GTFOBins
GTFOBins
GTFOBins is a curated reference of Unix-like executables and the legitimate functions in them (shell, file read and write, file transfer, sudo and SUID use) that attackers abuse in misconfigured systems. Each entry lists the abusable functions with example commands, and the site offers a JSON API file and a MITRE ATT&CK Navigator layer.
Required Attribution:
Under the GPL v3 text: keep the copyright and licence notices when redistributing the material, and license derived works under the same terms.
Coverage
Unix-like executables, community-maintained on GitHub. The site says: "GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems." It links a JSON API and an ATT&CK Navigator layer; the Windows counterpart is LOLBAS.
Verdict
Defensive reference for hardening sudo rules, SUID bits and restricted shells, and for writing detections for living-off-the-land abuse on Linux and other Unix-like hosts. It is a curated knowledge base, not a live threat feed. Licence: Custom: the GitHub repository is labelled "Readme GPL-3.0 license" and its LICENSE file is the "GNU GENERAL PUBLIC LICENSE" text, with no statement of only or or-later. Rate limits: Not stated. Signal Lab links only.
Get the free weekly email
Free weekly email of newly verified free data. Unsubscribe by emailing us.
By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.
Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer