Developer tools

The best privilege escalation tools, according to hackers

86 privilege escalation tools recommended in Hacker News comments over the past year, ranked by how many separate people recommend each one.

• Most recommendedfzf78 people recommend it
• Built to lastAtuinowners report a median of 2 years
• Least regretParqeye19 recommend, 0 criticize

All privilege escalation tools

• fzfFast fuzzy finder that adds interactive search to shell history, files and scripts. Caveat: slow on very large directories.78recommend
• jqCommand-line tool for filtering and reshaping JSON, used in shell pipelines and API work. Critics find its operator syntax cryptic and hard to remember.75recommend
• grepFast, decades-old command-line text search that composes well in scripts and agent workflows. Critics say it is lexical and floods context on large codebases.65recommend
• AtuinSyncs and searches shell history across machines, with context-aware search by directory and host. Critics worry about added AI features and growing bloat.63recommend
• GitHub CLILets you do most GitHub tasks from the terminal, and coding agents use it for PRs and CI. Main caveat: the telemetry rollout and plaintext credential storage.49recommend
• ImageMagickFree command-line tool for converting, scripting and bulk-editing images in any format. Critics often cite security bugs and heavy memory use.37recommend
• sedBuilt-in Unix stream editor for find-and-replace and text edits in scripts and pipelines, valued for ubiquity and terse one-liners. Caveat: macOS BSD and GNU versions differ in syntax.35recommend
• GitHub CLI (gh)People recommend gh for GitHub tasks in the terminal, especially with AI agents, which find it more token efficient than MCP. Critics note coarse token scopes.34recommend
• sudoPeople recommend it as battle-tested infrastructure that lets you start with few privileges and elevate when needed. Critics most often cite its history of security vulnerabilities.34recommend
• lessTerminal pager for reading files and piped command output, with search and filtering; people value its long track record. Critics point to past security vulnerabilities and a large code base.31recommend
• Google Workspace CLIPeople recommend it as a scriptable command-line interface to Google Workspace apps like Sheets and Docs, useful for agents. Critics say Google Cloud setup and auth are hard and that the vibe-coded code is a trust risk.31recommend
• GNU findPeople recommend find for fast, flexible file searching and for combining with xargs; the most common caveat is its arcane, hard-to-remember syntax.27recommend
• xargsStandard Unix tool that builds commands from piped input, used for parallel runs with -P and feeding find results. Caveat: options are easy to forget and filenames with spaces can break it.25recommend
• witrExplains why a Linux process is running by showing its parent chain, a handier take than shell aliases. Main caveat: curl-based install and parent-only checks.24recommend
• AWS CLIOfficial command-line tool for AWS services, used to script and automate cloud tasks; critics find its bundled Python runtime bloated and its JSON output and syntax awkward.22recommend
• fdPeople recommend fd as a faster, more intuitive replacement for find that respects .gitignore by default. Some note it cannot see files with malformed UTF-8.20recommend
• batFree command-line cat replacement with syntax highlighting and an automatic pager that people find covers most needs. Critics say it is slow to open very large files.19recommend
• ParqeyeA free, open source command line tool for visualizing and inspecting Parquet files, which people say fills a long-standing gap. Remote S3 support was not yet available when people discussed it.19recommend
• ddRecommended for exact byte-for-byte copies and disk cloning. Main caveat: its odd syntax and a wrong target can destroy data.18recommend
• zoxidePeople recommend it as a smarter cd that learns frequent folders and jumps to them quickly. Caveat: parent folders are only added if you cd into each one manually.18recommend
• sudo-rsRust rewrite of sudo that removes complexity behind vulnerabilities and drops insecure features; critics note gaps in compatibility with original sudo.17recommend
• VHS by CharmbraceletFree open-source command-line tool that records terminal sessions from a script into GIFs or videos, popular for README demos.16recommend
• GNU ParallelCommand-line tool that runs jobs in parallel, with options like --dry-run and --eta, and free software people recommend for batch work. Critics note its citation notice printed on each run.16recommend
• ADB (Android Debug Bridge)Command-line tool for sideloading apps, copying files and running commands on Android devices. Critics warn that enabled debugging exposes devices to attackers.15recommend
• llm by Simon WillisonFree command-line tool for sending prompts to cloud and local AI models, often used as a building block in other tools. Critics dislike how it stores template state.15recommend
• socatPeople recommend socat as a low-hassle command-line relay and a better alternative to base telnet for ad-hoc connections. One critic found it slow.15recommend
• Cloudflare WranglerCloudflare's official CLI for Workers, praised for local development, CI use and simple deploys. Critics find it heavy, dependent on the Node.js toolchain and clunky to use.14recommend
