# Docker for Pentest | Image With The More Used Tools To Create A Pentest Environment Easily And Quickly

**URL:** <https://onehack.st/t/docker-for-pentest-image-with-the-more-used-tools-to-create-a-pentest-environment-easily-and-quickly/96828>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [July 19, 2020, 1:48pm UTC](https://onehack.st/t/docker-for-pentest-image-with-the-more-used-tools-to-create-a-pentest-environment-easily-and-quickly/96828 "2020-07-19T13:48:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\
**Post date:** [July 19, 2020, 1:48pm UTC](https://onehack.st/t/docker-for-pentest-image-with-the-more-used-tools-to-create-a-pentest-environment-easily-and-quickly/96828/1 "2020-07-19T13:48:17Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/e/b/ebc742e99002ce622a4d9d8e32f07215dbc656a2.jpeg)

[![GitHub code size in bytes](https://camo.githubusercontent.com/12cc42cbf5c168b31cc47032f0573a179b361c7d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f636f64652d73697a652f616161677569727265702f70656e74657374)](https://github.com/aaaguirrep/pentest) [![GitHub repo size](https://camo.githubusercontent.com/5eaec13edd6de76d6af4c852e8b5ea21405d8e3b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f7265706f2d73697a652f616161677569727265702f70656e74657374)](https://github.com/aaaguirrep/pentest) [![GitHub last commit](https://camo.githubusercontent.com/4eb7ba5b0b7906dbe5b967aba2fd7861bb2a6cd3/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6173742d636f6d6d69742f616161677569727265702f70656e74657374)](https://github.com/aaaguirrep/pentest) [![GitHub issues](https://camo.githubusercontent.com/e003260bf923972bec082409d89dad88b2cc2e8a/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6973737565732f616161677569727265702f70656e74657374)](https://github.com/aaaguirrep/pentest) [![Docker Cloud Build Status](https://camo.githubusercontent.com/619662efab0cf17da03f497bc9d0d03d859f6cb5/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f636c6f75642f6275696c642f616161677569727265702f70656e74657374)](https://hub.docker.com/r/aaaguirrep/pentest) [![Docker Automated build](https://camo.githubusercontent.com/1a5ec60de452676de238291b80316c6316e949fa/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f6175746f6d617465642f616161677569727265702f70656e74657374)](https://hub.docker.com/r/aaaguirrep/pentest) [![Docker Pulls](https://camo.githubusercontent.com/f646c98f780756f48b084029741ee55d9c70dbbb/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f70756c6c732f616161677569727265702f70656e74657374)](https://hub.docker.com/r/aaaguirrep/pentest) [![Docker Image Size (latest by date)](https://camo.githubusercontent.com/d901c526c3e6793de265d433dd9a301f6ac6a4d5/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f696d6167652d73697a652f616161677569727265702f70656e74657374)](https://hub.docker.com/r/aaaguirrep/pentest) [![Docker Image Version (latest by date)](https://camo.githubusercontent.com/4195f4b5e0d3b0949e5ce24bb9e921c24e399964/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f762f616161677569727265702f70656e74657374)](https://hub.docker.com/r/aaaguirrep/pentest) [![Docker Stars](https://camo.githubusercontent.com/d28bf8bc94b160d8c129a53cfa8c5319f2ef32ff/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f73746172732f616161677569727265702f70656e74657374)](https://hub.docker.com/r/aaaguirrep/pentest) [![GitHub](https://camo.githubusercontent.com/2556ffe09c60389a6d9bfc2921dc5714f46ef305/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f616161677569727265702f70656e74657374)](https://github.com/aaaguirrep/pentest/blob/master/LICENSE)

Docker for pentest is an image with the more used tools to create an pentest environment easily and quickly.

## Features

- OS, networking, developing and pentesting tools installed.
- Connection to HTB (Hack the Box) vpn to access HTB machines.
- Popular wordlists installed: SecLists, dirb, dirbuster, fuzzdb, wfuzz and rockyou.
- Proxy service to send traffic from any browsers and burp suite installed in your local directory.
- Exploit database installed.
- Tool for cracking password.
- Linux enumeration tools installed.
- Tools installed to discovery services running.
- Tools installed to directory fuzzing.
- Monitor for linux processes without root permissions
- Zsh shell installed.

