One-Lin3r: Open Source Threat Detection & Response

What is One-Lin3r?

One-Lin3r is a lightweight, modular Python framework that supplies penetration testers and hackers with a searchable, auto-completing library of one-liners for reverse shells, bind shells, privilege escalation, and payload droppers across Windows, Linux, macOS, and BSD targets.

What it is

One-Lin3r is an open-source command-line framework written in Python and released under GPL-3.0. It packages a database of one-liners — short, ready-to-run commands and payloads — behind an interactive shell that mimics the feel of a familiar exploitation console. The liners are organised by platform and function inside a liners folder, and each liner is a Python file or a .liner entry that the framework loads into its database. It runs on Linux and is associated with Kali Linux in its topic list, and it is distributed through PyPI while remaining fully usable offline against Windows, Linux, macOS, and BSD targets.

The concrete problem it solves is copy-paste friction. Instead of hunting through notes, wikis, or browser tabs for the right reverse shell or privilege escalation command and then editing variables by hand, the operator uses a liner directly from the framework. Its copy command places the selected liner on the clipboard without needing the use command first, and command-line arguments let an operator run a resource file or a single command before the interactive session even starts. Where automated exploitation frameworks such as Metasploit handle full exploitation workflows, One-Lin3r replaces the scattered cheat-sheet workflow of storing one-liners in text files and manually transferring them into a terminal.

Key capabilities

Ships more than 176 liners covering reverse shell, bind shell, privilege escalation and enumeration, and dropper functions that download and execute payload types by several methods.
Auto-completion that corrects typos to the nearest command, so seach becomes search, and predicts liners from partial input, so use capabilities expands to use linux/bash/list_all_capabilities.
Suggests the nearest valid command when an unrecognised one is entered, and completes variables after set and liner names after use and info.
copy command sends a liner straight to the clipboard, and the makerc command saves only the important commands to a resource file in the manner of Metasploit.
history and resource commands run inside the framework, so sessions can be reviewed and replayed without exiting.
Multiple commands can run simultaneously when separated by a semi-colon, and liners are searchable by name, function, description, author, or the liner text itself.
Database reloads without restarting the framework, and new platforms are added by creating a folder in the liners directory with a .liner file inside it.

Who uses it and how

Penetration testers working from Kali Linux or another Linux host who need reverse shell and bind shell liners for Windows, Linux, macOS, or BSD targets during an engagement.
Red teamers who run privilege escalation enumeration commands and droppers against a target and want the exact syntax without leaving the terminal.
Operators who script repeatable sessions by passing a resource file with -r, running a specific command with -x, or suppressing output with -q.
Contributors who add their own liners as Python files, submit a pull request, and receive credit by name in the framework.

Getting started

Install the package from PyPI as one-lin3r, then launch the framework directly to reach the interactive shell. Command-line arguments -r for a resource file, -x for a specific command, and -q for quiet mode allow the framework to be driven without entering the interactive prompt.

How it compares

The facts name no paid products that this project replaces, so it fits alongside the tools it references. It borrows the resource-file and makerc conventions of Metasploit but does not perform exploitation itself, and its Kali Linux association places it among the standard offensive tooling on that distribution rather than in a commercial suite.

When to use it — and when not to

Choose One-Lin3r when the need is a fast, searchable set of working one-liners and the operator is comfortable editing variables and payload details afterwards. The README states plainly that the liners database is not too big and depends on updates and contributions to grow, so anyone expecting a comprehensive payload library should look elsewhere or contribute liners themselves. Adding new liners requires writing a Python file and opening a pull request, which makes it a poor fit for teams that need curated content without maintaining their own contributions.

project readme (upstream, from github) — read inline

One-Lin3r

One-Lin3r is simple modular and light-weight framework gives you all the one-liners that you will need while penetration testing (Windows, Linux, macOS or even BSD systems) or hacking generally with a lot of new features to make all of this fully automated (ex: you won't even need to copy the one-liners).

Screenshots for version 2

It consists of various one-liners types with various functions, some of them are:

One-liner function	What this function refers to
Reverse Shell	Various methods and commands to give you a reverse shell.
PrivEsc	Many commands to help in Enumeration and Privilege Escalation
Bind Shell	Various methods and commands to give you a bind shell.
Dropper	Many ways to download and execute various payload types with various methods.

