mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
83 lines
3.2 KiB
Plaintext
83 lines
3.2 KiB
Plaintext
[sniffer]
|
|
# Enable or disable the use of an external sniffer (tcpdump) [yes/no].
|
|
enabled = yes
|
|
|
|
# Specify the path to your local installation of tcpdump. Make sure this
|
|
# path is correct.
|
|
tcpdump = /usr/sbin/tcpdump
|
|
|
|
# We used to define the network interface to capture on in auxiliary.conf, but
|
|
# this has been moved to the "interface" field of each Virtual Machinery
|
|
# configuration.
|
|
|
|
# Specify a Berkeley packet filter to pass to tcpdump.
|
|
# Note: packer filtering is not possible when using "nictrace" functionality
|
|
# from VirtualBox (for example dumping inter-VM traffic).
|
|
bpf =
|
|
|
|
[mitm]
|
|
# Enable man in the middle proxying (mitmdump) [yes/no].
|
|
enabled = no
|
|
|
|
# Specify the path to your local installation of mitmdump. Make sure this
|
|
# path is correct.
|
|
mitmdump = /usr/local/bin/mitmdump
|
|
|
|
# Listen port base. Each virtual machine will use its own port to be
|
|
# able to make a good distinction between the various running analyses.
|
|
# Generally port 50000 should be fine, in this case port 50001, 50002, etc
|
|
# will also be used - again, one port per analyses.
|
|
port_base = 50000
|
|
|
|
# Script file to interact with the network traffic. Please refer to the
|
|
# documentation of mitmproxy/mitmdump to get an understand of their internal
|
|
# workings. (https://mitmproxy.org/doc/scripting/inlinescripts.html)
|
|
script = stuff/mitm.py
|
|
|
|
# Path to the certificate to be used by mitmdump. This file will be
|
|
# automatically generated for you if you run mitmdump once. It's just that
|
|
# you have to copy it from ~/.mitmproxy/mitmproxy-ca-cert.p12 to somewhere
|
|
# in the analyzer/windows/ directory. Recommended is to write the certificate
|
|
# to analyzer/windows/bin/cert.p12, in that case the following option should
|
|
# be set to bin/cert.p12.
|
|
certificate = bin/cert.p12
|
|
|
|
[replay]
|
|
# Enable PCAP replay capabilities.
|
|
enabled = yes
|
|
|
|
# Specify the path to your local installation of mitmdump. Make sure this
|
|
# path is correct. Note that this should be mitmproxy 3.0.5 or higher,
|
|
# installed in a separate virtualenv (or similar).
|
|
mitmdump = /usr/local/bin/mitmdump
|
|
|
|
# Listen port base. Each virtual machine will use its own port to be
|
|
# able to make a good distinction between the various running analyses.
|
|
# Generally port 51000 should be fine, in this case port 51001, 51002, etc
|
|
# will also be used - again, one port per analyses.
|
|
port_base = 51000
|
|
|
|
# Path to the certificate to be used by mitmdump. This file will be
|
|
# automatically generated for you if you run mitmdump once. It's just that
|
|
# you have to copy it from ~/.mitmproxy/mitmproxy-ca-cert.p12 to somewhere
|
|
# in the analyzer/windows/ directory. Recommended is to write the certificate
|
|
# to analyzer/windows/bin/cert.p12, in that case the following option should
|
|
# be set to bin/cert.p12.
|
|
certificate = bin/cert.p12
|
|
|
|
[services]
|
|
# Provide extra services accessible through the network of the analysis VM
|
|
# provided in separate, standalone, Virtual Machines [yes/no].
|
|
enabled = no
|
|
|
|
# Comma-separated list with each Virtual Machine containing said service(s).
|
|
services = honeyd
|
|
|
|
# Time in seconds required to boot these virtual machines. E.g., some services
|
|
# will only get online after a minute because initialization takes a while.
|
|
timeout = 0
|
|
|
|
[reboot]
|
|
# This auxiliary module should be enabled for reboot analysis support.
|
|
enabled = yes
|