## Tools installed

### Operative system tools

- rdate
- vim
- zsh
- oh-my-zsh
- locate
- cifs-utils
- htop
- [gotop](https://github.com/cjbassi/gotop)

### Network tools

- traceroute
- telnet
- net-tools
- iputils-ping
- tcpdump
- openvpn
- whois
- host
- prips
- dig

### Developer tools

- git
- curl
- wget
- ruby
- go
- python
- python-pip
- python3
- python3-pip
- php
- aws-cli
- [tojson](https://github.com/tomnomnom/hacks/tree/master/tojson)
- nodejs

### 🔪 Pentest tools

#### Port scanning

- [nmap](https://github.com/nmap/nmap)
- [masscan](https://github.com/robertdavidgraham/masscan)
- [ScanPorts](https://github.com/aaaguirrep/scanPorts) created by [@s4vitar](https://github.com/s4vitar) with some improvements

#### 🔍 Recon

- **Subdomains**
  - [Amass](https://github.com/OWASP/Amass)
  - [GoBuster](https://github.com/OJ/gobuster)
  - [Knock](https://github.com/guelfoweb/knock)
  - [MassDNS](https://github.com/blechschmidt/massdns)
  - [Altdns](https://github.com/infosec-au/altdns)
  - [spyse](https://github.com/zeropwn/spyse.py)
  - [Sublist3r](https://github.com/aboul3la/Sublist3r)
  - [findomain](https://github.com/Edu4rdSHL/findomain)
  - [subfinder](https://github.com/projectdiscovery/subfinder)
  - [spiderfoot](https://github.com/smicallef/spiderfoot)
  - [haktldextract](https://github.com/hakluke/haktldextract)

- **Subdomain takeover**
  - [subjack](https://github.com/haccer/subjack)
  - [SubOver](https://github.com/Ice3man543/SubOver)
  - [tko-subs](https://github.com/anshumanbh/tko-subs)

- **DNS Lookups**
  - [hakrevdns](https://github.com/hakluke/hakrevdns)

- 📷 **Screenshot**
  - [gowitness](https://github.com/sensepost/gowitness)
  - [aquatone](https://github.com/michenriksen/aquatone)

- 🕸 **Crawler**
  - [hakrawler](https://github.com/hakluke/hakrawler)
  - [Photon](https://github.com/s0md3v/Photon)
  - [gospider](https://github.com/jaeles-project/gospider)
  - [gau](https://github.com/lc/gau)
  - [otxurls](https://github.com/lc/otxurls)
  - [waybackurls](https://github.com/tomnomnom/waybackurls)

- 📁 **Search directories**
  - [dirsearch](https://github.com/maurosoria/dirsearch)

- **Fuzzer**
  - [wfuzz](https://github.com/xmendez/wfuzz)
  - [ffuf](https://github.com/ffuf/ffuf)

- **Web Scanning**
  - [whatweb](https://github.com/urbanadventurer/WhatWeb)
  - [wafw00z](https://github.com/EnableSecurity/wafw00f)
  - [nikto](https://github.com/sullo/nikto)
  - [arjun](https://github.com/s0md3v/Arjun)
  - [httprobe](https://github.com/tomnomnom/httprobe)
  - [striker](https://github.com/s0md3v/Striker)
  - [hakcheckurl](https://github.com/hakluke/hakcheckurl)

- **CMS**
  - [wpscan](https://github.com/wpscanteam/wpscan)
  - [joomscan](https://github.com/rezasp/joomscan)
  - [droopescan](https://github.com/droope/droopescan)
  - [cmseek](https://github.com/Tuhinshubhra/CMSeeK)

- **Search JS**
  - [LinkFinder](https://github.com/GerbenJavado/LinkFinder)
  - [getJS](https://github.com/003random/getJS)
  - [subjs](https://github.com/lc/subjs)

#### Wordlist

- [cewl](https://github.com/digininja/CeWL)
- wordlists:
  - [wfuzz](https://github.com/xmendez/wfuzz)
  - [SecList](https://github.com/danielmiessler/SecLists)
  - [Fuzzdb](https://github.com/fuzzdb-project/fuzzdb)
  - [Dirbuster](https://github.com/daviddias/node-dirbuster)
  - [Dirb](https://github.com/v0re/dirb)
  - [Rockyou](https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt)
  - [all.txt](https://gist.github.com/jhaddix/f64c97d0863a78454e44c2f7119c2a6a)

