Skip to content

Instantly share code, notes, and snippets.

@jesusprubio
Last active April 12, 2023 15:02
Show Gist options
  • Save jesusprubio/8f092af4ca252e252eab to your computer and use it in GitHub Desktop.
Save jesusprubio/8f092af4ca252e252eab to your computer and use it in GitHub Desktop.
Proposal: A Node.js penetration test framework

Proposal: Node.js penetration test framework

Hi guys! Since I started to write Bluebox-ng I've been tracking the different security projects I found written in Node.js. Now we've published the first stable version we think it's the right moment to speak among us (and, of course, everyone interested in it :).

Why?

  • I think we're rewriting the same stuff in our respective projects again and again. For example, almost any tool supports IPv6 because the functions we need are still not present in the Node core and the libraries I found (IMHO) were not enough.
  • There're different projects implementing exactly the same thing, ie: port scanners.
  • We're working in a too new environment, so we need to make it together.
  • Our 2 cents to make Node still more awesome. Now we have io.js whose main idea is to gain commiters.

To clarify: We've NO interest in keeping the project name or something similar, our only idea is to code in a bigger community.

@sergiogr
Copy link

If I had to pick only one I would go for assault.js, but I like warfare.js as well. My third option would be ninja.js which would be easier to design a logo for, but it's also more generic, I think.

@vertexclique
Copy link

Guys, there is already a project with that name btw http://ninjaui.com/

@jesusprubio
Copy link
Author

Hi, I've published a draft of the future web. I've used the most voted name for now. It's implemented using Polymer. I think I've already added all interested one projects. Ideas? :)

https://jesusprubio.github.io/

@Random1984
Copy link

I think assault.js is the coolest name it could have.

@jesusprubio
Copy link
Author

I aggree, I think we have a name. See you on #assaultjs at Freenode :). New links:

@jpenalbae
Copy link

Does this fit somewhere within the project?

https://gist.github.com/jpenalbae/80b697dc25b5ec4ac8dd

@jonatanrdsantos
Copy link

LOL, just now I see this, good name.

@ellerbrock
Copy link

ellerbrock commented Jun 8, 2016

hey guys,

is the project still active? i would love to join in! I basically had the same plan to write some pentesting stuff in node but was looking for few people to join. you can get in touch with me on gitter: https://gitter.im/frapsoft/penetration-testing ...

@cpruijsen
Copy link

👍 on the above - are we still alive? Would be cool to get involved.

@SJCaldwell
Copy link

This still active?

I'd be interested in contributing!

@maikelSec
Copy link

Is this still happening ?

@pdparchitect
Copy link

Hi everyone,

I am surprised to see this community page. It is awesome!

I started a nodejs security project called pownjs. You can learn more about what it is and the philosophy behind it over here https://github.com/pownjs/pown.

So far I have contributed a few modules including a LMNR spoofer, simple captcha breaking tool, pcap2 based sniffing tool, offline hacking tips browser and a few more modules. I am also toying with many ideas that I would like to eventually implement such as UPNP discovery and hacking toolkit, a proxy, arp spoofing etc, TV hacking toolkit, web security tools, recon tools, more responders (mdns, dns, dhcp etc), exploit development modules, etc.

I would love to get your opinion and also, if interested, get you involved.

The best part is that pownjs is decentralised project because it is based around npm and practically anyone can make their own distributions of the toolkit. This is part of the philosophy - i.e modules are framework agnostic and everyone is a contributor even the indirectly sometimes (check $ pown credits to see).

Let me know if you have any questions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment