-
Notifications
You must be signed in to change notification settings - Fork 203
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
4 changed files
with
427 additions
and
427 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,60 +1,60 @@ | ||
| .. _docker: | ||
|
|
||
| Docker | ||
| ====== | ||
|
|
||
| If you want to run up a quick instance of Thug on a couple of malicious web sites or try | ||
| it out but just lack the knowledge and/or time to install it, an alternative exists. Thanks | ||
| to Docker you can run Thug up in a matter of minutes. | ||
|
|
||
| Currently there exist a few docker images in the Docker Hub ready to run. | ||
|
|
||
| Docker is a platform for developers and sysadmins to develop, ship, and run applications. | ||
| Docker lets you quickly assemble applications from components and eliminates the friction | ||
| that can come when shipping code. Docker lets you get your code tested and deployed into | ||
| production as fast as possible. | ||
|
|
||
| Docker consists of: | ||
|
|
||
| * The Docker Engine - a lightweight and powerful open source container virtualization | ||
| technology combined with a work flow for building and containerizing your applications. | ||
| * Docker Hub - a SaaS service for sharing and managing application stacks. | ||
|
|
||
|
|
||
| Installation | ||
| ------------ | ||
|
|
||
| Please refer to http://docs.docker.com/installation/#installation for instructions on how | ||
| to install Docker on your system. | ||
|
|
||
| For instance on Debian/Ubuntu systems you just need to run the following commands | ||
|
|
||
| .. code-block:: sh | ||
| $ sudo apt-get update | ||
| $ sudo apt-get install docker.io | ||
| After Docker is properly installed you can proceed with the Thug installation. Get the | ||
| dockerized Thug from the Honeynet Project's Docker repository at https://hub.docker.com/r/thughoneyclient/thug | ||
|
|
||
| Thug will be installed in the directory */opt/thug*. To run it just execute *python /opt/thug/src/thug.py [options] URL*. | ||
|
|
||
| Download the latest stable container | ||
|
|
||
| .. code-block:: sh | ||
| $ docker pull thughoneyclient/thug | ||
| Then mount your host ~/logs dir and enable it to keep the logs on the host | ||
|
|
||
| .. code-block:: sh | ||
| $ docker run -it -v ~/logs:/logs buffer/thug | ||
| Test the dockerized Thug inside the container analyzing 20 random samples | ||
|
|
||
| .. code-block:: sh | ||
| $ for item in $(find /opt/thug/samples/ -type f | xargs shuf -e |tail -n 20); do python /opt/thug/src/thug.py -l $item; done | ||
| If everything works fine just enjoy your new Thug instance! | ||
| .. _docker: | ||
|
|
||
| Docker | ||
| ====== | ||
|
|
||
| If you want to run up a quick instance of Thug on a couple of malicious web sites or try | ||
| it out but just lack the knowledge and/or time to install it, an alternative exists. Thanks | ||
| to Docker you can run Thug up in a matter of minutes. | ||
|
|
||
| Currently there exist a few docker images in the Docker Hub ready to run. | ||
|
|
||
| Docker is a platform for developers and sysadmins to develop, ship, and run applications. | ||
| Docker lets you quickly assemble applications from components and eliminates the friction | ||
| that can come when shipping code. Docker lets you get your code tested and deployed into | ||
| production as fast as possible. | ||
|
|
||
| Docker consists of: | ||
|
|
||
| * The Docker Engine - a lightweight and powerful open source container virtualization | ||
| technology combined with a work flow for building and containerizing your applications. | ||
| * Docker Hub - a SaaS service for sharing and managing application stacks. | ||
|
|
||
|
|
||
| Installation | ||
| ------------ | ||
|
|
||
| Please refer to http://docs.docker.com/installation/#installation for instructions on how | ||
| to install Docker on your system. | ||
|
|
||
| For instance on Debian/Ubuntu systems you just need to run the following commands | ||
|
|
||
| .. code-block:: sh | ||
| $ sudo apt-get update | ||
| $ sudo apt-get install docker.io | ||
| After Docker is properly installed you can proceed with the Thug installation. Get the | ||
| dockerized Thug from the Honeynet Project's Docker repository at https://hub.docker.com/r/thughoneyclient/thug | ||
|
|
||
| Thug will be installed in the directory */opt/thug*. To run it just execute *python /opt/thug/src/thug.py [options] URL*. | ||
|
|
||
| Download the latest stable container | ||
|
|
||
| .. code-block:: sh | ||
| $ docker pull thughoneyclient/thug | ||
| Then mount your host ~/logs dir and enable it to keep the logs on the host | ||
|
|
||
| .. code-block:: sh | ||
| $ docker run -it -v ~/logs:/logs buffer/thug | ||
| Test the dockerized Thug inside the container analyzing 20 random samples | ||
|
|
||
| .. code-block:: sh | ||
