Living off The Browser: Running Popular Hacking Tools Inside Chrome

What it is

The IWA (Isolated Web App) bundle is a signed Chrome application installed via https://iwa-tools.pkilla.pw/iwa/update.json, exposing an in-browser console (iwa >) that runs the nine bundled tools as console commands with direct network access from the browser.

Preconditions / Affected

Requires enabling specific Chrome flags and relaunching Chrome; install happens through the chrome://web-dev surface (the page notes this moved from the older web-app-internals location in recent Chrome versions, so instructions tied to the old name will not work). The author explicitly warns not to use a daily-driver Chrome profile for this.

What to do

Setup and usage sequence, reproduced from the lab walkthrough:

# After enabling flags and relaunching Chrome, open chrome://web-dev
# Install the bundle via:
https://iwa-tools.pkilla.pw/iwa/update.json

# Inside the installed iwa-tools console:
iwa > help
iwa > command -h

# Port scan a target for common AD ports
iwa > portscan IP 88,389,445,5985,9389 --timeout 2000

# If Kerberos/LDAP/WinRM are open, attempt remote access
iwa > evil-winrm -H IP -u user -p password

# Enumerate DNS zones
iwa > adidns -H IP -u user -d domain -p password --auth kerberos --tls --list

# Check ADCS templates for ESC1 exposure
iwa > certipy find -H IP -u user -d domain -p password --tls -enabled

The interpretation step the summary doesn't spell out: open Kerberos (88) + LDAP (389) + WinRM (5985) on a host identifies it as a domain controller reachable for remote admin access, and that's the pivot point before moving to DNS enumeration and the Certipy ESC1 check.

Caveats

The page is a vendor-style walkthrough (links to the author's own Red Team Operator training) rather than an independent security advisory — there's no discussion of the IWA's code provenance, update/signing trust model, or what "signed" means in this context beyond Chrome accepting the install.