• StashFree CLI that syncs Markdown files to Apple Notes and stashes piped data; praised for simplicity and zero-knowledge design. Critics say the name clashes with another popular app.13recommend
• mcp2cliTurns MCP servers and APIs into a command-line interface so agents discover tools on demand, which cuts token use. Critics raise the latency cost and say the docs read as generated.13recommend
• ExifToolCommand-line tool that reads and writes metadata across many file formats; people script with it and build it into other projects. Critics say it is too slow for production pipelines.12recommend
• xdotoolCommand-line tool for simulating keyboard, mouse and window actions on X11, popular for scripting and test automation. Critics note it runs into gaps and inconsistent behavior.11recommend
• cat (Unix command)Standard Unix tool that prints files and fits cleanly into pipelines, so people reuse it in many workflows. Critics say it is often superfluous and can merge lines unexpectedly.11recommend
• BiffRecommended for thorough, example-rich command line datetime handling that uses the system timezone database. Critics note its specialised language and that LLMs can now do similar work.11recommend
• ChafaFree command-line tool that renders images in terminals with good quality, including sixel and kitty output. Caveat: one commenter found results not as good as a specific example.11recommend
• kubectlRecommended for monitoring and debugging clusters, and seen as more ergonomic than systemctl and journalctl. Common caveat: kubectl explain and its man pages are hard to navigate.10recommend
• ShowboatFree tool that lets AI agents and people produce readable code walkthroughs and demos. Critics say its use case is unclear and it mostly makes static output.10recommend
• GitlogueA terminal tool that replays Git commits with animation, which people find useful for digesting pull requests and following code history. Critics say it is meant as a presentation piece rather than a development aid.10recommend
• asciinemaPeople recommend asciinema as a good, professional way to record and share terminal sessions. The most common caveat is that it needs a JS player, so GitHub READMEs won't show it as a native image.9recommend
• lsofRecommended for finding which process holds a port or file open without restarting anything. Critics find its flags and defaults awkward, and warn against killing its results.9recommend
• fingerOld Unix command for looking up logged-in users; people like its simple single-file setup and nostalgia. Critics note it can't run behind a CDN.9recommend
• chronic (moreutils)Wraps a cron job so it stays quiet on success and mails its full output when the command fails, so failures surface without reviewing logs.9recommend
• lsStandard Unix file lister, stable and complete for everyday use. The most common caveat is its many cryptic flags, which feel awkward outside routine tasks.8recommend
• unitsA free command-line unit converter that people recommend for quick conversions in the terminal, with a wide range of built-in units.8recommend
• doasPeople recommend doas as a small sudo alternative with a core of just over 500 lines, originally from OpenBSD, for its simplicity and low footprint.8recommend
• Obsidian CLILets scripts and AI agents query and control Obsidian from the terminal, including Bases queries. Caveat: the Obsidian desktop app must stay open, and the CLI cannot display notes.8recommend
• run0 (systemd)Sudo alternative from systemd that uses Polkit and transient units instead of setuid, preferred for its design. Main caveat: poorly documented, with many interconnected points of failure.8recommend
• RunpromptRuns .prompt files from the command line, so LLM calls can be chained in shell pipelines with less typing and more control. Critics note it falls back to string input when JSON fails to parse.8recommend
• forkrunPeople recommend forkrun as a fast shell parallelizer that cuts overhead without script rewrites; the main caveat is that it relies on Linux-only system calls.8recommend
• OnceFree tool for caching CLI commands that keeps secrets out of files and the environment. Critics question what its use case is.8recommend
• jira-cli by ankitpokhrelPeople recommend this free command-line client for Jira so they can script issue workflows and let AI agents work from their tickets without opening the browser.7recommend
• ggRecommended for efficient Jujutsu browsing and squashing, as a console.log replacement, and as a gh CLI alternative, though it only shows traditional diffs.7recommend
• digCommand-line DNS lookup tool that people recommend for querying and tracing DNS records; some note nslookup may be the only one installed by default.7recommend
• Android Debug Bridge (ADB)Free Android command-line tool for controlling and inspecting devices from a computer, with broad compatibility on newer Android versions, though critics worry about elevated shell access.7recommend
• rlwrapA free wrapper that adds readline line editing and history to any command line program that lacks it, such as SQL clients.7recommend
• WhohasRecommended as a simple, useful command-line tool for finding packages across distros; critics say it is abandoned, last released 11 years ago, with hardcoded repository URLs.7recommend
