DEV Community

Ian Muchina
Ian Muchina

Posted on • Originally published at ianmuchina.com on

Building a Pentest lab with Docker

#docker #infosec

What is Docker?

Docker LogoDocker is a container platform that is similar to a Hypervisor like Virtualbox. Containers use less storage and RAM and are portable.

Docker can run on:

  • Linux
  • Windows
  • Mac OS

In this article I will go over how to set up a penetration testing lab entirely in docker

It will consist of two types of containers.

  1. Attacker Machine
  2. Target Machines

Installation on Linux

The Docker engine is in the official repositories of most Linux distributions.

Ubuntu/Debian

Anything that uses apt to install software is Debian based. Find a complete list here

To install on Ubuntu :

$ sudo apt install docker.io
Enter fullscreen mode Exit fullscreen mode

Fedora

To install on fedora:

$ sudo dnf install docker
Enter fullscreen mode Exit fullscreen mode

Start the Docker service

$ sudo systemctl start docker
Enter fullscreen mode Exit fullscreen mode

Arch/Manjaro

To install Arch based distros:

$ sudo pacman -Syu
Enter fullscreen mode Exit fullscreen mode

Enable the loop kernel module

$ sudo tee /etc/modules-load.d/loop.conf <<< "loop"
$ modprobe loop
Enter fullscreen mode Exit fullscreen mode

Install Docker

$ sudo pacman -S docker
Enter fullscreen mode Exit fullscreen mode

Start and enable the service

$ sudo systemctl start docker.service
$ sudo systemctl enable docker.service
Enter fullscreen mode Exit fullscreen mode

Docker on Windows

To run docker in windows, install Docker desktop.

Docker Desktop is an awesome app with a graphical interface. It can run Linux containers from windows. However, there’s one major deal-breaker.

Docker Desktop cannot co-exist with VirtualBox or VMware, because it requires Hyper-V to run Linux containers😤1.

Hyper-V is Microsoft’s hardware virtualization product

As a workaround.

  • Use Docker Toolbox 👨‍💻
  • Learn Hyper-V 📚
  • Install Linux 🤷‍♀️

This is also the same reason WSL cannot co-exist with VMware/Virtualbox.

Now I’m starting to see why people hate Microsoft. They lock users to their ecosystem.

Hello World

After you have installed docker, run this command as a test

$ sudo docker run hello-world
Enter fullscreen mode Exit fullscreen mode

If it completes successfully, you can follow along

The Network

The network will be called vulnerable. It will have a 10.0.0/24 subnet

Create it with this command

$ sudo docker network create vulnerable --attachable --subnet 10.0.0.0/24
Enter fullscreen mode Exit fullscreen mode

Attacker Container

For this, I will use Parrot OS. It’s docker images are better Kali Linux Images.

First download the Parrot OS Docker image. This command will take a while depending on your internet connection.

$ docker pull parrotsec/security:latest
Enter fullscreen mode Exit fullscreen mode

Create and run the container .

sudo docker run \
    --name parrot \
    -it \
    --hostname parrot \
    --network vulnerable \
    --ip="10.0.0.2" \
    --env DISPLAY=$DISPLAY \
    -v /dev/shm:/dev/shm \
    --device /dev/snd \
    --device /dev/dri \
    --mount type=bind,src=/tmp/.X11-unix,dst=/tmp/.X11-unix \
    parrotsec/security:latest \
    /bin/bash
Enter fullscreen mode Exit fullscreen mode

All tools available in Parrot OS are now an apt-get away.

Use this command to restart the parrot OS container after a reboot.

$ sudo docker start -a parrot
Enter fullscreen mode Exit fullscreen mode

Target container:Metasploitable2

This is a very vulnerable test machine. It is what I recommend for anyone starting out.

Open another terminal and pull the metasploitable image. The image is around 500MB.

$ docker pull tleemcjr/metasploitable2
Enter fullscreen mode Exit fullscreen mode

To run a metasploitable container:

docker run \
    -it \
    --network vulnerable \
    --ip="10.0.0.3" \
    --name metasploitable \
    --hostname metasploitable2 \
    tleemcjr/metasploitable2 \
    bash
Enter fullscreen mode Exit fullscreen mode

You should see a terminal prompt like this

root@metasploitable2:/#
Enter fullscreen mode Exit fullscreen mode

Start the vulnerable services

root@metasploitable2:/# services.sh
Enter fullscreen mode Exit fullscreen mode

You can now access metasploitable from 10.0.0.3

If you want to stop the container, close the terminal with CTRL + D

Run this command to start metasploitable again

$ sudo docker start -a parrot
Enter fullscreen mode Exit fullscreen mode

Then start the vulnerable services.

root@metasploitable2:/# services.sh
Enter fullscreen mode Exit fullscreen mode

Guides & Tutorials

There are tons of free guides out there on metasploitable.

