Security-Tools

Description

These are security-related tools contained in a Docker image.

Tools are configured to require least privilege. For some applications that means no network access at all (i.e. Ghidra), while others need network and user nobody (i.e. gobuster, ffuf, etc.)

History

I created this with the following requirements in mind:

Portability: I wanted a cross-platform way of running my toolset.
Consistent: I want a fresh environment every time I run my tools.
Modular: I wanted to make it easy to add or remove packages at runtime or during build.
Current: Packages should be as close to their current release as possible.

I chose Ubuntu as the base image since it generally has good package support. Arch was an option, since it usually has a good selection of current packages, but I didn't want to rely on the Arch User Repository (AUR) for installing packages.

The repository is setup in a way so builds are as automated as possible, to minimize time spent maintaining the image (i.e. no version pinning). When possible, packages are pulled from the standard Ubuntu repo except in cases where a more current version is desired (nmap, binwalk, ncrack, etc.).

Building image

$ ./build.sh

Build with latest packages

The latest git release tag (if available) will be checked out.

$ ./build.sh update

Language Support

C (with cross-compile support)
Python
Ruby
Golang
Perl

Tools included

Enumeration / Fingerprinting / Recon

amass
assetfinder
hping3
masscan
meg
nmap (with vulscan + vulners)
p0f
snmpcheck
waybackurls

Web

ffuf
gobuster
nikto
sqlmap
wfuzz
wpscan

Forensics

binwalk
bulk_extractor
volatility

Reverse Engineering / Debugging

adb/fastboot (Android)
apktool
Bindiff
Distorm3
Frida
JD-GUI (Java Decompiler)
QEMU (Emulation for ARM, MIPS, etc.)
radare2 (with Ghidra decompiler plugin)

Password Breaking

cewl
hashcat
hydra
john the ripper
ncrack

Sniffing / Spoofing

bettercap
dnschef
pwntools
responder
scapy

Other

tor
proxychains-ng

Usage

Shell with current working directory mounted inside container

host$ source source.sh
host$ dockershell

Bettercap

host$ source source.sh
host$ bettercap

Tor with proxychains

host$ source source.sh
host$ tor_cli

# Default proxychains uses standard tor port
$ proxychains curl https://ifconfig.me

Android Debugging

host$ android adb
# or
host$ android fastboot

r2ghidra Decompiler

host$ source source.sh
host$ dockershell_re
docker$ r2 /bin/some_executable
s main
aa # to analyze binary
pdg

Fernflower Java decompiler

host$ source source.sh
host$ fernflower lib/*.jar source/

GUI Apps

Note: These has only been tested on Linux since an X11 server is built in. This may require tweaking for other operating systems.

Guidra

To keep a persistent Ghidra state, create a .ghidra and ghidra_projects folder in your home directory. Then have Docker mount these as volumes within the Ghidra container. This is entirely optional.

The following example will disable all network access for Ghidra:

host$ mkdir ~/.ghidra ~/ghidra_projects
host$ source source.sh
host$ ghidra

IDA Free

host$ source source.sh
host$ ida

Firefox

This will launch a disposable Firefox.

host$ source source.sh
host$ dfirefox

BurpSuite Community

This will launch Burp listening on 127.0.0.1:8080 on your host.

host$ source source.sh
host$ dburp

Firefox + BurpSuite Community

This will launch burp and Firefox together. All HTTP requests will go through Burp.

host$ source source.sh
host$ dproxy

litobro/security-tools