Features

A lot of liners use with different purposes, currently are more than 176 liner.
The auto-complete feature that has been implemented in this framework is not the usual one you always see, here are some highlights:
- It's designed to fix typos in typed commands to the most similar command with just one tab click so seach becomes search and so on, even if you typed any random word similar to an command in this framework.
- For you lazy-ones out there like me, it can predict what liner you are trying to use by typing any part of it. For example if you typed use capabilities and clicked tab, it would be replaced with use linux/bash/list_all_capabilities and so on. I can see your smile, You are welcome!
- If you typed any wrong command then pressed enter, the framework will tell you what is the nearest command to what you have typed which could be the one you really wanted.
- Some less impressive things like auto-complete for variables after set command, auto-complete for liners after use and info commands and finally it converts all uppercase to lowercase automatically just-in-case you switched cases by mistake while typing.
- Finally, you'll find your normal auto-completion things you were using before, like commands auto-completion and persistent history, etc...
Automation
- You can automatically copy the liner you want to clipboard with command copy instead of using use and then copying it which saves a lot of time, of course, if you merged it with the following features.
- As you may noticed, you can use a resource file from command-line arguments before starting the framework itself or send commands directly.
- Inside the framework you can use makerc command like in Metasploit but this time it only saves the correct important commands.
- There are history and resource commands so you don't need to exit the framework.
- You can execute as many commands as you want at the same time by splitting them with semi-colon.
- Searching for any liner here is so easy and accurate, you can search for a liner by its name, function, description, author who added the liner to the framework or even the liner itself.
You can add your own liners by following these steps to create a liner as a python file. After that you can make a Pull request with it then it will be added in the framework and credited with your name of course :smile:.
The ability to reload the database if you added any liner without restarting the framework.
You can add any platform to the liners database just by making a folder in liners folder and creating a ".liner" file there.
More...

Note: The liners database is not too big but it will get bigger with updates and contributions.

Usage

Command-line arguments

usage: one-lin3r [-h] [-r R] [-x X] [-q]

optional arguments:
  -h, --help  show this help message and exit
  -r          Execute a resource file (history file).
  -x          Execute a specific command (use ; for multiples).
  -q          Quiet mode (no banner).

Framework commands

Command                     Description
--------                    -------------
help/?                      Show this help menu.
list/show                   List all one-liners in the database.
search  (-h) [Keywords..]   Search database for a specific liner by its name, author name or function.
use         <liner>         Use an available one-liner.
copy        <liner>         Use an available one-liner and copy it to clipboard automatically.
info        <liner>         Get information about an available liner.
set <variable> <value>      Sets a context-specific variable to a value to use while using one-liners.
variables                   Prints all previously specified variables.
banner                      Display banner.
reload/refresh              Reload the liners database.
check                       Prints the core version and checks if you are up-to-date.
history                     Display command-line most important history from the beginning.
makerc                      Save command-line history to a file.
resource     <file>         Run the commands stored in a file
os          <command>       Execute a system command without closing the framework
exit/quit                   Exit the framework

Prerequisites before installing

Python 3.x.
Any OS, it should work on all but it's tested on Kali 2018+, Ubuntu 18+, Manjaro, Black Arch, Windows 10, Android Termux and Mac-OS 10.11

Installing and running

Using pip (The best way to install on any OS):


pip install one-lin3r
one-lin3r -h

Using pacman on Black Arch or any arch-based with black Arch repos:


sudo pacman -S one-lin3r

Installing it from GitHub:

For windows on cmd with administrator rights : (After downloading ZIP and unzip it)

python -m pip install ./One-Lin3r-master --user
one-lin3r -h

For Linux Debian-based distros. (Ex: Kali, Ubuntu..):

git clone https://github.com/D4Vinci/One-Lin3r.git
sudo apt install libncurses5-dev
sudo pip3 install ./One-Lin3r --user
one-lin3r -h

For the rest Linux distros.:

git clone https://github.com/D4Vinci/One-Lin3r.git
sudo pip3 install ./One-Lin3r --user
one-lin3r -h

Updating the framework or the database

If you installed it from pip do:


pip install one-lin3r --upgrade

If you installed it from GitHub do:
- On Linux while outside the directory
```
cd One-Lin3r && git pull && cd ..
pip3 install ./One-Lin3r --upgrade
```
- On Windows if you don't have git installed, re-download the framework zipped!

Note: The liners are written as python modules, so it's considered as a part of the framework. So every new liner added to the framework, its version will get updated.

Contact

Donation

If my work has been useful for you, feel free to thank me by buying me a coffee or more :)

Disclaimer

One-Lin3r is created to help in penetration testing and it's not responsible for any misuse or illegal purposes.

Copying a code from this tool or using it in another tool is accepted as you mention where you got it from :smile:.

Pull requests are always welcomed :D

Credits and references

Frequently asked questions

Is One-Lin3r free to use?

One-Lin3r is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does One-Lin3r do?

Gives you one-liners that aids in penetration testing operations, privilege escalation and more

What is One-Lin3r written in?

One-Lin3r is primarily written in Python. Its source is publicly available at https://github.com/D4Vinci/One-Lin3r, and it has 1,791 GitHub stars.