Collaborative pentesting, in real time

Browser-based terminal workspace with real-time sync. Shared command history, credential vault, and playbooks. Side-by-side xterm.js terminal and markdown playbooks.

riptide
$ npm start
Riptide listening on https://localhost:3000
TLS certificate auto-generated

# Create a room, set a password, start hacking
[ws] 3 users connected to room ALPHA
[sync] credentials, variables, notes broadcasting
0
Tests
0
Frontend Modules
0
API Routes
0
Themes

Your team's war room

Terminal, playbooks, credentials, and knowledge base in one browser tab. Real-time multi-user sync with password-protected rooms.

Terminal + Playbooks

Full xterm.js terminal on one side, stackable markdown notes on the other. Fenced code blocks get Run buttons that execute directly in the terminal. Run All executes every block sequentially.

┌──── Playbook (MD) ────┬──── Terminal (PTY) ────┐
[Run] nmap -sCV <IP> $ nmap -sCV 10.10.10.5
[Run] gobuster dir 22/tcp open ssh
└─────────────────────┴─────────────────────┘
675
Tests Passing

Real-Time Collaboration

Password-protected rooms with dual WebSocket sync. Multiple users see presence, live updates on notes, credentials, and variables. Edit locks prevent conflicts.

Variable Substitution

Use <TargetIP>, <Domain>, or custom variables in code blocks. Riptide renders input fields and substitutes values at runtime.

Credential Vault

Store service/username/password/hash per target or globally. Click-to-reveal, one-click copy, bulk export. Flag findings to alert the team.

15
API Routes

Output Intelligence

Terminal output parser automatically extracts IPs, URLs, emails, hashes, credentials, and nmap ports — highlighted inline with one-click promote actions to push findings into the credential vault or scope panel.

$ nmap -sCV 10.10.10.5
22/tcp open ssh OpenSSH 8.9 [promote]
80/tcp open http nginx [promote]
Found: admin:password123 [add to vault]

Playbook Library

Reusable playbooks organized by category and tags. Search, import into rooms, customize. Frontmatter metadata for title, description, and category.

Platform support

Full-featured on Linux, macOS, and Windows. Vanilla JavaScript with no build step. Four Catppuccin themes.

xterm.js Terminal
WebSocket Sync
Markdown Playbooks
Credential Vault
Variable Engine
Output Intelligence
Session Recording
Knowledge Base
File Management
Real-Time Chat
Audit Logging
Playbook Library
Auto-TLS
Catppuccin Themes
CodeMirror Editor
DOMPurify Sanitize
Rate Limiting
scrypt Auth
Full   Partial   Not Supported

Client-server architecture

Express server with dual WebSocket channels. Vanilla JavaScript frontend with no build step. File-based storage with atomic JSON updates.

1

Express Server

Node.js with Express 4, ws for WebSocket, node-pty for terminal. 15 Router modules for rooms, tabs, notes, credentials, variables, and more.

2

Dual WebSocket

Terminal I/O on /ws/terminal and state broadcast on /ws/sync. Independent channels for low-latency terminal and reliable state sync.

3

Storage Layer

File-based with atomic JSON updates. Room data, playbooks, recordings, and knowledge base. No external database required.

4

Security Layer

helmet CSP/HSTS, express-rate-limit, DOMPurify on all rendered markdown. scrypt password hashing with 24-hour session expiry. Auto-TLS.

Clone and run

Node.js application with auto-TLS. npm install, npm start, open your browser.

install.sh
$ git clone https://github.com/Real-Fruit-Snacks/Riptide
$ cd Riptide && npm install

# Start with auto-generated TLS
$ npm start
Riptide listening on https://localhost:3000

# Run all 675 tests
$ npm test
usage.sh
# Open in browser
$ open https://localhost:3000

# Custom TLS certificate
$ SSL_KEY=./key.pem SSL_CERT=./cert.pem npm start

# Development mode
$ npm run dev

# Disable HTTPS
$ NO_SSL=1 npm start

Know the boundaries

Hidden From

  • Casual browsing — standard HTTPS traffic on port 3000
  • Content inspection — TLS encrypted WebSocket channels
  • Credential storage — scrypt hashed passwords
  • XSS attempts — DOMPurify sanitizes all markdown
  • Brute force — express-rate-limit on all endpoints

Visible To

  • Network monitoring — WebSocket connection metadata
  • Process listing — Node.js server visible
  • Port scanners — open port 3000
  • TLS inspection — self-signed certificate
  • Host forensics — room data stored on disk