👏 Image full credits go to Dirk Hoenes: https://pixabay.com/users/ptdh-275507.

Note: Even though this box is primarily intended for offensive operation, many tools and scripts can also be used for defensive purposes, for example, in CI/CD pipelines as security validation.

🔖 Quick access:

• Cheat sheet.
• Index of the scripts.

🎯 The goal of this image is to provide an, always up to date "box", containing materials (tools + scripts) useful in the context of the assessment of a web-based application: site, API, etc.

⚙️ The image is based on the kali-rolling base image without any metapackage installed.

📱 Recently, I started to add content for mobile assessment to gather information/tools in a single box.

🏷️ Issues with the label idea, contains general ideas on a project/code/script/payload/research/etc not necessarily directly linked to the toolbox itself. Indeed, as this project is my central toolbox's forge, I used it also to gather/centralize my ideas.

• SecLists.
• Nuclei templates.
• Param-Miner.

sequenceDiagram
    participant T as Toolbox
    participant P as Param-Miner    
    participant S as SecLists
    participant N as Nuclei templates
    alt Is a missing hidden http parameter/header entry
        T->>P: Propose a PR with the missing element
        P->>T: Get update from the GitHub repository once the PR is merged
    end    
    alt Is a missing discovery dictionary entry
        T->>S: Propose a PR with the missing element
        S->>T: Get update from the GitHub repository once the PR is merged
    end
    alt Is a missing detection generic point
        T->>N: Propose a PR with the missing template
        N->>T: Get update from the GitHub repository once the PR is merged
    end
    alt Is a missing useful existing tool
        T->>T: Add the tool in a way to always use the latest version
    end       
    alt Is a missing specific need or without existing tool
        T->>T: Add a new custom script
    end   

• Online in Gitpod
• Local in DevContainer

The folder build contains utility internal scripts used to build the docker image.

All tools are installed in the folder /tools and a transfer zone between the container and the host has been defined via the folder /tools/reports.

Note:

The index of all the scripts available is automatically updated, at each push on the master branch, via this workflow.

The folder scripts contains helper scripts for some operations using embedded tools.

The folder sandboxes contains utility docker files with specific OS/Runtime to create a specific sandbox.

The objective is to leverage the containerization to have a collection of quick sandboxes environment to test some specific behavior on a specific OS/runtime, for example, during a code review on an old version of a runtime (like PHP5).

The header of the dockerfile describes the target OS/runtime.

📡 All boxes are build and published to DockerHub every month (images starting with righettod/sandbox- name).

Command to use to build and/or run a sandbox:

💻 By default, a ZSH shell with Oh My Zsh is launched.

docker rmi -f righettod/[BoxName]
docker build --force-rm -t righettod/[BoxName] -f [Dockerfile] .
docker run --rm -v "[LOCAL_FOLDER_PATH]:/share" -i -t righettod/[BoxName]

The following images can be used:

# Use the following command to obtains a ruby 2.x environment
# Once in the container, you can install software via "apt-get update; apt-get install nano ..."
docker run -it ruby:2 /bin/bash

The folder misc contains materials that can be used for testing specific cases like for example when an app is using:

• HTTP Signature.
• eIDAS certificate and key materials.
• RSA weak key pair:
  • RSA 512 bits private key / RSA 512 bits public key.
  • RSA 1024 bits private key / RSA 1024 bits public key.
• RSA JWK format key pair:
  • RSA 2048 bits private key / RSA 2048 bits public key
  • Corresponding JSON Web Key Sets file with the public key only.
  • Corresponding JSON Web Key Sets file with the private key only.
• File upload feature accepting Microsoft Office documents, PDF documents or SVG images:
  • Word 97-2003 format document with a VBA macro performing a HTTP GET request to a defined domain.
  • PDF document with a link to a file considered as a malware by some Antivirus or Browsers.
  • SVG image with an XSS payload, see files misc/doc-test-xss-*.svg for the different versions.

The folder templates contains several scripts/files that can be used as a basis for custom scripts to speed-up the implementation of a POC.

The folder dictionaries contains several home-made custom dictionaries that can be used for discovery operations.

This file contains several technical hints for different kinds of context/issues/goals.

💻 It's my tailor made cheat sheet.

Use the following set of commands:

$ git clone https://github.com/righettod/toolbox-pentest-web.git
$ cd toolbox-pentest-web
$ docker build . -t righettod/toolbox-pentest-web --file Dockerfile
...

# Create a volume to share files with the container (ex: reports)
$ docker volume create --name shared_space
$ docker volume inspect shared_space
# Run container
$ docker run -v shared_space:/tools/reports -p 127.0.0.1:80:80 -i -t righettod/toolbox-pentest-web /bin/zsh
$ docker run -v shared_space:/tools/reports -p 192.168.206.128:80:80 -p 192.168.206.128:443:443 -i -t righettod/toolbox-pentest-web /bin/zsh
# Build image into local cache
$ docker build -t righettod/toolbox-pentest-web .
# Remove image from local cache
$ docker rmi -f righettod/toolbox-pentest-web

rem Run container and defines a shared folder
C:\> docker run -v F:/SharedFolder:/tools/reports -p 127.0.0.1:80:80 -i -t righettod/toolbox-pentest-web /bin/zsh

Warning: Private key to use for SSH authentication is here. This box is intended to be used as a toolbox for a short running period.

Warning: When deployed on Kubernetes, the SYS_CHROOT / AUDIT_WRITE / NET_RAW capabilities are required in the security context.

1. Run the container on the target docker host using the following command line:

$ docker run -p 22:22 righettod/toolbox-pentest-web
Server listening on 0.0.0.0 port 22.
Server listening on :: port 22.
...

2. Access the container, via SSH, using the following command:

$ ssh -i ~/.ssh/ssh-private-key.pem root@[DOCKER_HOST_IP]
➜  ~

Add "StrictHostKeyChecking=no" in case of trouble with the remote keys because they are unique for each built image:

$ ssh -o "StrictHostKeyChecking=no" -i ~/.ssh/toolbox-ssh-private-key.pem root@[DOCKER_HOST_IP]
➜  ~

Image is published here every week.

• Refer here for information about reporting a vulnerability.
• Image is audited every week, by Snyk and this workflow, to detect presence of any vulnerability.