Legions
EVM Node Security Toolkit
Legions is a handy toolkit for (security) researchers poking around EVM (Ethereum Virtual Machine) nodes and smart contracts, now with a slick command-line interface, with auto complete commands and history.
Features:
- Node detection (
getnodeinfo)- Detect the type of the Node, Chain, and Network
- Peer Count, Listening, Synching, and Mining status
- Gas Price
- etc
- Web3 API enumeration (
investigate)- Accounts
- Read coinbase, and exposed accounts of the node
- (
intrusive = True) will try to create accounts on the node
- Admin
- Enumerates web3.admin endpoints
- Sign (WIP)
- Enumerates signing functionalities (web3.sign)
- Accounts
- ENS Queries (
ens)- List Names owned by an address
- List Subdomains of an address
- Query individual names
- Query at latest/specific block number (
query)- Balance of an address
- Block details
- Bytecode of the smart contract
- Read storage of the smart contract (default
count=10reads the first 10 slots) - command, which you can pass any RPC method with args
- ECRecover of a signature
- Conversions (toWei, fromWei, keccak, toChecksumAddress, etc)
This tool is in beta and a work in progress
Demo
Main Functionality
ENS (Ethereum Name Service)
Installation
Require Python 3.6.
pip install legions
Or directly from source code:
git clone https://github.com/shayanb/Legions
cd Legions
pip install .
Usage
If installed locally:
python legions.py
or if installed globally:
legions
Functions Breakdown
| Command | [Subcommand] | Description |
|---|---|---|
| sethost | Setup the Web3 connection (RPC, IPC, HTTP) (default to infura mainnet) | |
| getnodeinfo | Information about the connected node (run setnode before this) |
|
| conversions | Conversions possible to do with Web3 | |
| fromWei | Converts the input to ether (to currency default to ether) |
|
| toWei | Converts the input to Wei (from currency default to ether) |
|
| keccak | keccak hash of the input | |
| toBytes | Converts the input to hex representation of its Bytes | |
| toChecksumAddress | Converts the input to Checksum Address | |
| toHex | Converts the input text to Hex | |
| fromWei | Converts the input to ether (or specified currency) | |
| query | Query Blockchain (Storage, balance, etc) | |
| balance | Get Balance of an account | |
| block | Get block details by block number | |
| code | Get code of the smart contract at address | |
| ecrecover | Get address associated with the signature (ecrecover) BUGGY |
|
| storage | Read the storage of a contract (count default = 10) |
|
| command | Manual RPC method with args | |
| investigate | Investigate further in the node (e.g. check if accounts are unlocked, etc) | |
| accounts | Investigate accounts (e.g. check if accounts are unlocked, etc) | |
| admin | Investigate accounts (e.g. functionalities under the admin_ namespace) | |
| sign | Investigate signature functionalities | |
| ens | Do Ethereum Name Service queries (supported on the mainnet only) | |
| toName | Transform an address to the ENS name | |
| toAddress | Transform an ENS name to the Ethereum public address | |
| info | Get details about an ENS name | |
| version | Print Versions (If connected to a node it will print the host version too) |
Acknowledgements
- Interactive shell: python-nubia
- Web3.py
- Node data provided by chainid.network
- ENS data provided by ENS GraphQL dataset
TODO:
- eth 2.0 API implementation
- Fix
VerboseStatus bar (It does not change fromOFF) - inline TODOs (tons)
- resolve mappings from storage (using ABI?)
- Get tokens Balance (etherscan or other explorer API)
2 maintainers
Release files for legions 0.8.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| legions-0.8.4.tar.gz | 19.5 kB | Details |
Built distributions (wheels)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| legions-0.8.4-py3.8.egg | Legacy Egg format | - | - | Details |
| legions-0.8.4-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 75.9 kB
Release files / legions-0.8.4.tar.gz
| Download URL | legions-0.8.4.tar.gz |
|---|---|
| Size | 19.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a9a039476dcaf4ad62bf2e44c77554c6bd148b35bf38e73b125697f3a6eafdb4
|
|
BLAKE2b-256 checksum How to use checksums |
b06e7c03e06d4051730dad35e0acc0feeb17294bc49bbdcd298c041bf3364050
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.2.0 pkginfo/1.5.0.1 requests/2.23.0 setuptools/49.1.0 requests-toolbelt/0.8.0 tqdm/4.47.0 CPython/3.8.1
|
Release files / legions-0.8.4-py3.8.egg
| Download URL | legions-0.8.4-py3.8.egg |
|---|---|
| Size | 36.7 kB |
| Tags | Egg |
|
SHA-256 checksum How to use checksums |
4d51b24afb2c60dcbb318a3c9d37c9e8764a0f1c82929f5c9eb81eb52d5c551e
|
|
BLAKE2b-256 checksum How to use checksums |
b73c70760590bd867673960f8148e26966b46af1b9ec700244ffb40d71c12b3d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.2.0 pkginfo/1.5.0.1 requests/2.23.0 setuptools/49.1.0 requests-toolbelt/0.8.0 tqdm/4.47.0 CPython/3.8.1
|
Release files / legions-0.8.4-py3-none-any.whl
| Download URL | legions-0.8.4-py3-none-any.whl |
|---|---|
| Size | 19.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
8717c0c46c3dc4d357ab29c30af46a144dce58772302ec73859f8ad2fded978c
|
|
BLAKE2b-256 checksum How to use checksums |
054f9e374d1d7bedfe2238b924ff7dee1af8634e810af4700bc30574339b4769
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.2.0 pkginfo/1.5.0.1 requests/2.24.0 setuptools/49.1.0 requests-toolbelt/0.9.1 tqdm/4.46.1 CPython/3.7.7
|