• Cloudflare CLIPeople like its complete Cloudflare API coverage, local Workers explorer and search for agent use. Critics call it complex and say help text and completions are inconsistent.7recommend
• OfficeCLIA command line tool that lets AI agents read and edit Microsoft Office files while using few tokens, which people find handy for document work.7recommend
• REWE grocery ordering CLILets shoppers order REWE groceries from the command line, including piping in item lists. Caveat: it relies on a reverse-engineered API that may break.7recommend
• Azure CLIRecommended as a strong way to work with Azure, including scripting setup tasks rather than using the web portal. Critics find even the CLI clunky.6recommend
• xsvPeople recommend xsv as a fast command-line tool for working through very large CSV files.6recommend
• tailStandard Unix utility that shows the end of a file or stream, mainly used to follow logs as they grow and for quick ad-hoc checks.6recommend
• systemctlPeople recommend systemctl for managing Linux services from the command line, including enabling and starting a service in one command and running commands on remote machines.6recommend
• gronFree command-line tool that flattens JSON into greppable lines, which people recommend for viewing JSON and as a possible replacement for jq.6recommend
• diffA long-standing Unix command that compares files line by line, recommended as solid, simple and reliable for everyday file comparison.6recommend
• cpStandard Unix copy command that is easy to explain over the phone and well established. Critics agree its default options are poor and it has no undo.6recommend
• pv (pipe viewer)Free command-line tool that shows progress, transfer speed and rate limiting for data passed between programs in a pipe.6recommend
• ssBuilt-in Linux tool for listing sockets and ports, with filters that replace grep. Caveat: default output is hard to read and parse.6recommend
• osxphotosA free command-line tool that reads the Apple Photos library and exports photos with their metadata and albums, useful for backups and moving photos out of Apple Photos.6recommend
• GhostBoxRecommended as a CLI for disposable dev machines on your own GitHub Actions minutes, with real SSH access. Critics warn it likely violates GitHub's terms of service.6recommend
• uhubctlFree command-line tool that switches power to individual ports on supported smart USB hubs, so people use it to turn devices like 3D printers and LED strips on and off.6recommend
• Android CLIPeople recommend it for structured commands that replace trial-and-error and for UI control by element name. Critics agree the claimed speed gains mostly apply to project and environment setup.6recommend
• Burn, Baby, BurnA free CLI tool that burns AI tokens, praised as hilarious and fully functional. One critic notes it is vibe-coded, so ownership is unclear.6recommend
• systemd-runRuns programs as transient systemd units to cap memory and CPU or sandbox them. Critics wonder whether its isolation is enough.5recommend
• z directory jumperPeople recommend z as a simple shell tool that ranks directories by frecency, so you can jump between projects quickly.5recommend
• caffeinateFree command built into macOS that keeps a Mac awake from the terminal. Critics say it does not stop sleep when the lid is closed.5recommend
• Atlassian acliAtlassian's command-line tool for Jira that people find discoverable and cheaper than MCP for agents. Critics note gaps in Confluence coverage and fewer capabilities than MCP.5recommend
• Atlassian CLIRecommended as a more reliable and token-efficient alternative to the Atlassian MCP server for AI agents. Critics say the CLI itself is rough, though agents use it consistently.5recommend
• pbcopyBuilt-in macOS commands that pipe text into and out of the clipboard from the terminal. Critics say copies can pick up a newline and rich text is not supported.5recommend
• vlm-run mmVideo understanding encoders and a CLI that warns before AI models you call are retired. Critics mention a broken GitHub link and a large download.5recommend
• Docx-CLIA command line tool that lets AI agents read and edit Word documents, with batched edits and git-like safety, as people recommend it.5recommend
• agent-slack CLILets AI agents work with Slack by reading its local data instead of the API or MCP, which people find works better for a Slack-only setup. Critics warn that accounts may be flagged as hijacked and sessions killed.5recommend
• Unity CLILets scripts and agents run Unity tests, C# code and builds without the editor, returning structured data. Critics say it is not stable enough for practical use.5recommend
• StinkpotPeople recommend it as a small, lean shell history tool that skips the extra features of tools like atuin, and it is only about 400 lines of code.5recommend
• Claude ChillA fix for Claude Code's terminal flickering that people say works well. The most common caveat is that it breaks Ghostty's native scrollback.5recommend
• bashnumerateRecommended as a consistent alternative to xargs, for loops and find -exec. The most common caveat is its unusual syntax.5recommend
• ClaudrabandA free wrapper around the official Claude Code CLI that people find clean and well designed. The most common caveat is that it only supports Claude Code, which some see as adding to Anthropic lock-in.5recommend