Ecosyste.ms: Repos
An open API service providing repository metadata for many open source software ecosystems.
GitHub / Recruit-CSIRT / odoriba
Malware Dynamic Analysis Platform enhanced Cuckoo Sandbox
JSON API: https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Recruit-CSIRT%2Fodoriba
Stars: 23
Forks: 8
Open Issues: 0
License: None
Language: Python
Repo Size: 29.8 MB
Dependencies:
267
Created: almost 7 years ago
Updated: over 2 years ago
Last pushed: over 6 years ago
Last synced: over 1 year ago
Files
Loading...
Readme
Loading...
Dependencies
- alembic *
- flask *
- flask-sqlalchemy *
- psycopg2 *
- requests *
- sqlalchemy *
- AdditionalSoftware *
- AlsointhiscasePython2.7ispreferred. *
- AtthispointyoushouldhaveinstalledeverythingneededbyCuckootorun *
- Cuckooguestcomponent.Theyinclude *
- Dependingonwhatkindoffilesyouwanttoanalyzeandwhatkindofsandboxed *
- InordertomakeCuckoorunproperlyinyourvirtualizedWindowssystem ,you
- InstallPython *
- PythonisastrictrequirementfortheCuckooguestcomponent *
- Remembertodisablethe *
- Requirements *
- SomePythonlibrariesareoptionalandprovidesomeadditionalfeaturesto *
- TheyarenotstrictlyrequiredbyCuckootoworkproperly ,butyouareencouraged
- Thisiscompletelyuptoyouandtowhatyourneedsare.Youcangetsomehints *
- Windowsenvironmentyouwanttorunthemalwaresamplesin ,youmightwanttoinstall
- YoucandownloadtheproperWindowsinstallerfromthe *
- additionalsoftwaresuchasbrowsers ,PDFreaders,officesuitesetc.
- anyadditionalsoftware. *
- byreadingthe *
- ordertorunproperly. *
- properly. *
- todownloadandinstalltheproperpackagesaccordingtoyourPythonversion. *
- toinstallthemifyouwanttohaveaccesstoallavailablefeatures.Makesure *
- willhavetoinstallsomerequiredsoftwareandlibraries. *
- AdditionalHostRequirements *
- AdditionalSoftware *
- AlsointhiscasePython2.7ispreferred. *
- AtthispointyoushouldhaveinstalledeverythingneededbyCuckootorun *
- Cuckooguestcomponent.Theyinclude *
- Dependingonwhatkindoffilesyouwanttoanalyzeandwhatkindofsandboxed *
- Inorderforthephysicalmachinemanagertowork ,youmusthaveaway
- InordertomakeCuckoorunproperlyinyourphysicalWindowssystem ,you
- InstallPython *
- OnDebian *
- PythonisastrictrequirementfortheCuckooguestcomponent *
- Remembertodisablethe *
- Requirements *
- SomePythonlibrariesareoptionalandprovidesomeadditionalfeaturesto *
- The *
- ThephysicalmachinemanagerusesRPCrequeststorebootphysicalmachines. *
- TheyarenotstrictlyrequiredbyCuckootoworkproperly ,butyouareencouraged
- Thisiscompletelyuptoyouandtowhatyourneedsare.Youcangetsomehints *
- Windowsenvironmentyouwanttorunthemalwaresamplesin ,youmightwanttoinstall
- YoucandownloadtheproperWindowsinstallerfromthe *
- additionalsoftwaresuchasbrowsers ,PDFreaders,officesuitesetc.
- anyadditionalsoftware. *
- byreadingthe *
- forphysicalmachinestobereturnedtoacleanstate.Indevelopment *
- fromthesamba-common-binpackage. *
- ordertorunproperly. *
- properly. *
- thephysicalmachines.However ,anyre
- todownloadandinstalltheproperpackagesaccordingtoyourPythonversion. *
- toinstallthemifyouwanttohaveaccesstoallavailablefeatures.Makesure *
- willhavetoinstallsomerequiredsoftwareandlibraries. *
- AssumingyoudecidetogoforVirtualBox ,youcangettheproperpackagefor
- Asyouwillseethroughoutthisdocumentation ,you
- BeforeproceedingonconfiguringCuckoo ,you
- BydefaultCuckooadopts *
- CuckoohostcomponentsarecompletelywritteninPython ,thereforemakesureto
- Cuckooonadedicatedsystemoratrustedenvironmentwheretheprivilegedtcpdump *
- Despiteheavilyrelyingon *
- ForthesakeofthisguidewewillassumethatyouhaveVirtualBoxinstalled *
- Ifyoudon *
- IfyouwanttouseKVMit *
- IfyouwanttouseXenServeryou *
- Ifyouwanttousethe *
- IfyouwanttousetheDjango-basedwebinterface ,you
- IncombinationwithCuckoo ,itcanautomaticallyprovideadditionalvisibility
- Inordertodumpthenetworkactivityperformedbythemalwareduring *
- Inordertofunctionproperly ,Cuckoorequiresatleastversion2.3ofVolatility.
