Our take
Quietno commits in the last 90 days and no release in a year- Activity
- 20
- Community
- 39
- Issues
- 21
- Pull requests
- 21
Coercer is a focused tool for Windows RPC authentication-coercion testing, but its quiet maintenance and highly concentrated contributions merit review before relying on it operationally.
Good fit if
- You need to assess or research Windows RPC methods that may trigger outbound authentication.
- Your workflow benefits from scan, coerce, or fuzz modes and machine-readable result exports.
- You can run a Python 3.7-or-newer tool and meet the obligations of its GPL-2.0 license.
Look elsewhere if
- You need a project with recent release activity: the latest listed release is from 2023, with no release in over a year.
- Your adoption process requires steady recent development or issue and pull-request activity; the health data reports no recent commits, issue closures, or merged pull requests.
- You need a tool unrelated to Windows RPC and SMB authentication testing.
All health signals
| Last commit | 2026-04-24 (6 months ago) |
|---|---|
| Commits, last 90 days | 0 |
| Releases, last 12 months | 0 (latest 2.4.3, 2023-10-04) |
| Contributors | 16 (top contributor: 83% of commits) |
| Issues closed, last 90 days | 0 |
| Pull requests merged, last 90 days | 0 |
| Project age | 4 years |
Checked on 2026-10-25 with the GitHub API.
Overview
Coercer is a Python tool for testing whether a Windows server can be made to authenticate to an arbitrary machine through Remote Procedure Call (RPC) methods. It helps security researchers and operators identify and exercise these authentication-coercion paths, including in NTLM relay or Responder assessments.
The tool checks remote SMB pipes and tries known RPC functions. Its scan, coerce, and fuzz modes support assessment, controlled coercion attempts, and RPC research. It can target one machine or a list, and can listen for incoming authentications in scan and fuzz modes.
Key Features
- Scans remote SMB pipes and tests known RPC coercion methods.
- Attempts RPC calls that may cause a server to authenticate to a specified machine.
- Fuzzes RPC methods with varied paths for research.
- Filters attempts by method, protocol, or pipe name.
- Targets individual hosts or a target list from a file.
- Supports a configurable delay and random UNC paths between attempts.
- Exports scan and fuzz results as SQLite, JSON, or XLSX.
- Provides a PowerShell installer script for building a Windows binary.
Use Cases
- Security testers can assess a Windows server's RPC exposure before deciding whether to attempt coercion.
- Red teams can test whether a server can be induced to authenticate to infrastructure prepared for NTLM relay or Responder.
- Protocol researchers can fuzz RPC methods and paths to investigate coercion behavior.
- Administrators can review exported results when assessing authentication exposure across a list of targets.
What you need
Detected in the repository
- Python >=3.7 (from pyproject.toml)
- Automated checks on GitHub Actions
License in plain words
GPL-2.0strong copyleft
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license notice
- Share your changes: yes, the full source of anything you distribute that includes it, under the GPL
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Install Coercer from PyPI:
sudo python3 -m pip install coercer
See the repository README for usage details and mode-specific documentation.
Considerations
The project is marked quiet, with no commits in the last 90 days and no release in over a year. Although it has multiple contributors, most of the code comes from one person, which may increase dependence on that contributor. The health data also shows no recent issue closures or merged pull requests. Coercer requires Python 3.7 or newer; its GPL-2.0 license should be reviewed against your distribution and usage plans. Its purpose is security testing, so use it only on systems you are authorized to assess.
Found this useful?
Share it with someone who would like Coercer.