| $ for item in $(find /opt/thug/samples/ -type f | xargs shuf -e |tail -n 20); do python /opt/thug/src/thug.py -l $item; done | ||
| If everything works fine just enjoy your new Thug instance! |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,37 @@ | ||
| .. _intro: | ||
|
|
||
| Introduction | ||
| ============ | ||
|
|
||
| `Thug <https://github.com/buffer/thug>`_ is a Python low-interaction honeyclient based on an hybrid | ||
| static/dynamic analysis approach. | ||
|
|
||
| Thug provides a DOM implementation which is (almost) compliant with W3C DOM Core, HTML, Events, | ||
| Views and Style specifications (Level 1, 2 and partially 3). [#f1]_ | ||
|
|
||
| Thug makes use of the Google V8 Javascript engine [#f2]_ wrapped through STPyV8 [#f3]_ in order to | ||
| analyze malicious Javascript code and of the Libemu library [#f4]_ wrapped through Pylibemu [#f5]_ | ||
| in order to detect and emulate shellcodes. | ||
|
|
||
| Currently 10 Internet Explorer (Windows XP, Windows 2000, Windows 7, Windows 10), 24 Chrome (Windows | ||
| XP, Windows 7, MacOS X, Android 4.0.3, Android 4.0.4, Android 4.1.2, Linux, iOS 7.1, iOS 7.1.1, iOS | ||
| 7.1.2, iOS 8.0.2, iOS 8.1.1, iOS 8.4.1, iOS 9.0.2), 4 Firefox (Windows XP, Windows 7, Linux) and 6 | ||
| Safari (Windows XP, Windows 7, MacOS X, iOS 7.0.4, iOS 8.0.2, iOS 9.1) personalities are emulated | ||
| and about 90 vulnerability modules (ActiveX controls, core browser functionalities, browser plugins) | ||
| are provided. | ||
|
|
||
|
|
||
| .. [#f1] `W3C DOM Specifications <http://www.w3.org/TR/#tr_DOM>`_ | ||
| .. [#f2] `Google V8 <http://code.google.com/p/v8/>`_ is Google's open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. | ||
| V8 implements ECMAScript as specified in ECMA-262, 3rd edition, and runs on Windows XP and Vista, Mac OS X 10.5 (Leopard), and Linux systems that use IA-32 or ARM processors. | ||
| V8 can run standalone, or can be embedded into any C++ application. | ||
| .. [#f3] `STPyV8 <https://github.com/cloudflare/stpyv8/>`_ is a Python wrapper for the Google V8 engine. STPyV8 acts as a bridge between the Python and JavaScript objects and supports | ||
| the Google V8 engine in Python scripts. | ||
| .. [#f4] `Libemu <http://libemu.carnivore.it/>`_ is a small library written in C offering basic x86 emulation and shellcode detection using GetPC heuristics. It is designed to be used | ||
| within network intrusion/prevention detections and honeypots. | ||
| .. [#f5] `Pylibemu <https://github.com/buffer/pylibemu>`_ is a Libemu Cython wrapper | ||
| .. _intro: | ||
|
|
||
| Introduction | ||
| ============ | ||
|
|
||
| `Thug <https://github.com/buffer/thug>`_ is a Python low-interaction honeyclient based on an hybrid | ||
| static/dynamic analysis approach. | ||
|
|
||
| Thug provides a DOM implementation which is (almost) compliant with W3C DOM Core, HTML, Events, | ||
| Views and Style specifications (Level 1, 2 and partially 3). [#f1]_ | ||
|
|
||
| Thug makes use of the Google V8 Javascript engine [#f2]_ wrapped through STPyV8 [#f3]_ in order to | ||
| analyze malicious Javascript code and of the Libemu library [#f4]_ wrapped through Pylibemu [#f5]_ | ||
| in order to detect and emulate shellcodes. | ||
|
|
||
| Currently 10 Internet Explorer (Windows XP, Windows 2000, Windows 7, Windows 10), 24 Chrome (Windows | ||
| XP, Windows 7, MacOS X, Android 4.0.3, Android 4.0.4, Android 4.1.2, Linux, iOS 7.1, iOS 7.1.1, iOS | ||
| 7.1.2, iOS 8.0.2, iOS 8.1.1, iOS 8.4.1, iOS 9.0.2), 4 Firefox (Windows XP, Windows 7, Linux) and 6 | ||
| Safari (Windows XP, Windows 7, MacOS X, iOS 7.0.4, iOS 8.0.2, iOS 9.1) personalities are emulated | ||
| and about 90 vulnerability modules (ActiveX controls, core browser functionalities, browser plugins) | ||
| are provided. | ||
|
|
||
|
|
||
| .. [#f1] `W3C DOM Specifications <http://www.w3.org/TR/#tr_DOM>`_ | ||
| .. [#f2] `Google V8 <http://code.google.com/p/v8/>`_ is Google's open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. | ||
| V8 implements ECMAScript as specified in ECMA-262, 3rd edition, and runs on Windows XP and Vista, Mac OS X 10.5 (Leopard), and Linux systems that use IA-32 or ARM processors. | ||
| V8 can run standalone, or can be embedded into any C++ application. | ||
| .. [#f3] `STPyV8 <https://github.com/cloudflare/stpyv8/>`_ is a Python wrapper for the Google V8 engine. STPyV8 acts as a bridge between the Python and JavaScript objects and supports | ||
| the Google V8 engine in Python scripts. | ||
| .. [#f4] `Libemu <http://libemu.carnivore.it/>`_ is a small library written in C offering basic x86 emulation and shellcode detection using GetPC heuristics. It is designed to be used | ||
| within network intrusion/prevention detections and honeypots. | ||
| .. [#f5] `Pylibemu <https://github.com/buffer/pylibemu>`_ is a Libemu Cython wrapper | ||
Oops, something went wrong.