# Forensics, SSL & Wireless Tools

## sslscan
```
[1;34m                   _
           ___ ___| |___  ___ __ _ _ __
          / __/ __| / __|/ __/ _` | '_ \
          \__ \__ \ \__ \ (_| (_| | | | |
          |___/___/_|___/\___\__,_|_| |_|

[0m
[1;34m		2.1.5
		OpenSSL 3.5.5 27 Jan 2026
[0m

[1;34mCommand:[0m
  [32msslscan [options] [host:port | host][0m

[1;34mOptions:[0m
  [32m--targets=<file>[0m     A file containing a list of hosts to check.
                       Hosts can  be supplied  with ports (host:port)
  [32m--sni-name=<name>[0m    Hostname for SNI
  [32m--ipv4, -4[0m           Only use IPv4
  [32m--ipv6, -6[0m           Only use IPv6

  [32m--show-certificate[0m   Show full certificate information
  [32m--show-certificates[0m  Show chain full certificates information
  [32m--show-client-cas[0m    Show trusted CAs for TLS client auth
  [32m--no-check-certificate[0m  Don't warn about weak certificate algorithm or keys
  [32m--ocsp[0m               Request OCSP response from server
  [32m--pk=<file>[0m          A file containing the private key or a PKCS#12 file
                       containing a private key/certificate pair
  [32m--pkpass=<password>[0m  The password for the private  key or PKCS#12 file
  [32m--certs=<file>[0m       A file containing PEM/ASN1 formatted client certificates

  [32m--ssl2[0m               Only check if SSLv2 is enabled
  [32m--ssl3[0m               Only check if SSLv3 is enabled
  [32m--tls10[0m              Only check TLSv1.0 ciphers
  [32m--tls11[0m              Only check TLSv1.1 ciphers
  [32m--tls12[0m              Only check TLSv1.2 ciphers
  [32m--tls13[0m              Only check TLSv1.3 ciphers
  [32m--tlsall[0m             Only check TLS ciphers (all versions)
  [32m--show-ciphers[0m       Show supported client ciphers
  [32m--show-cipher-ids[0m    Show cipher ids
  [32m--iana-names[0m         Use IANA/RFC cipher names rather than OpenSSL ones
  [32m--show-times[0m         Show handhake times in milliseconds

  [32m--no-cipher-details[0m  Disable EC curve names and EDH/RSA key lengths output
  [32m--no-ciphersuites[0m    Do not check for supported ciphersuites
  [32m--no-compression[0m     Do not check for TLS compression (CRIME)
  [32m--no-fallback[0m        Do not check for TLS Fallback SCSV
  [32m--no-groups[0m          Do not enumerate key exchange groups
  [32m--no-heartbleed[0m      Do not check for OpenSSL Heartbleed (CVE-2014-0160)
  [32m--no-renegotiation[0m   Do not check for TLS renegotiation
  [32m--show-sigs[0m          Enumerate signature algorithms

  [32m--starttls-ftp[0m       STARTTLS setup for FTP
  [32m--starttls-imap[0m      STARTTLS setup for IMAP
  [32m--starttls-irc[0m       STARTTLS setup for IRC
  [32m--starttls-ldap[0m      STARTTLS setup for LDAP
  [32m--starttls-mysql[0m     STARTTLS setup for MYSQL
  [32m--starttls-pop3[0m      STARTTLS setup for POP3
  [32m--starttls-psql[0m      STARTTLS setup for PostgreSQL
  [32m--starttls-smtp[0m      STARTTLS setup for SMTP
```

## sslyze
```
usage: sslyze [-h] [--update_trust_stores] [--cert CERTIFICATE_FILE]
              [--key KEY_FILE] [--keyform KEY_FORMAT] [--pass PASSPHRASE]
              [--json_out JSON_FILE] [--targets_in TARGET_FILE] [--quiet]
              [--slow_connection] [--https_tunnel PROXY_SETTINGS]
              [--starttls PROTOCOL] [--xmpp_to HOSTNAME]
              [--sni SERVER_NAME_INDICATION] [--compression] [--reneg]
              [--http_headers] [--sslv2] [--ems] [--certinfo]
              [--certinfo_ca_file CERTINFO_CA_FILE] [--tlsv1_2] [--tlsv1_1]
              [--heartbleed] [--sslv3] [--robot] [--tlsv1_3]
              [--elliptic_curves] [--early_data] [--fallback] [--openssl_ccs]
              [--tlsv1] [--resum] [--resum_attempts RESUM_ATTEMPTS]
              [--custom_tls_config CUSTOM_TLS_CONFIG]
              [--mozilla_config {modern,intermediate,old,disable}]
              [target ...]

