GTFOBins for identifying Unix binaries that bypass local security restrictions

GTFOBins is a curated, community-maintained database of Unix-like executables that can bypass local security restrictions on misconfigured systems, used by authorized penetration testers and defenders alike.

Tool	GTFOBins/GTFOBins.github.io — curated list of Unix binaries abusable to bypass local security restrictions
Category	Privilege escalation / post-exploitation reference database
Primary Use	Looking up whether an installed binary can be leveraged for sudo or SUID abuse, shell escapes, file read/write, or capability misuse during authorized assessments
Safe Use	Intended for authorized penetration tests, CTF/lab environments, and defensive hardening — auditors use it to find and remove dangerous binary grants on systems they administer
Telemetry Note	The site is passive documentation; defenders should instead alert on anomalous sudo invocations of interpreters and editors, unusual SUID execution, and shell escapes spawned from interactive binaries

GTFOBins occupies a unique position in the security tooling landscape: it is not a scanner, exploit, or framework, but a curated encyclopedia of legitimate Unix executables that become dangerous when local security controls are misconfigured. Hosted at GTFOBins/GTFOBins.github.io and published as a static site at gtfobins.org, the project has accumulated roughly 13.6k stars on GitHub and is licensed under GPL-3.0. The repository is written almost entirely in YAML, which is a deliberate architectural choice: every binary entry is a structured data file rather than prose, allowing the Hugo-based static site and CI pipelines to render and validate the content automatically. For professionals, this means the database is machine-adjacent — you can consume it as data, not just browse it as a website.

The core premise is simple and worth stating precisely. On a typical Linux or Unix system, administrators grant sudo rights, SUID bits, capabilities, sudoers entries, or filesystem permissions to binaries that look harmless — an editor, an archive utility, a pager, a language interpreter. GTFOBins documents, binary by binary, exactly which of these legitimate executables can be coaxed into reading files, writing files, spawning shells, or executing arbitrary commands under elevated context. The canonical example every operator knows is that vim with sudo is effectively a root shell, but the project extends that insight across hundreds of binaries, from tar and zip to awk, find, less, and far more obscure utilities.

Because each entry is a YAML file in the repository, the internal structure is consistent and queryable. Entries are organized by function — the site lets you filter binaries by what they enable, such as shell execution, file read, file write, SUID abuse, sudo abuse, and file download/upload capabilities. This functional taxonomy is what makes GTFOBins operationally useful in the field. When an assessor lands on a box with limited privileges and enumerates what they can run via sudo -l, they are looking at a list of binaries; the question is never whether the binary is an exploit, but whether it has a documented escape. Cross-referencing that list against GTFOBins is the standard next analytical step, entirely within the methodology of authorized testing.

The project's topic tags on GitHub — binaries, bind-shell, blueteam, bypass, exfiltration, gtfobins, linux, post-exploitation, redteam, reverse-shell, unix — make its dual audience explicit. The same reference serves red teamers mapping escalation paths and blue teams hardening baselines. From a defensive standpoint, GTFOBins is arguably more valuable as a hardening checklist than as an attack aid: it enumerates exactly the set of binaries that should never appear in a sudoers file, never carry the SUID bit, and never be granted elevated capabilities. A hardening pass that greps an estate's sudoers configuration against the GTFOBins corpus will surface the overwhelming majority of common local escalation exposures.

The repository's build pipeline reinforces its credibility as a maintained reference rather than a stale gist. The README shows CI workflows for both validation and GitHub Pages deployment, meaning every contribution is checked before the site is regenerated. Community curation is the project's core quality mechanism — entries are contributed, reviewed, and corrected by practitioners encountering real configurations in the field. For an editorial assessment, this matters: GTFOBins is not a one-off list but a living dataset with structured contribution hygiene, comparable in discipline to LOLBAS, its Windows-oriented counterpart.

Worth emphasizing for defenders is the telemetry angle. GTFOBins itself is a passive documentation site and leaves nothing on a host; the observable artifacts come from the abused binaries. The relevant detections are behavioral: interactive interpreters or editors invoked via sudo, SUID copies of system utilities in unusual paths, shell processes whose parent is a pager or archive tool, and sudoers grants that include shell-capable binaries. Since every technique in the database abuses a legitimate binary, signature-based detection is largely useless — the defensive value is in anomaly context, not indicators. This is precisely why the project's own tag list includes blueteam.

In an authorized workflow, GTFOBins slots in at the privilege escalation phase, after initial access and host enumeration. It is documentation, not automation — the operator still has to enumerate (sudo -l, SUID discovery with something like find, getcap for capabilities) and then consult the reference to interpret findings. That interpretive role is also why it is heavily used in CTF competitions and lab training: it teaches the mental model that on Unix systems, capability boundaries are defined by which binaries you can execute and under what context, and almost any binary that can open files or execute commands is a potential boundary violation.

The project's maintenance posture is healthy by any measure. With continuous integration validating its YAML corpus, an active GitHub sponsorship program, and a polished static site, it has become one of those references that effectively every security professional bookmarks. It also fits naturally into automation: because entries are structured YAML, tooling can ingest the repository directly and correlate it against local enumeration output, turning the encyclopedia into a data source for custom hardening or assessment pipelines.

Circling back to the architectural point: the choice of YAML plus static-site generation is what separates GTFOBins from an unstructured blog post. Each binary entry carries structured metadata about its abuse vectors, which the site renders into consistent per-binary pages with categorized function listings. The default branch is master, the primary language tag is YAML, and the deliverable is the rendered site — a clean separation between data and presentation that has kept the project maintainable as the corpus grew.

The bottom line for professionals: GTFOBins is one of the highest-signal, lowest-noise references in the offensive and defensive Unix tooling ecosystem. It weaponizes nothing itself — it documents properties of binaries that already exist on every system. Used within authorized assessments, it is the definitive interpreter of misconfigured local privileges; used by defenders, it is the definitive list of what should never be granted those privileges in the first place. That symmetry between red and blue value, backed by a structured, CI-validated YAML corpus, is why the project has earned its place as standard equipment in the industry's collective bookmark bar.

Official project repository for GTFOBins/GTFOBins.github.io.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.