Features

Native paths across the assessment chain.

nimux is built to cover discovery, authentication validation, remote execution, file movement, identity operations, pivoting, and repeatable reporting from one CLI.

Enumeration

TCP and UDP scanning, service fingerprinting, DNS subdomain discovery, HTTP probing, directory/file discovery, vhost discovery, SMB share enumeration, LDAP, RDP, MSSQL, SSH, FTP, NFS, AFP, VNC, WebDAV, MySQL, and PostgreSQL.

Web discovery

HTTP directory and file discovery, extension expansion, vhost discovery, custom headers, worker controls, recursion, link extraction, resume support, and false-positive filters such as -fs and auto-calibration.

SMB share triage

Anonymous and authenticated share checks, read-only spidering, path and depth controls, size limits, name patterns, and interesting-file matching for Windows, Linux, and macOS artifacts.

Remote execution

WinRM, WMI/CIM, SCM, helper service execution, DCOM, Task Scheduler, MSSQL xp_cmdshell, interactive shells, upload, and download.

Kerberos and identity

kinit, getST, S4U, constrained delegation, RBCD, ccache and kirbi conversion, roasting, PKINIT, certificate mapping, and shadow credential workflows.

Active Directory paths

LDAP object queries and writes, BloodHound Legacy 4.x-compatible output, ADCS policy and certificate workflows, GPO workflows, group and ACL operations, DCSync, secrets, DPAPI material, trust keys, and rollback records.

Pivoting

SOCKS workflows for Windows and Linux pivot hosts that can run in the background, including SSH-backed Linux deployment, and then route supported nimux commands through --proxy.

MCP integration

A structured MCP wrapper for AI clients that exposes the command surface with progress, policy controls, redaction, and reusable workflows.