Hi fellas,
Today, I wanted to introduce you a hacking toolbox that I configured for the sake of my latest pentesting agreements. Till now, and working on MacOS, I used a virtual machine dedicated to this task, containing all the tools required for my security assessment. However, such setup have its own limitations in term of resources consumption, system maintenance and dependancies compatibility. That is why, I switched on docker and configured this build, accessible through my github.
Virtual Machines VS docker container
Here are the reasons why I switched to docker.
Resources management
Well, …, this is a real cancer. Indeed, the VM lock resources on your host, letting it die and freeze if there is not enough resources for both of them. How many times, my computer was stuck when launching a heavy scanner on a target and using firefox on an other hand …. hopeless …. Moreover, a VM will never be idle, consuming resources that could be valuable for your host.
Docker is well more efficient. Indeed, the container will only ask for resources when used.
System maintenance
Installing tools can be harsh when come dependency issues. You can waste a lot of time either fixing it or rebuild a new virtual machine. With docker, a few commands will do the job and 15 minutes later you will be able to enjoy your new build.
File storage requirement
A docker image is well more lightest than a virtual machine. Indeed, a VM represent and entire operating system whereas a docker container limit its installation on the OS environment required to run your tools.
P0wn-box
Purpose
P0wn-box is a debian based docker container that includes Kali Linux repository to simplify the tools installation phase. As you can see bellow, just a few tools has been installed cause plenty of them are already compatible with my working machine. However, the image is easily customizable by modifying the Dockerfile.
Upstream, I have created a bin folder which contains scripts shell, used as shortcut to interact with the docker container. Their usage will be completely transparent by adding this folder to your PATH.
Tools installed:
- dirb
- john
- p0f
- patator
- dotdotpwn
- enum4linux
- dnsenum
- smtp-user-enum
- hydra
- wpscan
- snmpcheck
- wafw00f
- medusa
- hping3
- crunch
- setoolkit
- metasploit
It also includes:
- Wordlists from Kali Linux
Build
To build the container, just use this command:
docker build -t pentest .
Docker will download the Debian image and then execute the installation steps.
Be patient, the process can be quite long the first time.
Note that you may want to:
- If you wish to change the container name, please, run the script rename.sh in order to update the bin folder.
Run
Once the build process is over, get and enjoy your tools as you were on your proper system !
sudo docker run -t -p 9990-9999:9990-9999 -v ~/p0wnM3/:/tmp/data --name pentest pentest
Explanations:
- We map the port range from 9990 to 9999 to our host (useful for reverse tcp connexion)
- We mount a shared folder to simplify the data exchange between the container and the host
Of course, it is up to you to adjust it to your taste or need.
That’s all for today. I hope that you enjoyed this short article and that this docker will be useful for you and used in your hacking journey.
Best,
Nitrax