IT-Tools is one of the most widely deployed self-hosted collections of developer and IT utility tools, offering over 100 operations including cryptographic hashing, JWT decoding, network calculators, encoding/decoding utilities, and format converters. Its security relevance comes from two angles: IT-Tools runs without any authentication by default — all 100+ tools are accessible to any user who can reach the instance, which is a problem both for controlling who uses the tools and for what can be accomplished with an open instance; specific IT-Tools operations make outbound requests or process user-supplied URLs — the fetch tool, any tool that validates external resources, or tools that accept URLs as input can create SSRF vectors depending on the server-side processing involved; and IT-Tools deployed on internal developer networks serves as a convenient toolset for an attacker who gains internal network access, providing immediate access to JWT decoders, hash crackers, base64 decoders, and format converters without needing to install any tools. This guide covers systematic IT-Tools security assessment.
# IT-Tools — all tools accessible without authentication by default
ITTOOLS_URL="https://tools.example.com"
# Check if authentication is required (404 = not found, 200 = accessible)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${ITTOOLS_URL}/" 2>/dev/null)
echo "Homepage status (no auth): ${STATUS}"
# IT-Tools is a Vue.js SPA — check the main app bundle for tool list
curl -s "${ITTOOLS_URL}/" 2>/dev/null | grep -o '"path":"[^"]*"' | head -20
# List available tool routes from the manifest or bundle
curl -s "${ITTOOLS_URL}/manifest.json" 2>/dev/null | python3 -c "
import json,sys
try:
d=json.load(sys.stdin)
print(f'App: {d.get(\"name\")} version={d.get(\"version\")}')
except: pass
" 2>/dev/null
# Key tools to test for operational impact on an internal network:
# /jwt-parser — decodes JWTs, useful for extracting claims from intercepted tokens
# /base64-string-converter — decodes base64-encoded credentials and configuration
# /hash-text — hash/verify operations for credential testing
# /regex-tester — test regular expressions without installing tools
# /json-diff — compare configuration files without installing diff tools
# /ip-subnet-calculator — network calculation that may be useful for internal recon# IT-Tools sensitive tool categories for security assessment
ITTOOLS_URL="https://tools.example.com"
# 1. JWT Parser — accessible without auth, decodes any JWT for header/payload inspection
# Useful for attackers who have intercepted JWT tokens and want to analyze claims
# Note: IT-Tools JWT parser does NOT verify signatures — it only decodes the payload
curl -s "${ITTOOLS_URL}/jwt-parser" -o /dev/null -w "JWT parser status: %{http_code}\n" 2>/dev/null
# 2. Check if IT-Tools has any server-side API endpoints (depends on deployment/version)
# Some IT-Tools features (like HTTP client tools) may make server-side requests
curl -s "${ITTOOLS_URL}/api/" -o /dev/null -w "API endpoint status: %{http_code}\n" 2>/dev/null
# 3. Hash text tool — accessible without auth, enables offline-style hash operations
# Can be used to generate hashes for brute force testing without installing hashcat locally
curl -s "${ITTOOLS_URL}/hash-text" -o /dev/null -w "Hash tool status: %{http_code}\n" 2>/dev/null
# 4. Test for any proxy or URL-fetching endpoints
# IT-Tools' "Fetch" tool or any server-side URL validation would create SSRF
for ENDPOINT in "/api/fetch" "/api/proxy" "/api/url-check" "/fetch"; do
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${ITTOOLS_URL}${ENDPOINT}" 2>/dev/null)
echo "Endpoint ${ENDPOINT}: ${STATUS}"
done| Security Test | Method | Risk |
|---|---|---|
| All 100+ tools accessible without authentication | GET / without credentials — all tools including JWT parser, hash tools, base64 decoder, network calculators, and format converters are accessible to any user who can reach the instance | Medium |
| JWT decoder without signature verification | GET /jwt-parser — decodes any JWT without verifying the signature; enables rapid inspection of intercepted JWTs for claims, expiry, and algorithm without needing local tooling | Medium |
| Server-side URL fetching (version-dependent) | POST to any server-side fetch/proxy endpoint — if IT-Tools deployment includes server-side request capabilities, user-supplied URLs may trigger SSRF to internal services and cloud metadata endpoints | High (if present) |
| No rate limiting on resource-intensive operations | Hash generation, base64 decode, format conversion — no per-IP or per-session rate limiting; repeated intensive cryptographic operations could affect server resources | Low |
| Internal network service discovery via tool access | An internal IT-Tools instance confirms the presence of a developer environment; the tool categories available reveal what operations are routinely performed (JWT work, subnet calculation, format conversion suggests specific technology stack) | Low |
Ironimo tests IT-Tools deployments for unauthenticated access to all developer utility tools, server-side URL fetching capabilities that create SSRF vectors, JWT decoder availability for token analysis without local tools, hash generation tools accessible without credentials, network calculator features, and the presence of any server-side API endpoints that process user-supplied input.
Start free scan