iwa-tools: offensive Active Directory tooling built as Chrome Isolated Web Apps, presented by CICADA8.

OFFZONE 2026 · 0 dependencies · 0 native binaries

Offensive AD tradecraft
in a browser tab

A suite of Active Directory attack tools built as Chrome Isolated Web Apps. Raw TCP straight from a signed web app via the Direct Sockets API — no loader, no PE, no third-party libraries. Kerberos, TLS and DCE-RPC hand-rolled in JavaScript.

Install now Explore the toolkit
9
tools, one signed IWA
8
network protocols
8
DCE-RPC interfaces
0
runtime dependencies
// why it's different

Living off the browser

Chrome's Isolated Web App + Direct Sockets model turns a signed web bundle into an offensive toolkit.

◱

Browser-native delivery

Ships as a signed .swbn web bundle, installed as an Isolated Web App. Nothing lands on disk as an executable.

⚿

Crypto, hand-rolled

Full Kerberos 5 (AS/TGS, AES256 & RC4, overpass-the-hash, PKINIT), NTLMv2 and GSS sign+seal — pure JavaScript ports of impacket.

⛨

TLS compiled to WASM

rustls built to WebAssembly gives real LDAPS / HTTPS — with channel binding to survive DCs that enforce EPA.

⧉

Multi-protocol

NetExec-style SMB, LDAP, WinRM, MSSQL, SSH, FTP, RDP, VNC — credential spraying, enumeration, command execution, SAM/LSA dump.

// the toolkit

Nine tools, one console

Each builds to its own signed IWA — or run them all from the unified iwa-tools pseudo-terminal with inline arguments, help and tab-completion.

netexec / nxc8 protocols

Multi-protocol pentesting — SMB/LDAP/WinRM/MSSQL/SSH/FTP/RDP/VNC. Spraying, shares, exec, DCSync, SAM/LSA dump.

sharphoundLDAP + SMB

BloodHound CE collector — DCOnly over LDAP and host-based collection over SMB/RPC (local groups, sessions).

soaphoundADWS 9389

SOAPHound — collects BloodHound / ADCS / ADIDNS data over ADWS.

certifyLDAP + ICPR

AD CS audit — find ESC1–ESC15, request certs via MS-ICPR, authenticate via PKINIT, recover NT hash (UnPAC).

evil-winrmWinRM

Interactive WinRM PowerShell shell.

ldap-shellLDAP(S)

LDAP shell — add users/computers, group edits, RBCD, SPN, LAPS, password reset.

adidnsLDAP 389/636

ADIDNSDump — dumps AD-Integrated DNS, including hidden node records, over LDAP(S).

portscanraw TCP

nmap-style TCP connect scanner — IP / CIDR / octet ranges, concurrent probes, open ip:port out.

// no library exists — so we built the stack

SMB2 → DCE-RPC → BloodHound

There is no browser library for SMB + DCE-RPC. So the whole chain is hand-written over Direct Sockets: signed SMB2 sessions, NDR marshalling, and eight RPC interfaces — all validated live against a DC.

\samr · SAMR
LocalAdmins / RID brute
→
\lsarpc · LSAT
SID → name/type
→
\srvsvc · SRVSVC
Shares / Sessions
→
\wkssvc · WKSSVC
Logged-on users
→
\winreg · WINREG
RegistrySessions
\svcctl · SVCCTL
Command execution
→
\drsuapi · DRSUAPI
DCSync replication
→
\efsrpc · ICPR
Certificate requests
// under the hood

The stack

Everything from ASN.1 to AES to NDR is bundled into the signed app.

Isolated Web Apps Direct Sockets TCPSocket Kerberos 5 AES/RC4 NTLMv2 + CBT GSS-API sign+seal PKINIT + UnPAC rustls → WASM TLS 1.3 LDAP v3 / paged / SD-flags ADWS NMF/NNS SMB2 signed sessions DCE-RPC / NDR DRSUAPI DCSync SVCCTL smbexec BloodHound CE JSON rollup + wbn-sign
Install now ↑ Back to top
// get started

Install

Three steps to get iwa-tools running in Chrome browser. No build tools, no npm — just flags and a URL.

ENABLE CHROME FLAGS

Open each URL in Chrome and set the flag value. Relaunch Chrome after all three.

  • chrome://flags/#enable-isolated-web-apps → Enabled
  • chrome://flags/#enable-isolated-web-app-dev-mode → Enabled
  • chrome://flags/#local-network-access-check → Disabled
Relaunch Chrome for changes to take effect.

INSTALL FROM UPDATE MANIFEST

Open chrome://web-app-internals and paste the manifest URL into Install IWA from Update Manifest:

https://iwa-tools.pkilla.pw/iwa/update.json

LAUNCH

The app appears in chrome://apps and the system app launcher. Open it — you're in the pseudo-console. Type help to see all tools.

Questions or issues? Reach out on Telegram: @pkilla