Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers.
| Date | Stars |
|---|---|
| 2026-07-24 | 854 |
| 2026-07-25 | 854 |
| 2026-07-28 | 854 |
| 2026-07-30 | 854 |
| 2026-08-06 | 854 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats (WebRTC). If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into the internal network behind the server. I developed this tool during a test of Cisco Expressway which resulted in some vulnerabilities: [https://firefart.at/post/multiple_vulnerabilities_cisco_expressway/](https://firefart.at/post/multiple_vulnerabilities_cisco_expressway/) To get the required username and password you need to fetch them using an out-of-band method like sniffing the Connect request from a web browser with Burp. I added an [example workflow](#example-workflow) at the bottom of the readme on how you would test such a server. # LICENSE This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-sa/4.0/ or send a letter to Creative Commons, PO Box 1866, Mountain View, CA 94042, USA. # implemented RFCs STUN: [RFC 5389](https://datatracker.ietf.org/doc/html/rfc5389) TURN: [RFC 5766](https://datatracker.ietf.org/doc/html/rfc5766) TURN for TCP: [RFC 6062](https://datatracker.ietf.org/doc/html/rfc6062) TURN Extension for IPv6: [RFC 6156](https://datatracker.ietf.org/doc/html/rfc6156) # Available Commands ## info This command will print some info about the stun or turn server like supported protocols and attributes like the used software. ### Options ```text --debug, -d enable debug output (default: false) --turnserver value, -s value turn server to connect to in the format host:port --tls Use TLS/DTLS on connecting to the STUN or TURN server (default: false) --timeout value connect timeout to turn server (default: 1s) --help, -h show help (default: false) ``` ### Example ```bash ./stunner info -s x.x.x.x:443 ``` ## range-scan This command tries several private and restricted ranges to see if the TURN server is configured to allow connections to the specified IP addresses. If a specific range is not prohibited you can enumerate this range further with the other provided commands. If an ip is reachable it means the TURN server will forward traffic to this IP. ### Options ```text --debug, -d enable debug output (default: false) --turnserver value, -s value turn server to connect to in the format host:port --tls Use TLS/DTLS on connecting to the STUN or TURN server (default: false) --protocol value protocol to use when connecting to the TURN server. Supported values: tcp and udp (default: "udp") --timeout value connect timeout to turn server (default: 1s) --username value, -u value username for the turn server --password value, -p value password for the turn server --help, -h show help (default: false) ``` ### Example TCP based TURN connection (connection from you the TURN server): ```bash ./stunner range-scan -s x.x.x.x:3478 -u username -p password --protocol tcp ``` UDP based TURN connection (connection from you the TURN server): ```bash ./stunner range-scan -s x.x.x.x:3478 -u username -p password --protocol udp ``` ## socks This is one of the most useful commands for TURN servers that support TCP connections to backend servers. It will launch a local socks5 server with no authentication and will relay all TCP traffic over the TURN protocol (UDP via SOCKS is currently not supported). If the server is misconfuigured it will forward the traffic to internal adresses so this can be used to reach internal systems and abuse the server as a proxy into the internal network. If you choose to also do DNS lookups over socks, it will be resolved using your local nameserver so it's best to work with private IPv4
Excerpt of 14,419 characters
Read on GitHub
140
60
13
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:1a70275983344479, topic:testing