SSLyze version 6.3.0

positional arguments:
  target                The list of servers to scan.

options:
  -h, --help            show this help message and exit
  --custom_tls_config CUSTOM_TLS_CONFIG
                        Path to a JSON file containing a specific TLS
                        configuration to check the server against, following
                        Mozilla's format. Cannot be used with
                        --mozilla_config.
  --mozilla_config {modern,intermediate,old,disable}
                        Shortcut to queue various scan commands needed to
                        check the server's TLS configurations against one of
                        Mozilla's recommended TLS configurations. Set to
                        "intermediate" by default. Use "disable" to disable
                        this check.

Trust stores options:
  --update_trust_stores
                        Update the default trust stores used by SSLyze. The
                        latest stores will be downloaded from https://github.c
                        om/nabla-c0d3/trust_stores_observatory. This option is
                        meant to be used separately, and will silence any
                        other command line option supplied to SSLyze.

Client certificate options:
  --cert CERTIFICATE_FILE
                        Client certificate chain filename. The certificates
                        must be in PEM format and must be sorted starting with
                        the subject's client certificate, followed by
                        intermediate CA certificates if applicable.
  --key KEY_FILE        Client private key filename.
  --keyform KEY_FORMAT  Client private key format. DER or PEM (default).
  --pass PASSPHRASE     Client private key passphrase.

Input and output options:
  --json_out JSON_FILE  Write the scan results as a JSON document to the file
                        JSON_FILE. If JSON_FILE is set to '-', the JSON output
                        will instead be printed to stdout. The resulting JSON
                        file is a serialized version of the ScanResult objects
                        described in SSLyze's Python API: the nodes and
                        attributes will be the same. See https://nabla-
                        c0d3.github.io/sslyze/documentation/available-scan-
```

## aircrack-ng
```

  Aircrack-ng 1.7  - (C) 2006-2022 Thomas d'Otreppe
  https://www.aircrack-ng.org

  usage: aircrack-ng [options] <input file(s)>

  Common options:

      -a <amode> : force attack mode (1/WEP, 2/WPA-PSK)
      -e <essid> : target selection: network identifier
      -b <bssid> : target selection: access point's MAC
      -p <nbcpu> : # of CPU to use  (default: all CPUs)
      -q         : enable quiet mode (no status output)
      -C <macs>  : merge the given APs to a virtual one
      -l <file>  : write key to file. Overwrites file.

  Static WEP cracking options:

      -c         : search alphanumeric characters only
      -t         : search binary coded decimal chr only
      -h         : search the numeric key for Fritz!BOX
      -d <mask>  : use masking of the key (A1:XX:CF:YY)
      -m <maddr> : MAC address to filter usable packets
      -n <nbits> : WEP key length :  64/128/152/256/512
      -i <index> : WEP key index (1 to 4), default: any
      -f <fudge> : bruteforce fudge factor,  default: 2
      -k <korek> : disable one attack method  (1 to 17)
      -x or -x0  : disable bruteforce for last keybytes
      -x1        : last keybyte bruteforcing  (default)
      -x2        : enable last  2 keybytes bruteforcing
      -X         : disable  bruteforce   multithreading
      -y         : experimental  single bruteforce mode
      -K         : use only old KoreK attacks (pre-PTW)
      -s         : show the key in ASCII while cracking
      -M <num>   : specify maximum number of IVs to use
      -D         : WEP decloak, skips broken keystreams
      -P <num>   : PTW debug:  1: disable Klein, 2: PTW
      -1         : run only 1 try to crack key with PTW
      -V         : run in visual inspection mode

  WEP and WPA-PSK cracking options:

      -w <words> : path to wordlist(s) filename(s)
      -N <file>  : path to new session filename
      -R <file>  : path to existing session filename

  WPA-PSK options:

      -E <file>  : create EWSA Project file v3
      -I <str>   : PMKID string (hashcat -m 16800)
      -j <file>  : create Hashcat v3.6+ file (HCCAPX)
      -J <file>  : create Hashcat file (HCCAP)
      -S         : WPA cracking speed test
      -Z <sec>   : WPA cracking speed test length of
                   execution.
