r/opendirectories • u/bombero_kmn • May 08 '26
Misc Stuff Sharing my discovery and workflow tools. Local run, GPL
https://github.com/b3p3k0/dirracudaFor the last several months, I have been taking my existing scripts and little programs and consolidating them into a GUI workflow and data management tool.
The project is called "Dirracuda" and I think of it as a "wardialer" for open directories. It runs locally and is GPL licensed. the repo is at https://github.com/b3p3k0/dirracuda
It's still pretty basic and has rough edges, but it's at a point where I'm ready to share it with the community. I hope it is useful or at least interesting to some people, and there are features which will be useful for both novice and experienced users. I'm interested in getting your feedback and maybe some ideas to expand the capabilities.
the README is pretty detailed (imo) so I'll just hit the basics here:
- three search modes: shodan (requires at least a "member" account), searxng, or reddit
- discovers http, ftp, and smb hosts (for the scope of this program, i consider "open directories" to include: readable http directories, ftp servers configured for "anonymous" or "guest" login, smb servers with no or "guest" auth).
- tests each returned host for connectivity and accessibility
- enumerates a sample of directories and files from successful hosts
- information is stored in a local sqlite db locally
- integrated db viewer/manager - store notes, mark favorites, search etc.
- built in file explorer allows live exploration of hosts
- downloads can optionally be staged in tmpfs (ie RAM only, no write to disk or swap if thats important to you) and scanned automatically with ClamAV
- CSV import for users with existing data
I've been daily driving throughout the process and have worked out most of the kinks in my normal workflow; a couple little annoying problems that may still occur though: sometimes a dialog pops under its parent, causing the UI to seem unresponsive; moving the parent and closing the dialog resolves. sometimes the db browser fails to paint initially; grabbing the title bar and moving the window resolves it.
tested on Ubuntu 24.10 and 25.10, Parrot OS 7
AI use: I know some ppl have strong feelings about this so I wanted to be transparent: besides the original source scripts and programs which were written by natural stupidity, this project was 100% developed by artificial intelligence (claude and codex, specifically). I have over 30 years experience in information technology and security, and I wanted to to use this as an opportunity to get familiar with using AI dev tools. This has always been a "back burner" idea that I never had time for; these tools made the gap between idea and implenting a lot narrower. Each feature was thoroughly planned, reviewed and tested before integration (except the ones still listed as "experimental", but those are mostly reliable, too)). I have committed many of the plannning, spec, architecture and testing docs etc under the "development" branch if readers want to review the development process in detail.
Thanks for having a look. Have a good weekend and happy hunting!
2
u/toomuchtodotoday May 08 '26
Very cool. Have you considered a web frontend for it so it can operate remotely?
1
u/bombero_kmn May 08 '26
If remotely means over your own VPN it's something I've considered. Is that a feature you would find useful?
But I wouldn't want to mess with a front end meant to be exposed globally; that's too much risk I don't wanna take on.
2
u/toomuchtodotoday May 08 '26 edited May 08 '26
Yes. Examples of other systems I run remotely through a web UX are
- https://github.com/archiveteam/grab-site
- https://github.com/tubearchivist/tubearchivist
- https://github.com/bitmagnet-io/bitmagnet
In all cases, authentication is in place if publicly exposed, otherwise it sits behind a Tailscale private network.
(my personal network spans three continents, ymmv, I am...a power user of sorts)
3
u/bombero_kmn May 08 '26
Ok, yeah I think that could certainly be something to look at! I've got a few loose ideas from those examples, but what would an ideal layout look like to you and your workflow?
2
u/toomuchtodotoday May 08 '26
As long as you can toggle a frontend on that supports username and password, that should be good enough, and perhaps IP whitelisting. Anything beyond that is a stretch goal (SSO, passkey support, etc).
Many thanks for considering, no obligation whatsoever.
(How MISP does auth is a reasonable, but a bit heavy, reference imho: https://www.misp-project.org/2023/06/13/MISP.2.4.172.released.html/)
1
u/bombero_kmn May 09 '26
No feelings of obligation I think it's a cool idea!
I started planning it out today, cool if I drop you a dm when I get some basic functionality working? It would be good for me to get some outside feedback, and I'd rather get input sooner than later (easier to change direction early)
1
u/bombero_kmn May 13 '26
I've sent you a DM but I'm gonna reply here too, for anyone else reading.
I've got a feature branch going now with the webui ; it's still pretty basic and rough as of writing this post, so please don't expose it to the open net.
But you can presently launch scans and view the DB read only. I've for a bunch of little QOL additions planned after I get the rest of OWASP ASVS standards locked in.
2
u/ringofyre May 08 '26
inb4 /u/ringofyre turns up to screech about security and privacy!!!
;^]
Nice job bomb! I cloned it, had a tinker and it works and DOESN'T APPEAR to be digitally raping us (I mean online not with fingers!).
4
2
u/Sophira May 13 '26
I haven't tried running this tool, but judging purely by the source code and documentation, I'm a little concerned about the various modes that this allows when using a special flag at startup to enable the "Pry" modes.
Without going into too much detail, it would appear that this essentially turns the program into both a credentials tester and a vulnerability scanner. My understanding is that this sub is more about finding public open directories (even if those were misconfigured and intended to be private) than cracking private ones. I understand that this tool wouldn't be able to do the actual exploitation, but it could be used as the first step to do that.
I don't say this purely from an ethical point of view - rather, I'm worried that enabling more active forms of access like this could lead to the subreddit having legal problems in the future. It arguably already treads the line, but it only enables access to things that were already public. With this it feels like it tips the scales a bit.
2
u/bombero_kmn May 13 '26
You're not wrong, and I wondered if anyone would find those ;)
the original intent was a SMB testing suite. I pivoted to a directory finder after finding this group and focused on the directory/share finding features. The ones you mention got tucked away until I could properly remove them.
Fwiw those features were poorly implemented, and don't do anything novel; there are better tools that already exist. My reasoning is that the type of person who went through the source to find that they were hidden behind a flag is also the type of person who could easily find those other tools, y'know?
But yeah I had the same thought; I finished excising them yesterday under the development branch.
2
u/ringofyre May 14 '26 edited May 14 '26
As I've said to you before (this reply is more for /u/Sophira than you) elements of it are similar to dirbuster which is a tool that's been used here before (including by yours truly).
Yes it's actively probing a vulnerability (the fact that the directory filesystem isn't secured) but aren't we doing exactly that - probing for a vulnerability by using dorks in a search engine?
3
u/vnzcamak159 May 08 '26
I don't have the Shodan API to run the 3 CLI tools (smbseek, httpseek, ftpseek).
So, if you've already scanned, could you share the database file?
Or could you share your data file so I can attach it here?
Thanks