- Inordertoproperlyfunction ,Cuckoorequiressomedependencies.TheycanallbeinstalledthroughPyPIlikethis
- InstallingPythonlibraries *
- InstallingTcpdump *
- InstallingVolatility *
- InstallitonUbuntu *
- Installthebasicdependencies *
- Orotherwise *
- Pleasekeepinmindthateventhe *
- Requirements *
- Seethevolatilitydocumentationfordetailedinstructionsonhowtoinstallit. *
- Tcpdumprequiresrootprivileges ,butsinceyoudon
- TheinstallationofVirtualBoxisoutsidethescopeofthisdocumentation ,ifyou
- VirtualizationSoftware *
- Volatilityisanoptionaltooltodoforensicanalysisonmemorydumps. *
- Youarecompletelyresponsibleforthechoice ,configurationandexecutionof
- Youcangetitfromthe *
- Youcanverifytheresultsoflastcommandwith *
- andsupport. *
- architecturallyindependentfromthevirtualizationsoftware. *
- arenotfamiliarwithitpleaserefertothe *
- execution ,you
- executionandgeneralconfigurationofthesandbox. *
- executioniscontainedotherwise. *
- haveanappropriateversioninstalled.Forthecurrentrelease *
- ifthesystemhasotheruserswhicharepotentiallyuntrusted.Werecommendtorun *
- intodeepmodificationsintheoperatingsystemaswellasdetectthepresence *
- itinourchannelsandlists *
- manually ,sopleaserefertotheirwebsites.
- modulestosupportanysoftwareofyourchoice. *
- ofrootkittechnologythatescapedthemonitoringdomainofCuckoo *
- softwareandlibraries. *
- thetrafficanddumpittoafile. *
- you *
- youneedtoinstall *
- yourdistributionatthe *
- yourvirtualizationsoftware ,thereforepleaserefrainfromaskingforhelpon
- AdditionalSoftware *
- AtthispointyoushouldhaveinstalledeverythingneededbyCuckooto *
- Dependingonwhatkindoffilesyouwanttoanalyzeandwhatkindof *
- InordertomakeCuckoorunproperlyinyourvirtualizedWindows *
- InstallPython *
- PythonisastrictrequirementfortheCuckooguestcomponent *
- Requirements *
- SomePythonlibrariesareoptionalandprovidesomeadditional *
- TheyarenotstrictlyrequiredbyCuckootoworkproperly ,butyouare
- Thisiscompletelyuptoyouandtowhatyourneedsare.Youcanget *
- Windowsdesktopduringtheanalysis. *
- YoucandownloadtheproperWindowsinstallerfromtheofficial *
- accordingtoyourPythonversion. *
- encouragedtoinstallthemifyouwanttohaveaccesstoallavailable *
- features.Makesuretodownloadandinstalltheproperpackages *
- featurestoCuckooguestcomponent.Theyinclude *
- readers ,officesuitesetc.Remembertodisablethe
- runproperly. *
- sandboxedWindowsenvironmentyouwanttorunthemalwaresamplesin ,
- somehintsbyreadingthe *
- system ,youwillhavetoinstallsomerequiredsoftwareandlibraries.
- website.AlsointhiscasePython2.7ispreferred. *
- youmightwanttoinstalladditionalsoftwaresuchasbrowsers ,PDF
- AdditionalHostRequirements *
- AdditionalSoftware *
- AtthispointyoushouldhaveinstalledeverythingneededbyCuckooto *
- Dependingonwhatkindoffilesyouwanttoanalyzeandwhatkindof *
- Inorderforthephysicalmachinemanagertowork ,youmusthaveaway
- InordertomakeCuckoorunproperlyinyourphysicalWindowssystem ,
- InstallPython *
- OnDebian *
- PythonisastrictrequirementfortheCuckooguestcomponent *
- Requirements *
- SomePythonlibrariesareoptionalandprovidesomeadditional *
- The *
- ThephysicalmachinemanagerusesRPCrequeststorebootphysical *
- TheyarenotstrictlyrequiredbyCuckootoworkproperly ,butyouare
- Thisiscompletelyuptoyouandtowhatyourneedsare.Youcanget *
- Windowsdesktopduringtheanalysis. *
- YoucandownloadtheproperWindowsinstallerfromtheofficial *
- accomplishthis. *
- accordingtoyourPythonversion. *
- availablefromthesamba-common-binpackage. *
- encouragedtoinstallthemifyouwanttohaveaccesstoallavailable *
- features.Makesuretodownloadandinstalltheproperpackages *
- featurestoCuckooguestcomponent.Theyinclude *
- forphysicalmachinestobereturnedtoacleanstate.In *
- imagingplatformcanbeused *
- machines. *
- platformtohandlere-imagingthephysicalmachines.However ,anyre
- readers ,officesuitesetc.Remembertodisablethe
- runproperly. *
- sandboxedWindowsenvironmentyouwanttorunthemalwaresamplesin ,
- somehintsbyreadingthe *
- website.AlsointhiscasePython2.7ispreferred. *
- youmightwanttoinstalladditionalsoftwaresuchasbrowsers ,PDF
- youwillhavetoinstallsomerequiredsoftwareandlibraries. *
- AssumingyoudecidetogoforVirtualBox ,youcangettheproper
- BeforeproceedingonconfiguringCuckoo ,you
- BydefaultCuckooadoptstcpdump ,theprominentopensourcesolution.