      -r <DB>    : path to airolib-ng database
                   (Cannot be used with -w)

  SIMD selection:

      --simd-list       : Show a list of the available
                          SIMD architectures, for this
                          machine.
      --simd=<option>   : Use specific SIMD architecture.

      <option> may be one of the following, depending on
      your platform:

                   generic
                   avx512
                   avx2
                   avx
                   sse2
                   altivec
                   power8
                   asimd
                   neon

  Other options:

      -u         : Displays # of CPUs & SIMD support
      --help     : Displays this usage screen

```

## binwalk
```

Binwalk v2.4.3
Original author: Craig Heffner, ReFirmLabs
https://github.com/OSPG/binwalk

Usage: binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] ...

Disassembly Scan Options:
    -Y, --disasm                 Identify the CPU architecture of a file using the capstone disassembler
    -T, --minsn=<int>            Minimum number of consecutive instructions to be considered valid (default: 500)
    -k, --continue               Don't stop at the first match

Signature Scan Options:
    -B, --signature              Scan target file(s) for common file signatures
    -R, --raw=<str>              Scan target file(s) for the specified sequence of bytes
    -A, --opcodes                Scan target file(s) for common executable opcode signatures
    -m, --magic=<file>           Specify a custom magic file to use
    -b, --dumb                   Disable smart signature keywords
    -I, --invalid                Show results marked as invalid
    -x, --exclude=<str>          Exclude results that match <str>
    -y, --include=<str>          Only show results that match <str>

Extraction Options:
    -e, --extract                Automatically extract known file types
    -D, --dd=<type[:ext[:cmd]]>  Extract <type> signatures (regular expression), give the files an extension of <ext>, and execute <cmd>
    -M, --matryoshka             Recursively scan extracted files
    -d, --depth=<int>            Limit matryoshka recursion depth (default: 8 levels deep)
    -C, --directory=<str>        Extract files/folders to a custom directory (default: current working directory)
    -j, --size=<int>             Limit the size of each extracted file
    -n, --count=<int>            Limit the number of extracted files
    -0, --run-as=<str>           Execute external extraction utilities with the specified user's privileges
    -1, --preserve-symlinks      Do not sanitize extracted symlinks that point outside the extraction directory (dangerous)
    -r, --rm                     Delete carved files after extraction
    -z, --carve                  Carve data from files, but don't execute extraction utilities
    -V, --subdirs                Extract into sub-directories named by the offset

Entropy Options:
    -E, --entropy                Calculate file entropy
    -F, --fast                   Use faster, but less detailed, entropy analysis
    -J, --save                   Save plot as a PNG
    -Q, --nlegend                Omit the legend from the entropy plot graph
    -N, --nplot                  Do not generate an entropy plot graph
    -H, --high=<float>           Set the rising edge entropy trigger threshold (default: 0.95)
    -L, --low=<float>            Set the falling edge entropy trigger threshold (default: 0.85)

Binary Diffing Options:
    -W, --hexdump                Perform a hexdump / diff of a file or files
    -G, --green                  Only show lines containing bytes that are the same among all files
    -i, --red                    Only show lines containing bytes that are different among all files
    -U, --blue                   Only show lines containing bytes that are different among some files
    -u, --similar                Only display lines that are the same between all files
