Author: jgamblin

A picture started floating around the internet of  Mark Zuckerberg holding an Instagram cutout:

People almost instantly started to notice that his webcam and mic were taped over.   While Mark Zuckerberg isnt exactly known for having great security practices,  all his social media passwords were Dadada. This started a discussion in the office if someone could really spy on you via your webcam.  So being a huge fan of the POC||GTFO model of security I put together a quick POC using a 10 line bash script and imagesnap and put it on github.
Simply Running ./capture.sh & takes a photo every 60 seconds.

While I dont shower with my mac (that much) I will be  Zuckerberging my webcam from now so hackers can not see the strange faces I make at my computer when trying to figure out how to get a bash script to work correctly.

While rebuilding my iPad this weekend I noticed that I could name it an emoji.  So I named my iPad 📱(U+1F4F1):

 
While  I don’t have any problem using the iPad it basically makes it unreachable on the network via hostname.

From there I renamed all of my lab machines emojis.  Mostly  variations of 💩 (U+1F4A9) because I am sophomoric:

In case you were wondering this is all totally illegally according to RFC 952 (that was written in 1985)  and shouldn’t be allowed but I have not found an OS the enforces it.
While doing some research on hostnames and emojis  I read that .ws (Samoa) and .tk (Tokelau) allow emoji domains with the help on punycoder so I registered  http://☠💻💩.ws which is either going to be the waste of $6 or the start of a $10B security startup.  I have not decided yet.

If all of this isn’t ridiculous enough for you can even name your wireless network with emojis:

…emojis: they just aren’t for 12 year olds anymore.  😎
 

Docker containers have become so ubiquitous sometimes respected security professionals tweet ridiculous  things like:

docker run -u zap -p 8080:8080 -p 8090:8090 -i owasp/zap2docker-stable zap-webswing.sh

http://localhost:8080/?anonym=true&app=ZAP
— Jerry Gamblin (@JGamblin) June 7, 2016

…but it is 2016 and you should never run code on your machine if you don’t know what it does.  These are mini-virtual machines and not magically secure little shipping containers*.  At a minimum you should do these basic things to get some idea of what you are putting on your machine before you run it.

Pull the container first:
docker pull jgamblin/tiny-tor 

Use  Docker Inspect to look at the container’s metadata:
docker inspect jgamblin/tiny-tor 

You will want to carefully read through that output and take time to look at these fields:

• Image The image this container is running.
• NetworkSettings The network settings for the container,
• LogPath The system path to this container’s log file.
• Name The user defined name for the container.
• Volumes Defines the volume mapping between the host system and the container.
• HostConfig Key configurations for how the container will interact with the host system. These could take CPU and memory limits, networking values, or device driver paths.
• Config The runtime configuration options set when the docker run command was executed.

Use Docker History to see how the image was built:
docker history jgamblin/tiny-tor

Protip:  CenturylinkLabs released a tool to create a Dockerfile from a container.

Run the container without network access and look around a bit:
docker run -t -i --net=none jgamblin/tiny-tor /bin/sh

After you have done the following steps and feel comfortable you can then:
docker run -t -i -p 9050:9050 jgamblin/tiny-tor

If you do these basic things you can feel a little better about what you are running on your system.
* What a magically secure little shipping container might look like:

I built a simple TOR  socks proxy container today to be able to easily use TOR to machines I am working on.
Getting it to run is as simple as:
docker run --name tor -ti -p 9050:9050 jgamblin/tor
This will run it as a daemon:
docker run --name tor -ti -p 9050:9050 jgamblin/tor
From there all you have to do is configure your  browser to use port 9150 and you are using TOR.

The dockerfile for this build is fairly simple and is on Github and Docker Hub:
https://gist.github.com/jgamblin/3e1fd9aad19fcd496ed3d35d2cfe383b
As always if you are *REALLY* worried about security you should be using Tails but this works perfectly to get an “outside-in” real world look of your environment.   If you have any questions please reach out to me on twitter at @jgamblin.

