platypew/ketos

Docker Forensics for Static and Dynamic Analysis

👋🏼 Well Hello There!

$ whoami
Daryl

$ cat aboutme
Currently a student at the Singapore Institute of Technology 🏫
Studying Information Security 🔐

$ ls interests/
🚩 CTFs  📝 Neovim  🍚 Ricing  💻 Programming

$ ls skills/
🐳 Docker  🌳 Git  🕸 Node  🐍 Python

$ cowsay < wisdom
 _____________________________
<  FOSS is love, FOSS is life >
 -----------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

💻 Check out some of my work!

📈 Some stats idk

ketos's Issues

Allow extraction of files from image layer

Use snort to detect any malicious content

Change acquisition request to GET

Use Python to acquire all necessary information and pass it to REST-API

Decide what fields are required to show

Patch dive to show proper diffview

Extract the files changed between base image and container

Bulk extractor to find interesting files in filesystem

Use yara to analyse malicious software

Insert compressed live image to DB

Insert container info to DB

Generate Dockerfile from docker image history

Set DNScat for malware to connect back to C2

Insert image info to DB

Working on mockup for frontend

Generate Dockerfile from image tarfile

Recover deleted items from the image

Insert volume info to DB

Inspect layers and output JSON to stdout

Dump base image into a tarfile

Add image layers to DB

Depends on #28

Use snyk to scan container

Compress base and live images during export

Instructions to setup acquisition environment

Use docker ps to find processes and their PIDs

Calculate sha256 of selected files

Dump running container into tarfile

Inspect networks and output JSON to stdout

Helper function to get logs

Helper function to get container layer

API to allow extraction of specific files

Extract individual layers and find the difference by myself

Capture network on interface

Store dockerfile as file rather than DB

Insert network info to DB

Inspect containers and output JSON into stdout

Change all API calls from POST to PUT

Helper function to get diff between base image and live image for container

Use macrobber and mactime from TSK on container filesystem

Inspect volumes and output JSON to stdout

Allow upload of files to virustotal

Run container live to dump memory

Provide strings search of files

Use ciphey to decode and decrypt interesting strings

DB entry to list all files in container

Check file type of selected files

Compile Dive for macOS

Insert compressed base image to DB

Add dockerfile to DB

Create API for retrieving info