GTFOBins vs LOLBAS
GitHub Stats
About GTFOBins
GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions on misconfigured systems. It documents how standard system binaries (find, vim, python, bash, etc.) can be abused for privilege escalation, file read/write, shell escape, reverse shell creation, and more. It's the definitive reference for Living Off The Land techniques on Linux/Unix systems. Every pentester and red teamer has this bookmarked.
About LOLBAS
LOLBAS (Living Off The Land Binaries, Scripts and Libraries) is the Windows equivalent of GTFOBins. It documents Windows binaries, scripts, and libraries that can be used for file download, code execution, lateral movement, persistence, credential theft, and more — all using tools already present on the system. This includes certutil, mshta, rundll32, regsvr32, bitsadmin, and dozens more. Understanding LOLBAS is essential for both red teams (evasion) and blue teams (detection).
Platform Support
Tags
Shared
GTFOBins only
LOLBAS only