Free Online Pentest Tools: The MagmaNex Cybersecurity Toolkit
MagmaNex now offers a completely browser-based, free cybersecurity toolkit. No signup, no download, no install. Every tool runs directly in your browser, meaning on your own machine; your inputs are never sent to any server. When you're in the middle of a lab and you suddenly need a reverse shell one-liner, the right nmap command, or the type of a hash, switching tabs is all it takes now.
This set was built with OSCP, Hack The Box, and TryHackMe learners and working penetration testers in mind. Below we introduce the tools in logical groups.
Getting a Shell
When you first gain a foothold on a system, the usual first goal is to land an interactive shell.
Reverse Shell Generator
With the Reverse Shell Generator, enter an IP and port and instantly produce one-liner reverse shells for bash, python, nc, PowerShell, and many more formats. Base64 and URL encoding options plus filter/WAF bypass tips are included. When you don't know which interpreter is available on the target, you can try different variants with a single click.
Recon & Scanning
A good attack starts with good recon. Moving forward without understanding the target's surface area is a waste of time.
Nmap Command Builder
The Nmap Command Builder lets you build a complete nmap command by clicking the scan type, ports, timing, extra options, and NSE scripts. Each option comes with a short explanation of what it does, so you don't just copy the command, you also learn why you're using that flag. Ideal for grasping the logic instead of memorizing flags during the OSCP exam.
Building Payloads
The path to a shell often runs through the right payload.
Msfvenom Payload Builder
With the Msfvenom Payload Builder, you can generate msfvenom payloads for Windows, Linux, Android, PHP, and more, complete with encoders and format options. Pick the architecture, LHOST/LPORT, and output format, and your command is ready.
Web Attack Payloads
When it comes to web applications, the Web Attack Payloads Reference offers a full arsenal: search XSS, SQLi, LFI, command injection, SSTI, SSRF, and XXE payloads, and read how each one works. Instead of trying to remember what to fire at an input field, pick straight from the category.
Cracking Hashes
When you grab a hash, you need two things: to know its type and to build the right command.
Hash Identifier
Paste a hash into the Hash Identifier; it identifies the type and hands you the matching hashcat -m mode and john format. Don't waste time guessing whether what you're looking at is MD5, NTLM, or bcrypt.
Hashcat Command Builder
Once you know the type, the Hashcat Command Builder takes over. With around 80 hash modes and various attack modes (dictionary, brute-force, rule-based), it lets you build a complete hashcat command. Select the mode number, wordlist, and rules, and the command appears in the output.
Privilege Escalation
After landing a low-privilege shell, the goal is usually to become root or SYSTEM.
Unix Privilege Escalation Reference
The Unix Privilege Escalation Reference offers a searchable collection of SUID/sudo/capabilities and GTFOBins-style techniques. Each technique is explained for why it works; when you spot a binary, quickly find how it can be abused to escalate privileges.
Windows Privilege Escalation Reference
The Windows Privilege Escalation Reference gathers token abuse (SeImpersonate/Potato attacks), weak service configurations, UAC bypass, and credential dumping techniques, each with explanations. Knowing where to look on Windows targets saves valuable time.
Reporting & Reference
When the work is done, you need to properly measure and document your findings; and having a command summary always at hand speeds everything up.
CVSS 3.1 Calculator
With the CVSS 3.1 Calculator, you can score a vulnerability and produce the vector string to drop into your report. It's the easiest way to present a consistent, standard severity rating in the report you deliver to a client or instructor.
Pentest Cheat Sheet
The Pentest Cheat Sheet provides an 11-phase command reference, from recon to SMB, from web to password attacks, from privilege escalation to Active Directory and pivoting. When you get stuck on a step, jump to the relevant phase instead of wondering "which command was it again."
Explore Everything
All of these tools and more live together in MagmaNex's Cybersecurity category. To browse the full set, check out the Cybersecurity tools page. Every tool is free, runs in your browser, and requires no signup.
Ethical Use Notice
These tools are provided strictly for educational and authorized security testing purposes. Use them only on systems you own or have explicit written permission to test. Unauthorized penetration testing is a crime in most jurisdictions. Make sure you use MagmaNex tools responsibly, legally, and ethically; the responsibility is entirely yours.