  1. The Easiest Metasploit Guide You’ll Ever Read
  2. Metasploit Unleashed
  3. Metasploitable 2 Exploitability Guide
  4. Youtube Tutorials

If you don’t know what guide to use, I recommend this one.

More vulnerable containers 🧑‍💻

You can extend the lab with any of these containers depending on your learning goal.

OWASP Juiceshop

This container focusses on web application security.

To create and start the juiceshop container for the first time

docker run -d \
    --name juiceshop \
    --network vulnerable \
    --ip="10.0.0.6" \
    bkimminich/juice-shop
Enter fullscreen mode Exit fullscreen mode

Check if it is running

$ docker ps
Enter fullscreen mode Exit fullscreen mode

Access the web interface from this URL

http://10.0.0.6:3000/

Stop the container when you’re done

docker stop juiceshop
Enter fullscreen mode Exit fullscreen mode

Start the container again

docker start juiceshop
Enter fullscreen mode Exit fullscreen mode
Juiceshop Guides

OWASP Webgoat 🐐

Webgoat is a ctf-style vulnerable container focused on web application security.

Create and run the container for the first time

docker run -d \
    --name webgoat \
    --network vulnerable \
    --ip="10.0.0.4" \
    -e TZ=$(cat /etc/timezone) \
    webgoat/goatandwolf
Enter fullscreen mode Exit fullscreen mode

Access Webgoat and Webwolf from these URLs

10.0.0.4:8080/WebGoat

10.0.0.4:9090/WebWolf

To stop the container

docker stop webgoat
Enter fullscreen mode Exit fullscreen mode

To Start the container again.

docker start webgoat
Enter fullscreen mode Exit fullscreen mode

If you can’t access the url, check if it is running.

$ docker ps -a
Enter fullscreen mode Exit fullscreen mode

Why I use docker for a pentest lab

Two Operating systems make my computer painfully slow. Containers aren’t resource-intensive and perform well. This fits my use case.

If you have RAM to spare then it’s really not that much of a difference.

When not to use Docker

If you want to run Windows containers on a Linux host. You can run linux containers on WIndows though

Common Docker Commands

Stop a container:

$ sudo docker stop containerName
Enter fullscreen mode Exit fullscreen mode

Start a container

$ sudo docker start containerName
Enter fullscreen mode Exit fullscreen mode

List running and stopped containers

$ sudo docker ps -a
Enter fullscreen mode Exit fullscreen mode

Spawn a bash shell in a running container

$ sudo docker exec -it containerName bash
Enter fullscreen mode Exit fullscreen mode

Docker has tab completion for each of these commands.

Graphical apps inside docker

Sometimes you may want to run a GUI tool like firefox or burpsuite.

The Parrot OS commands above are already set for running graphical apps. You only need to install these packages

$ apt install hicolor-icon-theme \
    libcanberra-gtk* libgl1-mesa-dri \
    libgl1-mesa-glx libpangox-1.0-0 \
    libpulse0 libv4l-0 fonts-symbola \
Enter fullscreen mode Exit fullscreen mode

You can run a few commands to avoid some errors encountered when running GUI apps

Burpsuite

Burp Suite is a web app pentesting tool for monitoring http requests and responses.

To install and run burpsuite inside the parrot os container.

# sudo apt update
# sudo apt install burpsuite
# java -jar -Xmx2G /usr/bin/burpsuite
Enter fullscreen mode Exit fullscreen mode

You can then point your browser to use 10.0.0.2:8080 as the proxy and burp will intercept everything

Firefox

Firefox, is a free and open-source web browser.

To install and run firefox:

$ apt install firefox ca-certificates
Enter fullscreen mode Exit fullscreen mode

Credits

Illustrations from Freepik

Further reading/research

Jess Frazelle has written an awesome blog post with details on running graphical apps inside Docker containers. She’s also given this awesome Talk/Demo on running various applications and retro games inside docker containers.

Footnotes

Docker requires a Linux kernel to run Linux containers on Windows. Docker accomplishes this by running a Linux Virtual Machine inside Hyper-V. This is still more resource-efficient than full VM’s. Plus there’s the added benefit of running both Windows and Linux containers. This is not possible on Linux ↩

Top comments (1)

Collapse
 
eliasibgerardo profile image
Gerardo Eliasib •

Hi bro!
Do you think it is possible to build a web panel that communicates with the dockers to turn them on or off from there?
Thank you very much!
It was an excellent article...

Read next

huizhou92 profile image

Go program pattern 05 : Decorations

huizhou92 -

dbillion profile image

Unlocking the Power of Databases in Java with JDBC

Oludayo Adeoye -

avbravo profile image

Utilizar iconos css.gg con Primefaces

aristides villarreal -

celsojr profile image

Closures: Performance implications

Celso Jr -