Generate a prime number with specified bit length

Create backup of original logs before modification Args: log_path (str): Path to log file backup_dir

Execute system command with timeout and error handling Args: command (str or list): Command to execute

Remove specific log entries matching given patterns Args: log_path (str): Path to log file to modify

Analyze HTTP response for SQL injection indicators Args: response: HTTP response object payload (str

Check if a URL exists and is accessible Args: url (str): URL to check Returns:

Create covert logging channel disguised as system file Args: message (str): Message to log covertly

Create Ethernet header

Create IP header

Create a Morse code signal at specified frequency

Create packet header

Generate bash reverse shell How it works: - Uses /dev/tcp for network connection (bash built-in) - Redirects

Add human-like delays with natural variation Args: min_delay (int): Minimum delay in seconds max_del

Check if current time is during typical business hours Returns: bool: True if within business hours

Demonstrate living off the land techniques using built-in tools

Perform network scanning with Nmap Args: scan_type (str): Type of scan (quick, full, stealth)

Print shell information in formatted way

Print usage information

Execute complete security assessment

Simulate document editing work

Simulate email checking behavior

Simulate human typing with realistic delays and errors Args: text (str): Text to "type" base_wpm (in

Perform SYN scan on a single port How SYN scanning works: 1. Send SYN packet (connection request) 2. Wait fo

Connect to a web server and send an HTTP request Args: host (str): Target hostname or IP address port (int): Target port

Modify file timestamps to blend in with system files Args: file_path (str): File to modify timestamps

Analyze ARP packets for potential spoofing Args: packet: ARP packet timestamp: Packet timestamp

Analyze ICMP packets Args: packet: ICMP packet timestamp: Packet timestamp

Analyze HTTP response headers for security issues Args: url (str): URL to analyze

Analyze collected results and generate insights

Analyze TCP packets for connections and suspicious activity Args: packet: TCP packet timestamp: Pack

Analyze UDP packets Args: packet: UDP packet timestamp: Packet timestamp

Simple banner grabbing - useful for service identification Args: host (str): Target hostname or IP port (int): Target po

Attempt to grab service banner for identification Args: port (int): Port to grab banner from

0 → new info request → talk to Groq 1 → clarification ask → talk to Gemini critic

General suspicious activity checks Args: packet: Network packet timestamp: Packet timestamp

Clean command history files

Create audio file with both audible and hidden Morse code messages

Create DNS packet with suspicious query

Create complete HTTP packet

Create PCAP file header

Create a file that's both a valid JPEG and ZIP

Create TCP header

Create a valid JPEG image

Create a ZIP archive containing the flag

Demonstrate various log evasion techniques

Enumerate common directories and files

Create encrypted log entries Args: message (str): Message to encrypt and log key_path (str): Path to

Comprehensive behavioral evasion demonstration

Extract all forms from a webpage for testing Args: url (str): URL to extract forms from Ret

Extract forms from a webpage Args: url (str): URL to analyze Returns: list: Lis

Generate all available shell types

Generate DNS queries with one hidden flag

Generate realistic HTTP traffic

Generate listener commands for the attacker machine

Generate netcat reverse shell How it works: - Uses netcat (nc) to create network connection - -e flag execut

Generate Perl reverse shell How it works: - Uses Perl socket functions - Forks process and redirects I/O

Generate PHP reverse shell How it works: - Uses PHP socket functions - Creates file stream from socket

Generate PowerShell reverse shell (Windows) How it works: - Uses .NET socket classes - Creates network strea

Generate Python reverse shell How it works: - Creates socket connection to attacker - Duplicates file descri

Generate and display test report Args: vulnerabilities (list): List of found vulnerabilities

Generate security assessment report Args: format (str): Report format (json, html, txt) filename (st

Generate Ruby reverse shell

Generate plain text report Args: filename (str): Output filename

Generate web-friendly payloads (URL encoded, etc.)

Return help information

Get local IP address for display purposes

Miller-Rabin primality test

List available network interfaces

Main function

Main function

Main function

Main function

Main function

Main function

Main function

Main function

Main function

Main function

Simulate realistic user activity patterns during work day Args: duration_hours (int): How long to simulate activ

Calculate modular inverse using extended Euclidean algorithm

Parse dirb output to extract found directories Args: output (str): Raw dirb output Returns:

Parse Nikto output to extract vulnerabilities Args: output (str): Raw Nikto output Returns:

Parse Nmap XML output into structured data Args: xml_output (str): Raw XML from Nmap Return

Parse port specification string Supports: - Single ports: "80" - Ranges: "1-1000" - Lists: "22,80,443" - Mixed: "22,80-9

Print final analysis report

Print current capture statistics

Print scan summary

Execute command with legitimate-looking process name Args: command (str): Command to execute disguis