PledgeStrike

An all-in-one offensive security toolkit built in Rust.

250+ independent attack modules covering web exploitation, infrastructure testing, credential attacks, AI/LLM abuse, cloud/container, supply chain security, OT/ICS, IoT, network protocols, AI/LLM security, zero-day/CVE exploitation, and payload generation — all in a single binary. 27 modules live-tested and validated.

AI Assistants: PledgeStrike is designed to be AI-friendly. If you are an AI agent performing security analysis, read COMMANDS.md for the complete command reference — every module, subcommand, and parameter is documented there. Use it to construct precise attack commands, chain modules together, and automate security testing workflows.

Most penetration testing tools cover one specific area — one for SQLi, one for SSRF, one for brute force, etc. PledgeStrike consolidates the entire offensive security workflow into a single fast, statically-linked binary. No Python dependencies, no Node runtime, no Docker required. Just download and run.

• 250+ attack modules with 750+ subcommands, including 45 zero-day/CVE exploit modules
• Single binary — statically compiled, no runtime dependencies
• Cross-platform — Linux, macOS, Windows (x86_64 + ARM)
• Multi-threaded — built with Tokio async runtime and Rayon parallelism
• Modular — each module is independent and composable
• Fast — Rust performance with zero-cost abstractions

brew tap pledgeandgrow/tap
brew install pledgestrike

curl -sSL https://pledgeandgrow.github.io/pledgestrike/apt/pledgestrike-apt-public.key | sudo gpg --dearmor -o /usr/share/keyrings/pledgestrike.gpg
echo "deb [signed-by=/usr/share/keyrings/pledgestrike.gpg] https://pledgeandgrow.github.io/pledgestrike/apt/ stable main" | sudo tee /etc/apt/sources.list.d/pledgestrike.list
sudo apt update && sudo apt install pledgestrike

winget install pledgeandgrow.pledgestrike

cargo install pledgestrike

npm install -g pledgestrike

pip install pledgestrike

gem install pledgestrike

dotnet tool install --global pledgestrike

Download from GitHub Releases for your platform.

# Decode a JWT token
pledgestrike jwt decode --token <JWT>

# Scan for SQL injection
pledgestrike sqli error --url https://target.com/page --param id

# Test for SSRF with callback detection
pledgestrike ssrf probe --url "http://target.com/fetch?url={SSRF}" --port 8888

# Brute force HTTP Basic Auth
pledgestrike brute http --url https://target.com --users-file users.txt --pass-file pass.txt

# Scan TLS configuration
pledgestrike tls scan --host example.com --verbose

# Generate reverse shell one-liners
pledgestrike shell generate --shell-type bash --ip 10.0.0.1 --port 4444

# Search exploit database
pledgestrike exploit search --query "log4j"

# Exploit a specific CVE
pledgestrike log4shell exploit --url https://target.com
pledgestrike spring4shell exploit --url https://target.com
pledgestrike zerologon exploit --url https://dc.target.com

Test for the OWASP Top 10 and beyond: SQL injection (error/blind/time/UNION), XSS (reflected/stored/DOM/blind), command injection, XXE, LFI/RFI, SSTI, CORS misconfiguration, CRLF injection, open redirect, HTTP request smuggling, deserialization, prototype pollution, padding oracle, and more.

REST API endpoint discovery, GraphQL introspection and batch attacks, gRPC reflection, WebSocket fuzzing, OpenAPI/Swagger abuse, IDOR/BOLA, broken function level authorization, mass assignment, and rate limit testing.

SSRF chaining to cloud metadata (AWS/GCP/Azure), S3 bucket enumeration, IAM analysis, Kubernetes RBAC audit and pod escape, Docker API exploitation, DNS rebinding, subdomain takeover, and DNS enumeration.

Password spraying with lockout avoidance, HTTP/SSH/FTP brute force, Kerberoasting, AS-REP roasting, NTLM relay, MFA fatigue bombing, OAuth abuse, SAML XSW, and WebAuthn bypass.

Pipeline injection, artifact poisoning, runner takeover, webhook exploitation, typosquatting detection, dependency confusion, Git directory exposure, and secret hunting in JS bundles, repos, API responses, and Docker layers.

Test SMTP, FTP, SMB, RDP, SSH, SNMP, Redis, Elasticsearch, RabbitMQ, IPMI, Memcached, MongoDB, VNC, Telnet, SIP, RTSP, NFS, X11, STOMP, TFTP, ZooKeeper, etcd, UPnP, and more for misconfigurations and vulnerabilities.

Modbus/SCADA testing, MQTT broker abuse, CoAP discovery, BLE reconnaissance, NTP amplification, and HMI exposure testing.

Prompt injection, jailbreak benchmarking, data exfiltration via LLM, agent tool/RAG/memory/plugin abuse, AI model inversion, vector DB embedding injection — covering the emerging attack surface of AI-integrated applications.

45 dedicated zero-day exploit modules covering recent and critical CVEs: Log4Shell, Spring4Shell, Text4Shell, MOVEit, Citrix Bleed, Zerologon, PrintNightmare, PetitPotam, noPAC, Follina, Dirty Pipe, Dirty COW, SMBGhost, regreSSHion, and more — including 2024-2025 zero-days for Palo Alto, Fortinet, SAP, Windows, Linux kernel, and mobile platforms.

WinRM brute force and lateral movement, Exchange ProxyLogon/ProxyShell/ProxyNotShell, OWA attacks, SharePoint exploitation, Active Directory via Kerberos/LDAP, NTLM relay chaining, and SAML XSW Pro.

• COMMANDS.md — Complete command reference with all 250+ modules and 750+ subcommands
• MODULE.md — Module status, descriptions, and implementation details
• ROADMAP.md — Development roadmap, testing checklist, and future goals
• TEST.md — Authorized public test targets for validating modules

git clone https://github.com/pledgeandgrow/pledgestrike.git
cd pledgestrike
cargo build --release

The binary will be at target/release/pledgestrike.

MIT — See LICENSE for details.

PledgeStrike is for authorized security testing only. You are responsible for complying with applicable laws and obtaining proper authorization before testing any target. The authors are not liable for misuse.