HackTools is an all-in-one browser extension that streamlines web application penetration testing by providing quick access to exploitation payloads, reverse shells, and red team tools.
The all-in-one browser extension for offensive security professionals 🛠
Offensive security professionals and penetration testers use HackTools to efficiently conduct web application security assessments without switching between multiple resources. It centralizes commonly used payloads, shell generators, and encoding tools within the browser, enabling faster exploitation and testing workflows.
HackTools is transitioning from a browser extension to a web application due to browser environment limitations; users are encouraged to try the web app at https://hacktools.sh. The tool is designed to aid penetration testers but should be used responsibly and legally. The Command Palette significantly enhances usability by enabling fast keyboard-driven access to all features.
Install the extension from the Firefox Add-ons store: https://addons.mozilla.org/en-US/firefox/addon/hacktools
Or install from the Chrome Web Store: https://chrome.google.com/webstore/detail/hack-tools/cmbndhnoonmghfofefkcccljbkdpamhi?hl=en
For Safari users, refer to the GitHub issues page for the extension link: https://github.com/LasCC/Hack-Tools/issues/88
Alternatively, access the latest alpha web app version at https://hacktools.sh
To build from source, clone the repository and follow build instructions in the README (not provided here)Open HackTools popup or DevTools tab with F12
Access the tool interface within the browser for quick payload and tool usage
CTRL + K (or ⌘ + K on macOS)
Open the Command Palette to quickly search and execute any function within HackTools
Use arrow keys (↑ and ↓) and Enter
Navigate and select commands or payloads within the Command Palette
Generate reverse shell payloads in PHP, Bash, Ruby, Python, Perl, or Netcat
Create dynamic reverse shell commands tailored to the target environment
Use built-in XSS, SQLi, and LFI payloads
Quickly inject common exploitation payloads during penetration tests
Encode or decode Base64 strings
Transform data for obfuscation or decoding during testing
Generate hashes (MD5, SHA1, SHA256, SHA512, SM3)
Create cryptographic hashes for testing or verification purposes