Streamlined vulnerability discovery for Windows privilege escalation — statically analyze PE import tables and pinpoint hijackable DLLs without ProcMon noise.
A fast, dependency-free, open-source tool to hunt for DLL hijacking vulnerabilities across Windows environments. When applications load DLLs, Windows follows a strict search order — executable directory first, then System32, Windows folder, and PATH variables.
If an application loads a DLL that doesn't exist in a protected system directory, and you have write permissions to an earlier directory in that chain, you can drop a malicious payload. HydraSoft automates this discovery: it walks directory trees, parses PE import tables, cross-references files on disk, and pinpoints exact hijacking opportunities.
Instead of manually running Process Monitor and sifting through thousands of
NAME NOT FOUND events, HydraSoft statically analyzes binaries at rest
and delivers immediate, actionable intelligence for Red Team operations.
Point the GUI at a target directory and hit Scan. As HydraSoft parses executables, results populate the tree view in real-time. Expand any vulnerable executable to inspect hijackable DLLs, exported methods to proxy, and the full search-order path with writability flags.
Color-coded ratings help prioritize targets for crafting proxy DLLs:
For automation pipelines and headless environments. Progress routes to
stderr; clean JSON/CSV results go to stdout — fully pipe-friendly.
HydraSoft.exe --path <dir> [options] --path <dir> Directory to scan (required) --output <file> Write to file (.json or .csv). Default: stdout --image-type any|x86|x64 Filter by architecture --sign any|signed Filter by digital signature status --rate any|best|good|bad Filter by complexity rating --write-perm Only show writable target directories --best-dll-count <n> Default: 2 --best-exe-size <n> KB threshold (default: 10240) --help
# Hunt for best, easily exploitable targets → JSON HydraSoft.exe --path "C:\Program Files" --rate best --output hits.json # Pipe to jq for vulnerable exe paths HydraSoft.exe --path "C:\Program Files" | jq '.[].exePath' # Signed binaries in writable dirs (persistence / bypass) HydraSoft.exe --path "C:\Tools" --sign signed --write-perm
Parses application manifests. Binaries requiring requireAdministrator or
highestAvailable are flagged — hijacking them is a direct
privilege escalation vector.
Automatically excludes known system DLLs from System32, SysWOW64, and Windows\System. Analyzes both standard and delayed imports.
--write-perm filters to hijack targets where you can actually drop a payload
— no theoretical-only results.
Progress on stderr, structured JSON/CSV on stdout. Integrates cleanly with
automation, CI pipelines, and jq.
Native Windows, no runtime dependencies
Open Robber\Robber.dproj and build
CLI and graphical modes included
Fork · contribute · maintain zero-deps policy
This tool is provided strictly for authorized vulnerability research, system administration, and ethical hacking engagements. Identifying and exploiting DLL hijacking vulnerabilities without explicit, written permission from the system owner is illegal and unethical. The author assumes no liability for misuse, including unauthorized privilege escalation or persistence on production systems. Always operate within a defined engagement scope.