default, DCOnly, etc.) nameserver: Custom DNS nameserver

Dump secrets (NTLM hashes, Kerberos keys) from a domain controller using secretsdump.py.

Args: domain: AD domain username: Domain admin username password: Domain admin password target: Specific target (default: DC) dc_ip: Domain Controller IP hashes: NTLM hash for pass-the-hash (LMHASH:NTHASH)

Perform Kerberoasting attack to extract service ticket hashes.

Args: domain: AD domain username: Domain username password: Domain password dc_ip: Domain Controller IP target_user: Specific user to target (all SPNs if empty)

Perform AS-REP Roasting to get hashes for accounts with pre-auth disabled.

Args: domain: AD domain dc_ip: Domain Controller IP username: Specific username to test userlist: Path to username list file on Kali

Execute commands on a remote Windows host via PsExec (impacket).

Args: target: Target IP or hostname domain: AD domain username: Username password: Password hashes: NTLM hash for pass-the-hash command: Command to execute (default: cmd.exe)

Execute commands on a remote Windows host via WMI (impacket).

Args: target: Target IP or hostname domain: AD domain username: Username password: Password hashes: NTLM hash for pass-the-hash command: Command to execute

Enumerate Active Directory via LDAP.

Args: domain: AD domain username: Domain username password: Domain password dc_ip: Domain Controller IP query: Query type (users, groups, computers, spns, admins, all)

Perform password spraying attack against AD accounts.

Args: domain: AD domain password: Password to spray dc_ip: Domain Controller IP userlist: Path to username list file on Kali delay: Delay between attempts in seconds (default: 0)

Enumerate SMB shares and information on a target.

Args: target: Target IP or hostname username: Username for authenticated enum password: Password domain: AD domain

Start a Chisel server for tunneling.

Args: port: Listening port (default: 8080) reverse: Allow reverse tunnels (default: True)

Start a Chisel client to connect to a Chisel server.

Args: server_url: Chisel server URL (e.g., http://attacker:8080) tunnels: Tunnel specifications (e.g., 'R:8888:10.10.10.5:80') fingerprint: Server fingerprint for verification

Create an SSH local port forward (access remote service locally).

Args: ssh_host: SSH server to tunnel through local_port: Local port to listen on remote_host: Remote host to forward to (from SSH server's perspective) remote_port: Remote port to forward to username: SSH username password: SSH password key_file: SSH key file path

Create an SSH remote port forward (expose local service on remote host).

Args: ssh_host: SSH server to tunnel through remote_port: Port to open on the SSH server local_host: Local host to forward to local_port: Local port to forward to username: SSH username password: SSH password key_file: SSH key file path

Create an SSH dynamic SOCKS proxy.

Args: ssh_host: SSH server to use as SOCKS proxy socks_port: Local SOCKS port (default: 1080) username: SSH username password: SSH password key_file: SSH key file path

Create a socat port forward.

Args: listen_port: Local port to listen on target_host: Target host to forward to target_port: Target port to forward to protocol: Protocol (tcp, udp)

Start a Ligolo-ng proxy server for pivoting.

Args: interface: TUN interface name (default: ligolo) port: Listening port (default: 11601)

List all active tunnels and port forwards.

Stop a specific tunnel.

Args: tunnel_id: The tunnel ID to stop