Built into the page
Small, focused utilities embedded directly on pwnmi.com — no install, no separate tab, no account. Some are established community tools, credited and hosted here for convenience; others are built first-party for the site.
PoC Finder
Search GitHub for proof-of-concept code by CVE ID, keyword, or a product name pinned to a specific version — a browser port of a small CLI script, get_poc.sh.
Buffer Overflow Pattern Generator
Generate a De Bruijn-style unique pattern for stack overflow offset-finding, or look up the exact offset from a captured EIP/RIP value — entirely in your browser.
Encode / Decode
Base64, URL, hex, and HTML entity encoding and decoding in one lightweight page — the everyday slice of CyberChef, without the 13MB.
Hash Identifier
Paste a hash, get the likely algorithm(s) back plus the matching hashcat mode number — honest about ambiguity where the length alone doesn't settle it.
IP Obfuscator
Rewrite an IPv4 address as decimal, octal, hex, or a mixed-notation form — a real, still-effective technique against naive URL allow/blocklists.
JWT Decoder
Decode a JWT's header and payload, and check it against candidate secrets for HS256/384/512 — entirely client-side, no token or secret ever sent anywhere.
Pivot / Port-Forward Command Builder
One set of inputs, six ready-to-run commands: ssh -L/-R/-D, socat, and a chisel reverse tunnel — for reaching a target that's only visible from a pivot host.
Reverse Shell Generator
Every common reverse and bind shell one-liner, MSFVenom payload, and HoaxShell command — generated for your IP and port, right on this page.
Username / Password Mutator
Feed it a target's known info — name, birth year, pet, company — and get back a wordlist of realistic username and password guesses for spraying prep.
Linked, not embedded
Real, widely-used tools we looked at embedding the same way as the ones above and couldn't — usually a licensing mismatch, sometimes just no self-contained app to vendor. Described here honestly, with a link to the real thing.
GTFOBins ↗
Lookup for turning a reachable Unix binary (SUID, sudo, a capability) into a shell or a read/write primitive. GPL-3.0 is copyleft, and the live site is a Jekyll build, not a self-contained static app the way the Reverse Shell Generator is — nothing here to cleanly vendor. See PWNMI's GTFOBins cheat sheet for how it's actually used.
LOLBAS ↗
GTFOBins' Windows counterpart — signed, pre-installed binaries abused for execution and defense evasion. Same GPL-3.0 issue as GTFOBins, and its own source repo is just the underlying YAML data, not a web app at all — the live search UI lives elsewhere. See PWNMI's LOLBAS cheat sheet for how it's actually used.