Watch the NOCAP demonstration on YouTube

Every operator has the same dirty secret: a graveyard of unsaved scan output.

You ran NetExec against a subnet. Sprayed creds, got hits, saw Pwn3d! flash by. And then you realized you didn’t save it. Or you used --log but named it something useless and now it’s buried in the wrong directory alongside four other files with names you don’t recognize.

Every tool has its own output story. Nmap gives you -oA. NetExec has --log. Feroxbuster has -o. Gobuster has -o. Half your tools have nothing at all. You’re memorizing a different flag for every tool, manually naming files, manually routing to the right engagement directory — and when you forget any of it, the output is gone.

I got tired of this cycle. So I built NOCAP — a zero-dependency command capture wrapper that replaces all of it with one interface. One prefix. Every tool. No more per-tool output flags. No more | tee. No more thinking about where things go.

In my last post I talked about the philosophy: automate the repeatable, own your environment, iterate constantly. NOCAP is what happens when you take that philosophy and point it at the most common failure mode in offensive operations — losing your own output.

The Problem

Here’s how it usually goes:

netexec smb 10.10.10.0/24 -u admin -p 'Password1' --shares

The output scrolls by. Share enumeration across a whole subnet — readable shares, write access, interesting findings. It’s all right there in your terminal. And then it’s gone. You could have added --log shares.txt, but you didn’t. Or you did, and now you have shares.txt, shares2.txt, and smb-shares-final.txt scattered across two directories.

  • You forget the output flag (or the tool doesn’t have one) and the output is gone
  • Every tool uses a different flag: -oA, --log, -o, | tee — pick one and remember it for 250+ tools
  • You name files inconsistently across engagements
  • You forget which directory you’re in and write to the wrong place
  • You run the same scan with different flags and overwrite the first one
  • You’re juggling three engagements and mix up client data
  • | tee breaks the TTY — your tool loses colors and progress bars

These aren’t hypothetical. It’s just another Monday.

The Fix

cap netexec smb 10.10.10.0/24 -u admin -p 'Password1' --shares

That’s it. NOCAP captures the output, names the file netexec_smb_shares.txt automatically, routes it to the right engagement directory, preserves full terminal output (colors, progress bars, everything), and tells you where it went when it’s done.

No pipes. No thinking about filenames. No remembering directory structures.

Every capture starts with a structured header so you always know what generated the file:

Command: nmap -sCV 10.10.10.5
Date:    Mon Mar  3 14:30:52 EST 2026