Pentesting: Twelve Caesars – Community Tools for Offensive Security

What it is

Praetorian's "12 Caesars" is a series of open-source offensive tools from its red team, with one tool planned per week for twelve weeks. Each is a Go single binary with no external dependencies. The page covers four: Titus (secret scanning), Nerva (service fingerprinting), Brutus (credential guessing) and Julius (LLM service fingerprinting). It also says Titus ships as a Burp Suite extension and a Chrome extension.

How it works

Titus scans source code, files, git history and container images with 487 rules. Like TruffleHog, it validates a finding by calling the provider's API. Nerva takes open ports from naabu, nmap or similar and reports the service and version, across TCP, UDP and SCTP. Brutus is designed to take Nerva or naabu output, so Nerva results can feed password testing across a whole estate. Julius probes a URL, identifies the AI service (Ollama, vLLM, LiteLLM, LocalAI, Hugging Face TGI, AWS Bedrock, AnythingLLM) and can list the models it exposes.

What to do

Commands as shown on the page, run from Kali:

curl -sL -o titus https://github.com/praetorian-inc/titus/releases/latest/download/titus-linux-amd64
./titus --help

curl -sL -o nerva.tar.gz https://github.com/praetorian-inc/nerva/releases/download/v1.70.3/nerva_1.70.3_linux_amd64.tar.gz
tar --no-same-owner -xzf nerva.tar.gz
./nerva -t 192.168.131.9:22,11434

curl -sL -o brutus.tar.gz https://github.com/praetorian-inc/brutus/releases/latest/download/brutus-linux-amd64.tar.gz
tar --no-same-owner -xzf brutus.tar.gz
./brutus creds --target 127.0.0.1:22 --protocol ssh "admin:admin"

curl -sL -o julius.tar.gz https://github.com/praetorian-inc/julius/releases/download/v1.5.1/julius_1.5.1_linux_amd64.tar.gz
tar --no-same-owner -xzf julius.tar.gz
./julius list
./julius probe http://192.168.131.7:11434

Pinned versions on the page are Nerva v1.70.3 and Julius v1.5.1. Titus and Brutus use the latest release URL. Each subcommand has its own help, for example ./brutus creds --help.

For defenders, the page's one concrete finding is that an Ollama instance on port 11434 reachable from outside lets anyone use its models without authentication. Julius is a quick way to check hosts for this. The page also recommends regular secret checks, since leaked keys can sit in repositories for years.

Caveats

The page only runs Titus against Truffle Security's published test keys, and the other tools against lab hosts. It gives no output samples, performance figures or comparison with Hydra beyond calling Brutus an alternative. It tells readers to test only systems they own or have written authorization to test. Its examples run chmod 777 on the binaries, which is broader than needed. Because Titus validates by calling provider APIs, running it on real secrets sends them to those providers, a point the page does not discuss.