iwa-tools README

The project's README from github.com/CICADA8-Research/iwa-tools. As one markdown file: README.md.

iwa-tools

TL;DR

Check out the demo on this site!

изображение

Description

Chrome has an experimental API called Direct Sockets that gives raw TCP/UDP to "Isolated Web Apps" — signed, installed web apps that live under isolated-app://<key>/. It exists so people can build things like SSH clients and databases inside the browser without a native shim. It also happens to be perfect for offensive AD tooling.

This is a bunch of pentesting utilities on top of that. Everything runs inside a signed .swbn that Chrome installs, and speaks SMB / LDAP / DCE-RPC / WinRM / Kerberos / MSSQL / ADWS from a browser tab.

Written for OFFZONE 2026 — talk "Living off the Browser".

Use only against systems you own or have explicit written permission to test.

Screenshots

The main console — one prompt, all tools. Here it's running portscan → adidns (Kerberos + LDAPS + channel binding) → certify find:

iwa-tools console

Or install each tool as its own IWA if you'd rather have a GUI than a console:

Standalone apps

What's in it

Tool What it does
nxc (netexec) The netexec port. SMB · LDAP · WinRM · MSSQL · SSH · FTP · RDP · VNC
adidnsdump Dumps AD-integrated DNS zones over LDAP
sharphound BloodHound collector — LDAP + SMB flavour
soaphound BloodHound collector — ADWS flavour (port 9389, quieter than LDAP)
certipy AD CS: ESC1-15 discovery, cert requests, PKINIT → TGT + UnPAC-the-hash
ldap-shell Interactive LDAP — DACL, RBCD, Shadow Creds, gMSA, password reset, all the fun stuff
evil-winrm Remote PowerShell over WinRM (HTTP/HTTPS)
portscan Plain TCP connect scanner

The protocol stacks are hand-written JS. NTLMv2 with signing and sealing, Kerberos AES256, pass-the-hash, pass-the-ticket, PKINIT, and channel binding (tls-server-end-point) for LDAPS / WinRM EPA on locked-down DCs.

TLS goes through rustls compiled to WASM (tls-wasm/) — that was way easier than writing a from-scratch TLS 1.3 stack in JavaScript.

Building

You need Node.js. Chrome ≥ 128 for install.

Enable these three flags at chrome://flags/#... and relaunch Chrome afterwards (otherwise nothing works):

Then:

git clone https://github.com/CICADA8-Research/iwa-tools && cd iwa-tools
make                       # build every tool
# or:  make iwa-tools      # just the combined console

Open chrome://web-app-internals, find Install IWA from Signed Web Bundle, paste the full path to iwa-tools/dist/iwa-tools.swbn, hit Install. It shows up in chrome://apps and the system launcher.

Rebuilds don't auto-update — you have to hit Perform update now on the same page. That's a Chrome quirk.

Using it

The console has a help command. help <tool> for a specific one. If you've used netexec / crackmapexec, most of this will feel familiar:

nxc smb 10.0.0.0/24 -u admin -d corp.local -p PASSWORD --shares
nxc smb dc01 -u admin -d corp.local -p PASSWORD --dcsync             # everyone
nxc smb dc01 -u admin -d corp.local -p PASSWORD --atexec whoami
nxc ldap dc01 -u admin -d corp.local -p PASSWORD --kerberoast
nxc winrm dc01 -u admin -d corp.local -p PASSWORD -x hostname
nxc mssql db01 -u sa -p PASSWORD --query 'SELECT @@version'
certipy find -H dc01 -u admin -d corp.local -p PASSWORD --tls
certipy req  -H dc01 -u lowpriv -d corp.local -p PASSWORD \
             --cahost ca01 -ca corp-CA -t VulnerableTemplate -upn [email protected]
certipy auth -k dc01 -pfx loot/certipy/…pfx
sharphound -H dc01 -u admin -d corp.local --collection Default --tls
ldap-shell -H dc01 -u admin -d corp.local --tls

Files (ccache/kirbi, wordlists, results) live in an in-memory store — there's a Files tab in the UI for upload/download. Then any command that takes --ticket <path> or @path for arg interpolation picks them up.

What doesn't work (yet)

Development

make test             # per-tool unit tests
make clean            # drop dist/
make distclean        # also drop node_modules/
make keygen-<tool>    # regenerate signing key — CHANGES the app origin

The signing key is Ed25519 per tool, generated on first build. The public key becomes the app's isolated-app://<key>/ origin, so regenerating a key means the app installs fresh — Chrome treats it as a different app entirely.

License

MIT. See LICENSE.

iwa-tools (CICADA8-Research/iwa-tools)

Searching Database…

146 ·GitHub
Iwa-tools
What is this?iwa-tools is an offensive security toolkit that runs inside Chrome as an installed Isolated Web App, letting you speak SMB, LDAP, DCE-RPC, WinRM, Kerberos, MSSQL and ADWS directly from a browser tab for Active Directory pentesting.
Is it a browser extension?No — it is an Isolated Web App, a signed .swbn bundle that Chrome installs like a native app via its experimental Direct Sockets API for raw TCP/UDP, not a regular extension.
What do I need to build and run this?Just Node.js to build it, and Chrome 128 or newer with the three experimental flags enabled to install and use it.
What doesn't work yet?nxc smb --wmi isn't implemented because the DCOM NDR marshalling isn't done (use nxc winrm --wmi instead), and full ntds.dit parsing isn't supported — it only downloads the raw hive files and points you to secretsdump.py locally.
Does it run on any OS with Chrome?Yes — since it is an Isolated Web App rather than native code, it runs wherever Chrome 128+ runs, on Windows, macOS, or Linux.
What's inside the toolkit?It bundles a netexec-style multiprotocol client (SMB/LDAP/WinRM/MSSQL/SSH/FTP/RDP/VNC), adidnsdump, sharphound and soaphound BloodHound collectors, certipy for AD CS abuse, an interactive ldap-shell, evil-winrm, and a plain TCP portscan — all hand-written JS reimplementations.
How are the network protocols implemented in JavaScript?The author hand-wrote the protocol stacks in JS, including NTLMv2 signing/sealing, Kerberos AES256, pass-the-hash/pass-the-ticket, PKINIT and TLS channel binding, with TLS itself handled by rustls compiled to WASM.
Why was this built?It was written for the OFFZONE 2026 talk 'Living off the Browser,' showing that AD attack tooling can run entirely from a signed, installed browser tab instead of a native implant.
What happens if I rebuild the app?Each build generates a fresh Ed25519 signing key per tool; since the public key becomes the app's isolated-app:// origin, Chrome treats a rebuilt app as an entirely new, separate app.
What are similar projects?Claude-Red, Decepticon, CVE-2026-62911, xray, ARTEX, Sn1per, 404StarLink, Claude-AD
Which topics is it in?hacking-tools, red-teaming, network-security, chrome, offensive-security, red-team, penetration-testing, wasm, cybersecurity, security-tools, browser, security
Creator
CICADA8-Research
Size
1.4 MB
Stars
146
Updated
CommitAug 27
Age
1mo
Commits · 90 Days