How spiderlabs/ikeforce works
IKEForce is a command-line IKEv1/IPsec assessment tool. The user selects transform discovery, group-name/ID enumeration, XAUTH credential guessing, or connection testing; the controller sends IKE exchanges to a VPN target and interprets replies. A successful full negotiation can yield ESP keys, while response handling also supports vendor-ID recognition and the documented XAUTH-bypass check. The graph separates orchestration, packet construction, cryptography, and protocol interpretation. The excerpts show controller-to-client and controller-to-handler calls; unsampled mode wiring is represented only where the README documents the capability.
Main entry points: ikeforce.py Mode controller · ikeclient.py IKE exchange builder · ikehandler.py Packet interpreter · ikecrypto.py IKE cryptography
Components 14
Command workflows
- Mode controller
ikeforce.py - Transform discovery
ikeforce.py - Group enumeration
ikeforce.py - XAUTH guessing
ikeforce.py - Connection test
ikeforce.py
IKE protocol
- IKE exchange builder
ikeclient.py - Packet interpreter
ikehandler.py
Key operations
- IKE cryptography
ikecrypto.py - Diffie-Hellman
dh.py
Reference data
- Guessing lists
wordlists - Vendor ID catalog
vid.py
Other components
- CLI user
- IKE VPN target
- ESP key material
Connections 18
- CLI user → Mode controller: selects mode
- Mode controller → Transform discovery: dispatches
- Mode controller → Group enumeration: dispatches
- Mode controller → XAUTH guessing: dispatches
- Mode controller → Connection test: dispatches
- Mode controller → IKE exchange builder: builds exchanges
- Mode controller → Packet interpreter: parses replies
- Transform discovery → IKE exchange builder: probes transforms
- Group enumeration → IKE exchange builder: probes IDs
- XAUTH guessing → Guessing lists: reads guesses
- XAUTH guessing → IKE exchange builder: attempts credentials
- Connection test → IKE exchange builder: negotiates
- Mode controller → IKE cryptography: uses key operations
- Mode controller → Diffie-Hellman: derives exchange keys
- IKE exchange builder → IKE VPN target: sends IKE packets
- IKE VPN target → Mode controller: returns IKE replies
- Packet interpreter → Vendor ID catalog: identifies vendors
- Connection test → ESP key material: reports negotiated keys