My favorite open source tool for analyzing PCAP files is CapAnalysis  and I have always kept a virtual machine around to run this software but I have been on a kick of containerizing all my favorite tools recently so I decided to put CapAnalysis into a container.
It allows you to easily visualize the traffic flow, statistics, geolocation and a ton of other amazing information:

To get started you just need to run:
docker run -t -i -d -p 9877:9877 jgamblin/capanalysis
From there all you have to do is create a dataset and upload the pcaps you want to analyze.
Inside the container is:
Ubuntu 15.04
Apache2
PHP5
Postgresql
The Dockerfile for this container is:

FROM ubuntu:15.04

# Install packages
ENV DEBIAN_FRONTEND noninteractive

RUN apt-get update && apt-get -y install \
wget \
curl \
gdebi \
php5 \
sudo \
apache2\
apt-utils

RUN echo '#!/bin/sh' > /usr/sbin/policy-rc.d \
    && echo 'exit 101' >> /usr/sbin/policy-rc.d \
    && chmod +x /usr/sbin/policy-rc.d

RUN wget http://downloads.sourceforge.net/project/capanalysis/version%201.2.0/capanalysis_1.2.0_amd64.deb

RUN apt-get update && gdebi --n capanalysis_1.2.0_amd64.deb

RUN sed -i -e 's/PRIORITY=1 #(0..20)/PRIORITY=0 #(0..20)Z/g' /etc/init.d/capanalysis

CMD sudo service postgresql restart && \
sudo service apache2 restart && \
sudo service capanalysis restart && \
tail -f /var/log/apache2/access.log

If you have any questions or comments reach out to me on twitter at @jgamblin

I always do this… I wrote KaliBrowser over the weekend and today at lunch I was thinking this same setup would be really handy to use with Burp so I put together BurpBrowser that lets you run Burp and Firefox in a browser.

It runs the following packages:
Ubuntu 16.04
Burp Proxy
Firefox
OpenBox
NoVNC 
Getting started is as easy as:
docker run --name burpbrowser -d -t -i -p 80:6080 jgamblin/burpbrowser


and then point your favorite browser to:
http://ip
If you want to build a local copy or laugh at how terrible I am at docker here is what is in the Dockerfile:
FROM ubuntu:latest
ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update -y && \
apt-get install -y \
git \
xvfb \
x11vnc \
wget \
python \
python-numpy \
unzip \
menu \
geany \
openbox \
net-tools \
geany \
menu \
openjdk-8-jre \
firefox
Run cd /root && git clone https://github.com/kanaka/noVNC.git && \
cd noVNC/utils && git clone https://github.com/kanaka/websockify websockify && \
cd /root
ADD burpsuite_pro_v1.7.03.jar /root
ADD burpsuite_free_v1.7.03.jar /root
ADD startup.sh /startup.sh
RUN chmod 0755 /startup.sh && \
apt-get autoclean && \
apt-get autoremove && \
rm -rf /var/lib/apt/lists/*
CMD /startup.sh
Here is what is in the startup.sh
#!/bin/bash
export DISPLAY=:1
Xvfb :1 -screen 0 1600x900x16 &
sleep 5
openbox-session&
x11vnc -display :1 -nopw -listen localhost -xkb -ncache 10 -ncache_cr -forever &
cd /root/noVNC && ln -s vnc_auto.html index.html && ./utils/launch.sh --vnc localhost:5900

If you have any questions or comments reach out to me on twitter at @jgamblin
Happy Burping!  : )

I have been spending some time recently getting up to speed on Docker so this weekend I built KaliBrowser:

It runs the following packages:
Kali Docker
OpenBox
NoVNC 
Getting started is as easy as:
docker run -d -t -i -p 6080:6080 jgamblin/kalibrowser
and then point your favorite browser to:
http://ip:6080
To keep this image as small as I could (and it is still 841MB) I only included the base if you want to grab a “ready to go” version I built jgamblin/kalibrowser-top10 (2GB) that has the Kali Top 10 metapackage pre installed so if you want that  run:
docker run -d -t -i -p 6080:6080 jgamblin/kalibrowser-top10 
If you want to build a local copy or laugh at how terrible I am at docker here is what is in the Dockerfile:
FROM kalilinux/kali-linux-docker
ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update -y && \
apt-get install -y \
net-tools \
openbox \
git \
x11vnc \
xvfb \
wget \
python \
python-numpy \
unzip \
geany \
iceweasel
menu && \
cd /root && git clone https://github.com/kanaka/noVNC.git && \
cd noVNC/utils && git clone https://github.com/kanaka/websockify websockify && \
cd /root
ADD startup.sh /startup.sh
RUN chmod 0755 /startup.sh && \
apt-get autoremove && \
rm -rf /var/lib/apt/lists/*

#The Kali Docker Image Is Out Of Date. : (
RUN apt-get update -y && apt-get dist-upgrade -y

CMD /startup.sh
and the startup.sh
#!/bin/bash
export DISPLAY=:1
Xvfb :1 -screen 0 1600x900x16 &
sleep 5
openbox-session&
x11vnc -display :1 -nopw -listen localhost -xkb -ncache 10 -ncache_cr -forever &
cd /root/noVNC && ln -s vnc_auto.html index.html && ./utils/launch.sh --vnc localhost:5900
If you have any questions or comments reach out to me on twitter at @jgamblin