Make the images used for dynamic analysis more representative of a standard Linux install
Open
Nobody has claimed this yet.
dynamic analysis
enhancement
needs discussion
- Dominant language
- Go
- Stars
- 912
- Forks
- 74
- PR merge metrics
- No merged PRs in 30d
Description
Currently the base images used are the *-slim variants.
To ensure we capture common attack scenarios the base images should include things like:
- curl, wget
- git, mercurial
- git config
- dummy key files (ssh, aws, etc - bonus points if these are canarytokens.org or similar)
Other nice-to-haves might be:
- a common cryptowallet
- browser profile (e.g. session cookies)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the base-image definitions used by dynamic analysis and compare their current *-slim variants. Define a representative Linux baseline containing the listed command-line tools and safe dummy credential files, then verify that the resulting images build and support the intended attack scenarios.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, linux
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100