Shellshelf

Default scripts, version detection, and output in three formats (nmap/xml/gnmap).

Replace <host> with a host you are authorized to test. Run as root for SYN scan (-sS).

All 65535 TCP ports at a higher packet rate, then follow up with -sC -sV on open ports.

UDP scan of the 100 most common ports. Slow; needs root.

Collect public emails, names, and subdomains from multiple sources.

Users, shares, policies, and OS info against an SMB target you own or have permission to test.

Identify CMS, frameworks, and headers at aggression level 3.

Discover hidden paths using a wordlist. Only against hosts you are allowed to test.

Fast web fuzzer. Filter on interesting status codes.

Checks a web server for known misconfigurations and outdated software.

Brief view of addresses and interface state (replaces ifconfig).

TCP/UDP listeners with process names. Needs root to see all PIDs.

Write packets on a port to a pcap for later inspection.

Fetch response headers only — useful for server and redirect checks.

Resolve an A record without the verbose dig banner.

Extract HTTP requests from a packet capture without opening Wireshark.

Listen on TCP 4444 for a reverse connection during a lab you control.

IP, DNS, and gateway per interface — PowerShell replacement for ipconfig /all.

Local listeners with owning PID. Pair with Get-Process -Id.

TCP reachability plus optional traceroute. Replaces telnet host 443.

Query A records with TTL and the server that answered.

Show wlan0/rmnet addresses. pkg install net-tools if the command is missing.

Ping sweep a typical home subnet from the phone. Adjust the prefix to your LAN.

Only scan networks you own. Cellular/rmnet ranges are usually not useful here.

Save a remote file into the Android Downloads folder via the storage bind.

Put a wireless NIC into monitor mode (creates wlan0mon on most cards).

Stop NetworkManager first if the interface keeps dropping: sudo airmon-ng check kill

Survey nearby networks and write frames. Only on networks you own or have written permission to test.

List saved wireless profiles on this machine.

Enable and start OpenSSH so you can log in remotely.

Connect with a specific key and ignore other identities in the agent.

Copy a tree over SSH, preserving permissions, with a progress meter.

Windows 11 ships OpenSSH. Use this from PowerShell or Windows Terminal.

Install, start, and persist the OpenSSH server optional feature.

Allow port 22 in the firewall afterward if you want LAN access.

Interactive session on another Windows host. WinRM must be enabled on the target.

Install OpenSSH, set the Termux user password, start the daemon on port 8022.

Connect with: ssh -p 8022 <android-user>@<phone-ip>. Find the IP via ifconfig or termux-wifi-connectioninfo.

Drop a laptop public key into authorized_keys so you can skip the password.

Outbound SSH from the phone. Add -i ~/.ssh/id_ed25519 for a key.

Permit SSH before flipping the firewall on so you do not lock yourself out.

Inbound rules that are currently on.

Open a TCP port in Windows Defender Firewall. Run elevated.

Human-readable listing, hidden files included, directories first.

Owner rwx, group rx, others none — typical for scripts and private dirs.

Compress a directory tree into a .tar.gz archive.

Extract a gzip tarball into a destination directory.

Show hidden and system items in a readable table.

Recursive copy, overwriting existing files.

Display the access control list for a file or folder.

Archive Termux home (minus the Android storage bind) onto shared storage.

Git works the same as on Linux once the package is installed.

Recursive case-insensitive name search; stderr suppressed for permission noise.

Recursive content search with line numbers, skipping binary matches.

Recursive name search from a root, swallowing access-denied errors.

grep equivalent for a glob of files.

Name search under Termux home, including the ~/storage tree once set up.

Refresh indexes and apply Kali upgrades. Review the changelog on a production box.

Find a tool in the Kali repositories by name or description.

Find a package in Windows Package Manager.

Exact-id install, skip the two agreement prompts.

Update every winget-managed package that has a newer version.

Refresh Termux indexes and upgrade installed packages.

Find a package in the Termux repos. Prefer pkg over apt so mirrors stay consistent.

A practical first install set for a new Termux session.

Interactive mirror picker — use this when pkg hangs or is geographically slow.

Isolated Python environment in Termux home — avoids breaking pkg-managed modules.

Process tree sorted by memory use.

Quick look at who is burning CPU and RAM.

Kill every process with that name. Confirm the name first with Get-Process.

Named tmux session so sshd jobs survive a client disconnect. Reattach: tmux attach -t main

Processes in this Termux session. Android hides most of the system table from apps.

Show whether a systemd unit is running and its last log lines.

Currently running Windows services.

Restart a named service. Needs an elevated prompt for most services.

Ready (enabled) scheduled tasks on this host.

UID/GIDs plus a non-interactive check for passwordless sudo.

User, SID, groups, and privileges for the current token.

Local SAM accounts and whether they can log on.

Drive letters, filesystem, health, and space in GB.

Home filesystem free space and top-level directory sizes.

Priority logs from the current boot with extra explanation.

Kernel, hostname, and distro version — first thing on a new box.

Hostname, edition, build, and RAM in one object.

Most recent OS patches by install date.

Last 20 Error-level events from the System log.

Installed Linux distros and which one is default.

Whether Microsoft Defender real-time protection is on, and last quick scan age.

App version, Android version, device, and repo — paste this when asking for help.

A real Debian userland without rooting the phone. apt inside the distro is independent of pkg.

Apply ~/.termux/termux.properties without killing the session (colors, extra keys, bell).

Add ESC/CTRL/TAB and arrows on the extra-keys bar — the usual phone-keyboard setup.

Prompt for storage permission and create ~/storage links into shared Android folders.

Required before you can read DCIM, Downloads, or the shared Documents tree.

JSON dump of charge percent, temperature, and plugged state. Needs Termux:API.

Install: pkg install termux-api, plus the Termux:API Android app from F-Droid.

SSID, BSSID, IP, and link speed for the active connection. Needs Termux:API.

Print the Android clipboard. Pair with termux-clipboard-set for the reverse.

Hand a file to the Android intent system (viewer / share sheet).

Prevent Android from sleeping Termux — useful for sshd or long jobs. Release with termux-wake-unlock.

Android notification from a script. Needs Termux:API.

Show the policy at every scope (Machine, User, Process).

Let the current user run local scripts; still block unsigned downloads.

Create the PowerShell profile if missing, then open it.

Open the current Microsoft docs page for a cmdlet.

Extract embedded filesystems and compressed blobs from a binary.

Printable strings of length 8+ with file offsets, hex column.

Dump all metadata groups from an image or document, including unknown tags.

SHA-256 and MD5 fingerprints for evidence or download verification.

Mode 0 (MD5) dictionary attack. Only against hashes you are authorized to recover.