Which of the following hacking tools provides shell access over ICMP?

John the Ripper is a password cracking tool used to perform dictionary and brute-force attacks against hashed credentials, not a tool for establishing shell access over any protocol.

Nmap is a network scanning and host discovery tool used to enumerate open ports and services, not a tool for providing remote shell access.

Nessus is a vulnerability assessment scanner that identifies security weaknesses on target systems and does not provide shell or command-execution capability.

Loki encapsulates shell commands and their output inside ICMP echo request and reply packets, allowing an attacker to maintain covert remote shell access on a compromised host. Because many firewalls allow ICMP traffic to pass without deep inspection, Loki effectively bypasses network-layer controls that block TCP/UDP-based backdoors. This makes it a classic example of protocol-based covert channel exploitation.