Category: Career

My favorite open source tool for analyzing PCAP files is CapAnalysis  and I have always kept a virtual machine around to run this software but I have been on a kick of containerizing all my favorite tools recently so I decided to put CapAnalysis into a container.
It allows you to easily visualize the traffic flow, statistics, geolocation and a ton of other amazing information:

To get started you just need to run:
docker run -t -i -d -p 9877:9877 jgamblin/capanalysis
From there all you have to do is create a dataset and upload the pcaps you want to analyze.
Inside the container is:
Ubuntu 15.04
Apache2
PHP5
Postgresql
The Dockerfile for this container is:

FROM ubuntu:15.04

# Install packages
ENV DEBIAN_FRONTEND noninteractive

RUN apt-get update && apt-get -y install \
wget \
curl \
gdebi \
php5 \
sudo \
apache2\
apt-utils

RUN echo '#!/bin/sh' > /usr/sbin/policy-rc.d \
    && echo 'exit 101' >> /usr/sbin/policy-rc.d \
    && chmod +x /usr/sbin/policy-rc.d

RUN wget http://downloads.sourceforge.net/project/capanalysis/version%201.2.0/capanalysis_1.2.0_amd64.deb

RUN apt-get update && gdebi --n capanalysis_1.2.0_amd64.deb

RUN sed -i -e 's/PRIORITY=1 #(0..20)/PRIORITY=0 #(0..20)Z/g' /etc/init.d/capanalysis

CMD sudo service postgresql restart && \
sudo service apache2 restart && \
sudo service capanalysis restart && \
tail -f /var/log/apache2/access.log

If you have any questions or comments reach out to me on twitter at @jgamblin

I always do this… I wrote KaliBrowser over the weekend and today at lunch I was thinking this same setup would be really handy to use with Burp so I put together BurpBrowser that lets you run Burp and Firefox in a browser.

It runs the following packages:
Ubuntu 16.04
Burp Proxy
Firefox
OpenBox
NoVNC 
Getting started is as easy as:
docker run --name burpbrowser -d -t -i -p 80:6080 jgamblin/burpbrowser


and then point your favorite browser to:
http://ip
If you want to build a local copy or laugh at how terrible I am at docker here is what is in the Dockerfile:
FROM ubuntu:latest
ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update -y && \
apt-get install -y \
git \
xvfb \
x11vnc \
wget \
python \
python-numpy \
unzip \
menu \
geany \
openbox \
net-tools \
geany \
menu \
openjdk-8-jre \
firefox
Run cd /root && git clone https://github.com/kanaka/noVNC.git && \
cd noVNC/utils && git clone https://github.com/kanaka/websockify websockify && \
cd /root
ADD burpsuite_pro_v1.7.03.jar /root
ADD burpsuite_free_v1.7.03.jar /root
ADD startup.sh /startup.sh
RUN chmod 0755 /startup.sh && \
apt-get autoclean && \
apt-get autoremove && \
rm -rf /var/lib/apt/lists/*
CMD /startup.sh
Here is what is in the startup.sh
#!/bin/bash
export DISPLAY=:1
Xvfb :1 -screen 0 1600x900x16 &
sleep 5
openbox-session&
x11vnc -display :1 -nopw -listen localhost -xkb -ncache 10 -ncache_cr -forever &
cd /root/noVNC && ln -s vnc_auto.html index.html && ./utils/launch.sh --vnc localhost:5900

If you have any questions or comments reach out to me on twitter at @jgamblin
Happy Burping!  : )

I have been spending some time recently getting up to speed on Docker so this weekend I built KaliBrowser:

It runs the following packages:
Kali Docker
OpenBox
NoVNC 
Getting started is as easy as:
docker run -d -t -i -p 6080:6080 jgamblin/kalibrowser
and then point your favorite browser to:
http://ip:6080
To keep this image as small as I could (and it is still 841MB) I only included the base if you want to grab a “ready to go” version I built jgamblin/kalibrowser-top10 (2GB) that has the Kali Top 10 metapackage pre installed so if you want that  run:
docker run -d -t -i -p 6080:6080 jgamblin/kalibrowser-top10 
If you want to build a local copy or laugh at how terrible I am at docker here is what is in the Dockerfile:
FROM kalilinux/kali-linux-docker
ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update -y && \
apt-get install -y \
net-tools \
openbox \
git \
x11vnc \
xvfb \
wget \
python \
python-numpy \
unzip \
geany \
iceweasel
menu && \
cd /root && git clone https://github.com/kanaka/noVNC.git && \
cd noVNC/utils && git clone https://github.com/kanaka/websockify websockify && \
cd /root
ADD startup.sh /startup.sh
RUN chmod 0755 /startup.sh && \
apt-get autoremove && \
rm -rf /var/lib/apt/lists/*

#The Kali Docker Image Is Out Of Date. : (
RUN apt-get update -y && apt-get dist-upgrade -y

CMD /startup.sh
and the startup.sh
#!/bin/bash
export DISPLAY=:1
Xvfb :1 -screen 0 1600x900x16 &
sleep 5
openbox-session&
x11vnc -display :1 -nopw -listen localhost -xkb -ncache 10 -ncache_cr -forever &
cd /root/noVNC && ln -s vnc_auto.html index.html && ./utils/launch.sh --vnc localhost:5900
If you have any questions or comments reach out to me on twitter at @jgamblin

Yesterday I was in a situation where  I was helping someone who needed to monitor and record all the traffic from a couple of servers for a day to investigate a strange issue that was happening.

Normally for this I would just tell them to run this command to record a day’s worth of traffic into 15 minute chunks.:
tcpdump -G 900 -w '%Y-%m-%d_%H:%M:%S.pcap' -W 96



…but this is 2016 and we have containers!(Not An Actual Docker Container.)

So I did what any self-respecting security professional would do and spent a Friday night writing a tcpdump container and put it on Docker Hub.

So now in the future when anyone wants to record all the traffic from a server all they have to do is run
docker run -v ~/pcap:/pcap --net=host -d jgamblin/tcpdump
and the pcaps will save in their home directory.

If you want to build your own copy here is everything I have in the dockerfile:
FROM debian
RUN apt-get update && apt-get install -y \
tcpdump
RUN mkdir /pcap
RUN cd /pcap
WORKDIR /pcap
CMD tcpdump -G 900 -w '%Y-%m-%d_%H:%M:%S.pcap' -W 96
From here if you wanted to display the PCAPs in a browser for easy access all you need to do is run
docker run -h tccdumpweb -p 1337:80 -v ~/pcap:/var/www/html/ -d eboraas/apache
and all  files captured will be displayed at http://hostip:1337.

Happy tcpdumping!

On Wednesday night I tweeted this:

If you are using TrueCrypt you should stop. Hashcat is now optimized to crack TrueCrypt volumes. https://t.co/voBdtKuuHW

— Jerry Gamblin (@JGamblin) December 10, 2015

I started getting retweets and replies like this on Friday from people I respect (and a bunch from people I don’t know):

@JGamblin this is a non sequitur. there are valid reasons to stop using TC, but Hashcat isn't one of them.

— Kyle Maxwell (@kylemaxwell) December 11, 2015

https://twitter.com/averagesecguy/status/674768017864134657
So people REALLY like TrueCrypt or I didn’t make my point articulately enough.  In case I didnt make my point well enough I will try to lay it out here.
3 Reasons Why I Think You Should Stop Using TrueCrypt:
The developer stopped maintaining it, took down the webpage and replaced it with this.
“WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues“.

I think that this reason should be more than enough to get 99% of people to stop using it.
The latest version of HashCat includes support for TrueCrypt volumes.
If you are using good passphrases (most people don’t) it really isnt a big deal but it does lower the level of complexity for hacking a TrueCrypt volume with a weak password from a medium-high skill level (Think Security Professional) to downloading kali and following instructions (Think Help Desk Analyst).
The developer stopped maintaining it, took down the webpage and replaced it with this.
“WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues“.

There are many other open source and paid alternatives that you can evaluate and pick the best one for you.  So unless you have an amazingly valid reason to not move off of TrueCrypt you should move off it as soon as possible.