    -w, --terse                  Diff all files, but only display a hex dump of the first file

Raw Compression Options:
    -X, --deflate                Scan for raw deflate compression streams
    -Z, --lzma                   Scan for raw LZMA compression streams
    -P, --partial                Perform a superficial, but faster, scan
    -S, --stop                   Stop after the first result

General Options:
    -l, --length=<int>           Number of bytes to scan
    -o, --offset=<int>           Start scan at this file offset
    -O, --base=<int>             Add a base address to all printed offsets
    -K, --block=<int>            Set file block size
    -g, --swap=<int>             Reverse every n bytes before scanning
    -f, --log=<file>             Log results to file
    -c, --csv                    Log results to file in CSV format
    -t, --term                   Format output to fit the terminal window
    -q, --quiet                  Suppress output to stdout
    -v, --verbose                Enable verbose output
    -h, --help                   Show help output
    -a, --finclude=<str>         Only scan files whose names match this regex
    -p, --fexclude=<str>         Do not scan files whose names match this regex
    -s, --status=<int>           Enable the status server on the specified port

[NOTICE] Binwalk v2.x will reach EOL in 12/12/2025. Please migrate to binwalk v3.x
```

## radare2
```
Usage: r2 [-ACdfjLMnNqStuvwzX] [-P patch] [-p prj] [-a arch] [-b bits] [-c cmd]
          [-s addr] [-B baddr] [-m maddr] [-i script] [-e k=v] file|pid|-|--|=
 --           run radare2 without opening any file
 -            same as 'r2 malloc://512'
 =            read file from stdin (use -i and -c to run cmds)
 -=           perform !=! command to run all commands remotely
 -0           print \x00 after init and every command
 -1           redirect stderr to stdout
 -2           close stderr file descriptor (silent warning messages)
 -a [arch]    set asm.arch
 -A           run 'aaa' command to analyze all referenced code
 -b [bits]    set asm.bits
 -B [baddr]   set base address for PIE binaries
 -c 'cmd..'   execute radare command
 -C           file is host:port (alias for -c+=http://%s/cmd/)
 -d           debug the executable 'file' or running process 'pid'
 -D [backend] enable debug mode (e cfg.debug=true)
 -e k=v       evaluate config var
 -f           block size = file size
 -F [binplug] force to use that rbin plugin
 -h, -hh      show help message, -hh for long
 -H ([var])   display variable
 -i [file]    run rlang program, r2script file or load plugin
 -I [file]    run script file before the file is opened
 -j           use json for -v, -L and maybe others
 -k [OS/kern] set asm.os (linux, macos, w32, netbsd, ...)
 -L, -LL      list supported IO plugins (-LL list core plugins)
 -m [addr]    map file at given address (loadaddr)
 -M           do not demangle symbol names
 -n, -nn      do not load RBin info (-nn only load bin structures)
 -N           do not load user settings and scripts
 -NN          do not load any script or plugin
 -q           quiet mode (no prompt) and quit after -i
 -qq          quit after running all -c and -i
 -Q           quiet mode (no prompt) and quit faster (quickLeak=true)
 -p [prj]     use project, list if no arg, load if no file
 -P [file]    apply rapatch file and quit
 -r [rarun2]  specify rarun2 profile to load (same as -e dbg.profile=X)
 -R [rr2rule] specify custom rarun2 directive (uses base64 dbg.profile)
 -s [addr]    initial seek
 -S           start r2 in sandbox mode
 -t           load rabin2 info in thread
 -u           set bin.filter=false to get raw sym/sec/cls names
 -v, -V       show radare2 version (-V show lib versions)
 -w           open file in write mode
 -x           open without exec-flag (asm.emu will not work), See io.exec
 -X           same as -e bin.usextr=false (useful for dyldcache)
 -z, -zz      do not load strings or load them even in raw
```
