anubis is a cross-platform, MIT-licensed terminal and remote-access workspace that bundles SSH, SFTP, RDP, VNC, and related protocols for authorized administration and security research.
| Tool | Anubis-Security-Tool/anubis — open-source cross-platform desktop workspace for terminals, remote access, and security automation |
| Category | Electron-based terminal / remote-access client with a modular security ecosystem |
| Primary Use | Managing SSH, SFTP, FTP, RDP, VNC, SPICE, Telnet, and Serial sessions through connection profiles, quick commands, and file transfers |
| Safe Use | Intended for system administrators, security researchers, and DevSecOps teams connecting exclusively to systems they are authorized to access; suitable for labs, enterprise administration, and authorized assessments |
| Telemetry Note | As a client tool, anubis generates standard protocol-level logs (SSH, RDP, VNC authentication records) on the servers it connects to; defenders can observe connections through existing service logs and session auditing |
anubis positions itself as an open-source, cross-platform workspace that collapses several daily-operator tools into a single desktop application. Rather than being a dedicated exploit framework, it is a connectivity and workflow hub: terminals, remote sessions, file transfers, and eventually a suite of security-analysis modules all live behind one interface. The repository, Anubis-Security-Tool/anubis, is written primarily in JavaScript, sits at roughly 397 stars, and is distributed under the permissive MIT license. The README is unusually candid for a project of this kind — it repeatedly distinguishes what is implemented from what is merely on the roadmap, which is a detail security buyers should appreciate.
The current public Desktop release is v5.7.2, with builds published for Windows, macOS, and Linux through the project's download portal. The README notes that a 5.7.3 string in the source manifest is a fix candidate, not a confirmed release — a small but telling admission that the maintainers care about version hygiene. There is also a separate browser-based distribution, anubis-web, maintained in its own repository, and the documentation explicitly warns that Desktop, standalone Web, and managed-device Web are different packages with potentially different versions, dependencies, and installation paths. Before installing, the project recommends verifying the published SHA-256 checksum when provided and backing up application data prior to upgrades.
Protocol coverage is the core of the product. anubis supports SSH for remote shells, SFTP and FTP for file movement, RDP for Windows remote desktop, VNC and SPICE for remote display, Serial for device-console work, and Telnet for legacy endpoints. The README is careful to caveat that protocol behavior depends on the target service and installed build — no inflated claims about every feature working everywhere. For operators, this breadth means one client can replace a shelf of single-protocol tools, which is the real consolidation pitch.
Workflow ergonomics get real attention. Connection profiles, created through a "New bookmark" flow, persist address and connection parameters so repetitive administrative access becomes a click rather than a retyped command line. Quick commands keep frequently used operations on hand, and bookmarks can be grouped and their settings reused. The README also documents configurable proxy and SSH-tunneling workflows, which matters for operators working through bastion hosts or segmented networks — a common constraint in authorized enterprise engagements.
Architecturally, anubis is not a monolith but a family of repositories. anubis itself is the Desktop terminal and remote-access core. anubis-web is the browser distribution. anubis-managed-access handles device enrollment and controlled remote access to approved endpoints. anubis-resource holds shared branding, icons, and build assets. The README is explicit that installing Desktop does not deploy a Web service or enroll a remote device — a useful clarification that prevents operators from misunderstanding the attack surface of their own installation.
The security ecosystem is where the project's ambition shows, and also where skepticism is warranted. Anubis Aegis is a live repository for CVE scanning and vulnerability intelligence, and the README defers entirely to that repository for implementation status and supported inputs. Beyond it, four modules exist only as roadmap concepts: anubis lists Scarab for planned DLL scanning and binary analysis, Atlas for proxy and network infrastructure, Oracle for AI-assisted security assessment workflows, and Osiris for cross-platform system automation. The README states plainly that a planned module or visible UI element does not mean the functionality is implemented — honest framing that many commercial vendors would not offer.
For developers, the build path is documented in detail and follows a conventional Node.js workflow. The project recommends Node.js 24.x, and the dependency install is npm install --legacy-peer-deps, which also triggers a configured post-install script — operators building from source should review what that script does before running it on a sensitive machine, as with any npm-based project. Development requires two concurrent processes: npm start runs the Vite development server on port 5570, while npm run app in a second terminal launches the Electron application entry point. Both must stay running during development.
Packaging is layered rather than one-command. npm run b executes a clean/compile/prepare-file sequence that produces application build artifacts, and npm run pb prepares the root Electron Builder configuration. The README cautions that neither command guarantees a complete platform installer — producing a shippable package may require additional native components, platform tooling, and release steps. Quality gates include npm run lint, npm run test-unit-ci, npm run test-integration, and platform-specific checks such as npm run test-packaged-windows, which carries its own Windows test-environment prerequisites.
Notably, the README contains an entire section on security and responsible use, and the first-connection instructions explicitly direct users to enter parameters for a system they are authorized to access. That framing matches the tool's identity: this is an administration and research client, not an attack platform. The remote-access breadth — RDP, VNC, Telnet, Serial — is the same protocol set any legitimate IT department uses daily, and the managed-access component with device enrollment suggests the project is aiming at controlled enterprise workflows rather than ad-hoc connectivity.
Where does anubis fit for a security professional? The clearest near-term value is as a consolidated client for authorized work: an assessment lab with mixed Linux SSH targets, Windows RDP boxes, network gear on Serial, and occasional VNC consoles can be driven from one window with saved profiles and quick commands. The Aegis CVE scanner extends that toward asset triage, assuming its own repository holds up to scrutiny. The roadmap modules — binary analysis, proxy infrastructure, AI-assisted assessment — would widen the scope considerably, but a professional should treat them as marketing until they ship.
From a defensive standpoint, there is little here that is inherently hostile. anubis leaves the normal footprint of any remote client: authentication events, session logs, and transfer records on the services it touches. Blue teams monitoring SSH and RDP infrastructure will see anubis connections the same way they see PuTTY, MobaXterm, or xfreerdp sessions. The managed-access enrollment model is actually a governance feature, giving organizations a controlled path for remote device connectivity instead of shadow IT.
The honest bottom line: anubis is an ambitious, actively documented consolidation play in the crowded terminal/remote-access space. Its distinguishing traits are the breadth of protocol support, the multi-repository architecture with clear implementation-versus-roadmap separation, and a README that resists overclaiming. Operators evaluating it should pin their expectations to the v5.7.2 Desktop release, audit the Aegis scanner separately, and treat the ecosystem modules as direction rather than capability. For authorized administration and research workflows that span many protocols, it is worth a look.
Anubis-Security-Tool/anubis.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.