- crunch

#### Git repositories

- [gitleaks](https://github.com/zricethezav/gitleaks)
- [gitrob](https://github.com/michenriksen/gitrob)
- [gitGraber](https://github.com/hisxo/gitGraber)
- [github-search](https://github.com/gwen001/github-search)
- [GitTools](https://github.com/internetwache/GitTools)

#### OWASP

- [sqlmap](https://github.com/sqlmapproject/sqlmap)
- [XSStrike](https://github.com/s0md3v/XSStrike)
- [kxss](https://github.com/tomnomnom/hacks/tree/master/kxss)
- [dalfox](https://github.com/hahwul/dalfox)
- [jwt\_tool](https://github.com/ticarpi/jwt_tool)

#### 📱 Mobile

- [apktool](https://ibotpeaches.github.io/Apktool/)

#### Brute force

- [crowbar](https://github.com/galkan/crowbar)
- [hydra](https://github.com/vanhauser-thc/thc-hydra)
- [patator](https://github.com/lanjelot/patator)
- medusa

#### Cracking

- [hashid](https://github.com/psypanda/hashID)
- [john the ripper](https://github.com/magnumripper/JohnTheRipper)
- [hashcat](https://github.com/hashcat/hashcat)

#### OS Enumeration

- [htbenum](https://github.com/SolomonSklash/htbenum)
- [linux-smart-enumeration](https://github.com/diego-treitos/linux-smart-enumeration)
- [linenum](https://github.com/rebootuser/LinEnum)
- [enum4linux](https://github.com/portcullislabs/enum4linux)
- [ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump)
- [PEASS - Privilege Escalation Awesome Scripts SUITE](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite)
- [Windows Exploit Suggester - Next Generation](https://github.com/bitsadmin/wesng)
- [smbmap](https://github.com/ShawnDEvans/smbmap)
- [pspy - unprivileged Linux process snooping](https://github.com/DominicBreuker/pspy)
- smbclient
- ftp

#### Exploits

- [searchsploit](https://github.com/offensive-security/exploitdb)
- [Metasploit](https://github.com/rapid7/metasploit-framework)
- [MS17-010](https://github.com/worawit/MS17-010)
- [AutoBlue-MS17-010](https://github.com/3ndG4me/AutoBlue-MS17-010)
- [PrivExchange](https://github.com/dirkjanm/PrivExchange)

#### Windows

- [evil-winrm](https://github.com/Hackplayers/evil-winrm)
- [impacket](https://github.com/SecureAuthCorp/impacket)
- [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec)
- [Nishang](https://github.com/samratashok/nishang)
- [Juicy Potato](https://github.com/ohpe/juicy-potato)
- [PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
- [pass-the-hash](https://github.com/byt3bl33d3r/pth-toolkit)
- [mimikatz](https://github.com/gentilkiwi/mimikatz)
- gpp-decrypt

#### Reverse shell

- [netcat](https://github.com/diegocr/netcat)
- [rlwrap](https://github.com/hanslub42/rlwrap)

#### Other resources

- [pentest-tools](https://github.com/gwen001/pentest-tools) from [@gwen001](https://github.com/gwen001)
- [qsreplace](https://github.com/tomnomnom/qsreplace) from [@tomnomnom](https://github.com/tomnomnom)

### Custom functions

- NmapExtractPorts from [@s4vitar](https://github.com/s4vitar)

### Other services

- apache2
- squid

## 📝 Documentation

See the project’s [wiki](https://github.com/aaaguirrep/pentest/wiki) for documentation.

## 🛠 Usage

### Prerequisites

- Docker service installed

You can use the docker image by the next two options:

### Option 1 - Use the github repository

```auto
git clone --depth 1 https://github.com/aaaguirrep/pentest.git
cd pentest
docker build -t pentest .
docker run --rm -it --name my-pentest pentest /bin/zsh

```

### Option 2 - Use the image from docker hub

Use image from docker hub: [aaaguirrep/pentest](https://hub.docker.com/r/aaaguirrep/pentest)

```auto
docker pull aaaguirrep/pentest
docker run --rm -it --name my-pentest pentest /bin/zsh

```

### Considerations to run the container

There are differents use cases for use the image and you should know how to run the container properly.

