iwa-tools: Offensive Tools for Active Directory Directly Inside Chrome

iwa-tools: Offensive Tools for Active Directory Directly Inside Chrome

The CICADA8 Research team has published iwa-tools, a collection of Active Directory penetration-testing tools that run directly inside Google Chrome without a native shim.

The project is based on Isolated Web Apps (IWAs) and Chrome's experimental Direct Sockets API. Unlike ordinary web applications, IWAs can get raw TCP/UDP access. The authors used this capability to implement protocol stacks capable of speaking SMB, LDAP, DCE/RPC, WinRM, Kerberos, MSSQL, and ADWS directly from an application installed in Chrome. The tools run inside signed .swbn bundles installed by Chrome as Isolated Web Apps. They can be used through the unified iwa-tools console or installed individually as standalone IWAs.

What's included in iwa-tools • nxc — a port of NetExec supporting SMB, LDAP, WinRM, MSSQL, SSH, FTP, RDP, and VNC. • adidnsdump — dumping AD-integrated DNS zones over LDAP. • sharphound — BloodHound collection via LDAP and SMB. • soaphound — BloodHound collection via ADWS. • certipy — AD CS ESC1–15 discovery, certificate requests, PKINIT, and UnPAC-the-hash. • ldap-shell — operations involving DACLs, RBCD, Shadow Credentials, gMSA, and password resets. • evil-winrm — remote PowerShell over WinRM. • portscan — a TCP connect scanner. What's particularly interesting is that the protocol stacks are hand-written in JavaScript. The project implements NTLMv2 with signing and sealing, Kerberos AES256, Pass-the-Hash, Pass-the-Ticket, PKINIT, and channel binding for LDAPS and WinRM EPA. For TLS, it uses rustls compiled to WebAssembly.

In effect, Chrome becomes a platform for AD tooling: Chrome → Isolated Web App → Direct Sockets → SMB / Kerberos / LDAP / DCE-RPC / WinRM → Active Directory .ccache and .kirbi files, wordlists, and results can be stored in the application's internal in-memory storage.

There are limitations as well: WMI via DCOM for nxc smb has not yet been implemented, and there is no full ntds.dit parsing inside the browser. The module downloads the raw hive files but relies on a local secretsdump.py to parse them. With sufficient privileges, NT hashes can instead be obtained via DCSync.

The project was created for the “Living off the Browser” talk at OFFZONE 2026 and demonstrates an unusual approach: the browser becomes not merely an interface to an external offensive toolkit, but the execution environment itself.

Tool: https://github.com/CICADA8-Research/iwa-tools