- CuckoohostcomponentsarecompletelywritteninPython ,therefore
- DespiteheavilyrelyingonVirtualBoxinthepast ,Cuckoohasmovedon
- ForthesakeofthisguidewewillassumethatyouhaveVirtualBox *
- Ifyoudon *
- IfyouwanttouseKVMit *
- IfyouwanttouseXenServeryou *
- Ifyouwanttousethe *
- IfyouwanttousetheDjango-basedwebinterface ,you
- Inordertodumpthenetworkactivityperformedbythemalwareduring *
- Inordertofunctionproperly ,Cuckoorequiresatleastversion2.3of
- Inordertoproperlyfunction ,Cuckoorequiressomedependencies.They
- InstallingPythonlibraries *
- InstallingTcpdump *
- InstallingVolatility *
- InstallitonUbuntu *
- Installthebasicdependencies *
- Orotherwise *
- Pleasekeepinmindthateventhe *
- Pythonpackage *
- Requirements *
- Seethevolatilitydocumentationfordetailedinstructionsonhowto *
- Tcpdumprequiresrootprivileges ,butsinceyoudon
- VirtualizationSoftware *
- Volatility.Youcangetitfromtheofficialrepository. *
- Volatilityisanoptionaltooltodoforensicanalysisonmemory *
- YaraandPydeepare *
- Youarecompletelyresponsibleforthechoice ,configurationand
- Youcanverifytheresultsoflastcommandwith *
- additionalvisibilityintodeepmodificationsintheoperatingsystem *
- affectanyhowtheexecutionandgeneralconfigurationofthesandbox. *
- andwritemodulestosupportanysoftwareofyourchoice. *
- aswellasdetectthepresenceofrootkittechnologythatescapedthe *
- beingarchitecturallyindependentfromthevirtualizationsoftware.As *
- binary *
- canallbeinstalledthroughPyPIlikethis *
- capturethetrafficanddumpittoafile. *
- containedotherwise. *
- documentation. *
- dumps.IncombinationwithCuckoo ,itcanautomaticallyprovide
- execution ,you
- executionofyourvirtualizationsoftware ,thereforepleaserefrain
- fromaskingforhelponitinourchannelsandlists *
- generatedtraffic *
- ifyouarenotfamiliarwithitpleaserefertotheofficial *
- installMongoDBtoo *
- installationofVirtualBoxisoutsidethescopeofthisdocumentation ,
- installed *
- installit. *
- makesuretohaveanappropriateversioninstalled.Forthecurrent *
- manually ,sopleaserefertotheirwebsites.
- monitoringdomainofCuckoo *
- packageforyourdistributionattheofficialdownloadpage.The *
- perfectlysafeifthesystemhasotheruserswhicharepotentially *
- release *
- requiredsoftwareandlibraries. *
- runasrootyou *
- software *
- thefollowingcommand *
- trustedenvironmentwheretheprivilegedtcpdumpexecutionis *
- untrusted.WerecommendtorunCuckooonadedicatedsystemora *
- websiteforinstallationinstructions. *
- youwillseethroughoutthisdocumentation ,you
requirements.txt
pypi
- Django ==1.8.4
- Flask ==0.10.1
- HTTPReplay ==0.1.5
- Jinja2 ==2.8
- Mako ==1.0.1
- MarkupSafe ==0.23
- SQLAlchemy ==1.0.8
- Werkzeug ==0.10.4
- alembic ==0.8.0
- beautifulsoup4 ==4.4.1
- cffi ==1.2.1
- chardet ==2.3.0
- cryptography ==1.0
- dpkt ==1.8.6.2
- ecdsa ==0.13
- enum34 ==1.0.4
- idna ==2.0
- ipaddress ==1.0.14
- itsdangerous ==0.24
- jsbeautifier ==1.5.10
- ndg-httpsclient ==0.4.0
- pefile *
- pyOpenSSL ==0.15.1
- pyasn1 ==0.1.8
- pycparser ==2.14
- pymongo ==3.0.3
- python-dateutil ==2.4.2
- python-editor ==0.3
- python-magic ==0.4.6
- requests ==2.7.0
- six ==1.9.0
- tlslite-ng ==0.6.0
- wakeonlan ==0.2.2