Curiosity in Practice
Docker containers have become so ubiquitous sometimes respected security professionals tweet ridiculous things like: docker run -u zap -p 8080:8080 -p 8090:8090 -i owasp/zap2docker-stable zap-webswing.sh http://localhost:8080/?anonym=true&app=ZAP — Jerry Gamblin (@JGamblin) June 7, 2016 …but it is 2016 and you should never run code on your machine if you don’t know what it does. These are mini-virtual machines … Read more
I built a simple TOR socks proxy container today to be able to easily use TOR to machines I am working on. Getting it to run is as simple as: docker run –name tor -ti -p 9050:9050 jgamblin/tor This will run it as a daemon: docker run –name tor -ti -p 9050:9050 jgamblin/tor From there all you … Read more
My favorite open source tool for analyzing PCAP files is CapAnalysis and I have always kept a virtual machine around to run this software but I have been on a kick of containerizing all my favorite tools recently so I decided to put CapAnalysis into a container. It allows you to easily visualize the traffic flow, statistics, geolocation and … Read more
I always do this… I wrote KaliBrowser over the weekend and today at lunch I was thinking this same setup would be really handy to use with Burp so I put together BurpBrowser that lets you run Burp and Firefox in a browser. It runs the following packages: Ubuntu 16.04 Burp Proxy Firefox OpenBox NoVNC Getting started is … Read more
I have been spending some time recently getting up to speed on Docker so this weekend I built KaliBrowser: It runs the following packages: Kali Docker OpenBox NoVNC Getting started is as easy as: docker run -d -t -i -p 6080:6080 jgamblin/kalibrowser and then point your favorite browser to: http://ip:6080 To keep this image as small … Read more
Yesterday I was in a situation where I was helping someone who needed to monitor and record all the traffic from a couple of servers for a day to investigate a strange issue that was happening. Normally for this I would just tell them to run this command to record a day’s worth of traffic into … Read more
At work we are moving to slack as a communication method and since I am spending so much time in the tool I decided it was time to start building in some of the tools I use on a regular basis. So far I have put together the following tools: /NMAP Nmap-For-Slack runs a basic … Read more
The TV in my hotel room this week advertised how easy it is to control it with the stayconnect app. So I downloaded it and was pretty impressed by how well it worked…. until I remembered my phone was still on 4G and VPNed through a server in Europe. So I fired up Burp Suite to … Read more
Last week I saw this 3.5″ Touchscreen LCD and case on Amazon for $20 so I ordered it thinking it would be fairly easy to install and get to work. I was wrong and spent the better part of a Saturday looking at this: After spending 5 or 6 hours digging through forums, reddit posts … Read more
This morning I needed someone who I was helping to provide me some basic information about their Macbook and realized while I knew how to get that information it wasnt all in one easy to digest place so I wrote sysinfo.sh to quickly gather that information: Here is the code: https://gist.github.com/jgamblin/aa9a6eda5bce6797ab8394e0c47d3676 You will need to install … Read more