1. Use the container to access HTB (Hack the Box) machines by HTB vpn.

```auto
 docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun --sysctl net.ipv6.conf.all.disable_ipv6=0 --name my-pentest aaaguirrep/pentest /bin/zsh

```

1. Share information from your local directory to container directory and save information on your local directory. You should save information under /pentest directory.

```auto
 docker run --rm -it -v /path/to/local/directory:/pentest --name my-pentest aaaguirrep/pentest /bin/zsh

```

1. Expose internal container services (apache, squid) for your local environment.

```auto
 docker run --rm -it --name my-pentest -p 80:80 -p 3128:3128 aaaguirrep/pentest /bin/zsh

```

Inside the container start apache2 and squid services by the aliases.

```auto
 apacheUp
 squidUp

```

1. Mount directories by umount command.

```auto
 docker run --rm -it --privileged --name my-pentest aaaguirrep/pentest /bin/zsh

```

1. Tools are downloaded in /tools directory.

## ⚙ Nice configurations

You can set up the docker image with nice configurations like as:

### 1. Alias to connect to HTB (Hack the Box) VPN

To use both options you should use -v option to map local directoty with /pentest container directory.

#### Option 1 - HTB VPN using github repository

Add the next line in step “Create shorcuts” in Dockerfile, build a new image and run a new container with the -v option.

```auto
RUN echo "alias vpnhtb=\"openvpn /pentest/path/to/ovpn/file\"" >> /root/.zshrc

```

#### Option 2 - HTB VPN using docker hub image

Create a new Dockerfile with the next steps, build a new image and run a new container with -v option.

```auto
FROM aaaguirrep/pentest

# Create a shortcut and load the ovpn file from workstation
RUN echo "alias vpnhtb=\"openvpn /pentest/path/to/ovpn/file\"" >> /root/.zshrc

```

### 2. Save and load command history in your local environment

When you delete a container all information is deleted incluide command history. The next configuration provides you an option for save the command history in your local environment and load it when you run a new container. So, you wont lose your command history when run a new container.

To use both options you should use -v option to map local directoty with /pentest container directory.

#### Option 1 - Command history using github repository

Add the next line in step “Create shorcuts” in Dockerfile, build a new image and run a new container.

```auto
# Save and load command history in your local environment
RUN sed -i '1i export HISTFILE="/pentest/.zsh_history"' /root/.zshrc

```

#### Option 2 - Command history using docker hub image

Create a new Dockerfile with the next steps, build a new image and run a new container.

```auto
FROM aaaguirrep/pentest

# Save and load command history in your local environment
RUN sed -i '1i export HISTFILE="/pentest/.zsh_history"' /root/.zshrc

```

## ✅ Environment tested

The image was tested in the following environments:

- Docker service for Mac: Docker version 19.03.5, build 633a0ea
- Docker service for Linux instance on Google Cloud Platform: Docker version 19.03.6, build 369ce74a3c

## ⚠ Warning

- Do not save information on container directories because it will be lost after delete the container, you should save information in your local environment using the parameter -v when you run the container. For instance:

```auto
docker run --rm -it -v /path/to/local/directory:/pentest --name my-pentest aaaguirrep/pentest /bin/zsh

```

The above command specify a path local directory mapped with /pentest container directory. You should save all information under /pentest directory.

- Use hashcat and john the ripper on controlled environments as CTF. You can experiment issues.

## Contributing

[Contributing Guide](https://github.com/aaaguirrep/pentest/blob/master/CONTRIBUTING.md)

## License

[MIT](https://github.com/aaaguirrep/pentest/blob/master/LICENSE)

Copyright (c) 2020, Arsenio Aguirre

## GitHub:

> **[GitHub - aaaguirrep/offensive-docker: Offensive Docker is an image with the more used...](https://github.com/aaaguirrep/offensive-docker)**
>
> Offensive Docker is an image with the more used offensive tools to create an environment easily and quickly to launch assessment to the targets.