custom-oscp-tooling — Updated!
OSCP-focused toolkit for read-only network, SMB, AD, DNS, web, and database enumeration; privesc scanning, hash identification, and payload/credential command generation.
Custom OSCP Tooling
A consolidated set of read-only, OSCP-exam-safe custom tools by Samson Laird. Everything here enumerates, identifies, and advises. Nothing here exploits, sprays, or modifies a target.
The problem this solves
OSCP exam and lab work is a list of disconnected one-liners: nmap here,
enum4linux there, a BloodHound-ish scan somewhere else. These tools
wrap that into one read-only suite where each tool does one enumeration job
and the obi.py advisor ties the findings to next commands. Every tool is
exam-safe by contract: enumerate, identify, advise. None of them modify,
spray, or exploit a target, which keeps the whole suite legal inside OSCP
exam scope.
Tools
| Tool | What it does | Class |
|---|---|---|
cantina.py | Network recon orchestrator: port discovery, service classification, enum-plugin dispatch. | Enum / orchestration |
ackbar.py | AD enumeration in one script. BloodHound + PowerView style output, no graph DB. | AD enum |
bobafett.py | Database service enumerator. Auth tests + read-only SELECT only. | DB enum |
jarjar.py | HTTP service scanner with verbose logging + Rich TUI report. | Web enum |
jawa.py | SMB enumeration with clean output (enum4linux replacement). | SMB enum |
leia.py / leia.ps1 / leiAD.ps1 | Universal privesc scanner. Detects OS, runs the right checks. | PrivEsc enum |
maul.py | DNS enumeration. Pure Python, no external deps. | DNS enum |
obi.py | Context-aware attack advisor. Reads findings, matches technique library, prints next commands. | Advisor |
yoda.py | Hash identification + hashcat command generation + *2john wrappers. | Hash ID |
jedi.nse | Nmap NSE script (service enum). | NSE |
blaster/ | OSCP payload factory (payload + listener + hosting + download cmds). | Payload factory |
chewie/ | On-host Windows domain enumerator (transfer to compromised box). | AD enum |
order66/ | Multi-protocol AD credential sprayer (password-first strategy). | Credential logic |
vader/ | Port-to-playbook lookup engine. Feed nmap output or ports, get playbooks. | Lookup |
xwing/ | ADCS exploitation assistant. Walks Ackbar/Certipy findings. | ADCS assistant |
Safety contract
Every tool is read-only where it claims to be. No tool here:
- Modifies, creates, or deletes AD objects, files, or shares
- Cracks hashes itself (identification + command generation only)
- Auto-runs credential sprays (order66 generates the sequence; you run it)
- Executes system commands against a target
Run against authorized targets and your own lab / OSCP exam scope only. You are responsible for scope.
Requirements
- Python 3.10+
- Kali (or similar) tools when available:
nmap, plus service tools plugins call - Soft deps only: missing tools are skipped, not fatal
Quick start (Cantina)
# list plugins (no scan)
python tools/cantina.py --list-plugins
# single host
python tools/cantina.py 10.10.10.5 -t quick
# multi-target concurrent
python tools/cantina.py -T hosts.txt -t all --max-workers 3 --timeout 90
Tests
pip install -e ".[dev]" # or: pip install pytest
python -m pytest tests/ -q
# expect: exit 0
Layout
tools/ CLI tools (run with: python tools/<tool>.py)
cantina.py CLI + orchestrator
cantina_plugins.py discover / select / run
ackbar.py ... Star Wars custom OSCP tools
plugins/ service enum plugins
blaster/ chewie/ order66/ vader/ xwing/
assets/banner.txt CLI terminal banner
banner.jpg README hero image
tests/ unit tests (stubbed tools)
lab/ optional multi-service lab ground truth
fixtures/ nmap parse fixtures
License
MIT. See LICENSE.