Command Generator
Fill a catalog template. Placeholders stay visible until you replace them. The generator does not run the command.
Tools with command templates
The generator fills these templates in your browser. It builds the command text and never runs it. Pipelines from Workflows open here too.
- subfinder - 2 templates: Passive enum → file, Silent (pipe-friendly)
- amass - 2 templates: Passive enum, Active + brute
- assetfinder - 1 template: Subdomains only
- dnsx - 2 templates: Resolve live, A + CNAME records
- puredns - 2 templates: Bruteforce, Resolve list
- shuffledns - 1 template: Bruteforce
- httpx - 2 templates: Probe + enrich, Silent URLs only
- naabu - 2 templates: Top ports, Full + nmap
- nmap - 2 templates: Service + default scripts, Fast all-ports
- rustscan - 1 template: Scan → nmap
- ffuf - 2 templates: Directory brute, VHost fuzz
- feroxbuster - 1 template: Recursive scan
- gobuster - 1 template: Directory mode
- katana - 2 templates: Crawl a host, Headless deep crawl
- gau - 1 template: All known URLs
- waybackurls - 1 template: Fetch URLs
- hakrawler - 1 template: Crawl from stdin
- nuclei - 2 templates: Scan live hosts, Specific templates
- jaeles - 1 template: Scan with signatures
- arjun - 1 template: Find params
- paramspider - 1 template: Mine params
- dalfox - 2 templates: Scan URL list, Pipe from gf
- sqlmap - 2 templates: Test a URL, From request file
- gf - 1 template: Filter for pattern
- qsreplace - 1 template: Inject marker
- anew - 1 template: Append unique
- unfurl - 2 templates: Extract domains, Param keys
- gowitness - 1 template: Screenshot list
- getJS - 1 template: Extract JS URLs
- LinkFinder - 1 template: Parse a JS file
- wpscan - 1 template: Enumerate
- s3scanner - 1 template: Scan bucket list
- interactsh - 1 template: Start client
- notify - 1 template: Pipe alerts
- trufflehog - 2 templates: Scan a git repo (verified only), Scan a live host
- gitleaks - 1 template: Scan a repo dir
- jsluice - 2 templates: Extract URLs, Extract secrets
- kiterunner - 1 template: Scan with routes
- x8 - 1 template: Find params
- smuggler - 1 template: Test a host
- h2csmuggler - 1 template: Attempt h2c upgrade
- graphql-cop - 1 template: Audit endpoint
- clairvoyance - 1 template: Rebuild schema
- jwt_tool - 2 templates: Run all attacks, Crack weak secret
- ysoserial - 1 template: Generate gadget
- uncover - 1 template: Find exposed hosts
- asnmap - 1 template: Org → CIDRs
- mapcidr - 1 template: Expand CIDR
- tlsx - 1 template: Pull SAN names
- cero - 1 template: Names from certs
- alterx - 1 template: Permute → resolve
- subzy - 1 template: Check list
- wafw00f - 1 template: Fingerprint WAF
- chisel - 2 templates: Server (your box), Client → reverse SOCKS
- ligolo-ng - 2 templates: Proxy (your box), Agent (foothold)
- linPEAS - 1 template: Run enumeration
- pspy - 1 template: Monitor
- waymore - 2 templates: Collect URLs, URLs + responses
- urlfinder - 1 template: Passive URLs
- gospider - 1 template: Crawl + JS
- chaos - 1 template: Download dataset
- pdtm - 2 templates: Install all, Update all
- masscan - 1 template: Top ports on a range
- dirsearch - 1 template: Recursive dirs
- kxss - 1 template: From URL corpus
- uro - 1 template: Dedupe URLs
- hakrevdns - 1 template: PTR over a range
- git-dumper - 1 template: Dump .git
- noseyparker - 1 template: Scan a dump
- cloud_enum - 1 template: Keyword enum
- testssl.sh - 1 template: Full TLS report
- jq - 1 template: Extract a field from JSONL
- HTTPie - 1 template: JSON GET
- mitmproxy - 1 template: Listen 8080
- hashcat - 1 template: Crack a hash
- commix - 1 template: Probe a URL
- tplmap - 1 template: Probe a parameter
- SecretFinder - 1 template: One JS file
- subjs - 1 template: From live hosts
- sourcemapper - 1 template: Rebuild from map URL
- semgrep - 1 template: JS sinks
- trivy - 2 templates: Scan an image, Scan a repo
- kube-hunter - 1 template: Remote CIDR
- cloudflared - 1 template: Quick tunnel
- socat - 1 template: TCP forward
- shodan - 1 template: Hostname search
- github-subdomains - 1 template: Code search
- dnsgen - 1 template: Permute then resolve
- whatweb - 1 template: Fingerprint
- interactsh-client - 1 template: New session
- ghauri - 1 template: Single parameter, owned row
- crlfuzz - 1 template: Silent scan
- ppmap - 1 template: Probe a URL
- Corsy - 1 template: Scan live hosts
- findomain - 1 template: Passive
- cdncheck - 1 template: Check one host
- proxify - 1 template: Log local proxy traffic
- vulnx - 1 template: Search advisories
- osv-scanner - 1 template: Scan a local tree
- grype - 1 template: Scan a local SBOM
- syft - 1 template: SBOM from a local path
- zizmor - 1 template: Offline workflow audit
- retire.js - 1 template: Scan a local path
- graphw00f - 1 template: Detect and fingerprint
- xnLinkFinder - 1 template: Links from a local file
- ZAP - 1 template: Launch desktop