// the find
firefart/stunner
Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers.
A Go CLI for probing and abusing misconfigured STUN/TURN/TURN-over-TCP servers (the relay infrastructure behind WebRTC), letting a tester check whether a server will proxy traffic into an internal network and, if so, actually pivot through it. Built for pentesters who run into TURN servers like Cisco Expressway during an engagement, not for general network admins.
Implements STUN/TURN/TURN-TCP/IPv6 TURN (RFCs 5389, 5766, 6062, 6156) itself in Go rather than wrapping an existing library, and backs that with real parser-level unit tests. The `socks` command turns a misconfigured TURN server into an actual SOCKS5 pivot point, which is the useful payoff beyond mere detection. The `memoryleak` command is a concrete TLV boundary-check exploit the author found and disclosed against Cisco Expressway, not a speculative feature. CI is solid for a one-person tool: lint, Go test workflow, dependabot, goreleaser for releases.
Licensed CC BY-NC-SA 4.0, so despite living on GitHub with an OSI-style topic list it's not actually open source and can't be used on paid commercial pentest engagements without separately clearing that. The SOCKS pivot only relays TCP — no UDP support — which cuts its usefulness against TURN deployments that only need UDP relaying internally. It has no built-in way to obtain the username/password; you're expected to sniff the Connect request out-of-band with Burp or Wireshark first, so the tool is only one link in a manual chain. The README itself admits the udp-scanner/tcp-scanner sweeps can take multiple days against full private ranges, and there's no documented concurrency or rate control to make that practical.