opencode-shannon-plugin/Dockerfile at main · vichhka-git/opencode-shannon-plugin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
# Shannon Tools - Security Testing Docker Image
# Build: docker build -t shannon-tools .
# This container runs as a dumb tool executor. OpenCode's AI reasons about results.

FROM kalilinux/kali-rolling

ENV DEBIAN_FRONTEND=noninteractive

# Use direct Kali mirror (bypass CDN redirector that routes to dead regional mirrors)
RUN echo "deb http://kali.download/kali kali-rolling main non-free non-free-firmware contrib" > /etc/apt/sources.list

# Core system packages + Security tools
RUN apt-get update -o Acquire::Retries=3 && \
    apt-get install -y --no-install-recommends \
    bash curl wget git ca-certificates gnupg unzip jq \
    python3 python3-pip python3-venv \
    nmap dnsutils whois whatweb \
    nikto sqlmap gobuster dirb \
    hydra netcat-openbsd \
    hashcat john \
    ffuf testssl.sh python3-tk \
    pandoc weasyprint fonts-recommended \
    && rm -rf /var/lib/apt/lists/*

# Install nuclei (latest release)
RUN curl -sL https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_$(curl -sL https://api.github.com/repos/projectdiscovery/nuclei/releases/latest | jq -r '.tag_name' | sed 's/v//')_linux_amd64.zip -o /tmp/nuclei.zip && \
    unzip /tmp/nuclei.zip -d /usr/local/bin/ && \
    chmod +x /usr/local/bin/nuclei && \
    rm /tmp/nuclei.zip || true

# Install httpx (latest release)
RUN curl -sL https://github.com/projectdiscovery/httpx/releases/latest/download/httpx_$(curl -sL https://api.github.com/repos/projectdiscovery/httpx/releases/latest | jq -r '.tag_name' | sed 's/v//')_linux_amd64.zip -o /tmp/httpx.zip && \
    unzip /tmp/httpx.zip -d /usr/local/bin/ && \
    chmod +x /usr/local/bin/httpx && \
    rm /tmp/httpx.zip || true

# Install subfinder (latest release)
RUN curl -sL https://github.com/projectdiscovery/subfinder/releases/latest/download/subfinder_$(curl -sL https://api.github.com/repos/projectdiscovery/subfinder/releases/latest | jq -r '.tag_name' | sed 's/v//')_linux_amd64.zip -o /tmp/subfinder.zip && \
    unzip /tmp/subfinder.zip -d /usr/local/bin/ && \
    chmod +x /usr/local/bin/subfinder && \
    rm /tmp/subfinder.zip || true

# Install grpcurl (latest release)
RUN curl -sL https://github.com/fullstorydev/grpcurl/releases/latest/download/grpcurl_$(curl -sL https://api.github.com/repos/fullstorydev/grpcurl/releases/latest | jq -r ".tag_name" | sed "s/v//")_linux_x86_64.tar.gz -o /tmp/grpcurl.tar.gz && \
    tar -xvf /tmp/grpcurl.tar.gz -C /usr/local/bin grpcurl && \
    rm /tmp/grpcurl.tar.gz || true


# Install gowitness - web screenshot utility with gallery UI
# https://github.com/sensepost/gowitness
RUN GOWITNESS_VERSION=$(curl -sL https://api.github.com/repos/sensepost/gowitness/releases/latest | jq -r '.tag_name') && \
    curl -sL "https://github.com/sensepost/gowitness/releases/download/${GOWITNESS_VERSION}/gowitness-${GOWITNESS_VERSION}-linux-amd64" -o /usr/local/bin/gowitness && \
    chmod +x /usr/local/bin/gowitness || true

# Chromium + Playwright for browser-based testing (SPA/dynamic pages)
# Let apt resolve Chromium's dependencies automatically instead of listing
# individual libs (which get renamed across Kali Rolling releases, e.g. libasound2 → libasound2t64)
RUN apt-get update -o Acquire::Retries=3 && \
    apt-get install -y \
    chromium chromium-driver \
    fonts-liberation xdg-utils \
    && rm -rf /var/lib/apt/lists/*

# Python security libraries + Playwright + BrowserBruter dependencies
RUN pip3 install --break-system-packages --no-cache-dir \
    requests beautifulsoup4 lxml \
    playwright pyyaml \
    selenium selenium-wire 2>/dev/null || true

# Install Playwright browsers (Chromium only to save space)
RUN python3 -m playwright install chromium 2>/dev/null || true

# Install BrowserBruter - browser-based form fuzzing (bypasses encryption)
# https://github.com/netsquare/BrowserBruter
RUN git clone --depth 1 https://github.com/netsquare/BrowserBruter.git /opt/BrowserBruter && \
    cd /opt/BrowserBruter && \
    pip3 install --break-system-packages --no-cache-dir -r requirements.txt 2>/dev/null || true && \
    printf '#!/bin/sh\npython3 /opt/BrowserBruter/BrowserBruter.py "$@"\n' > /usr/local/bin/browserbruter && \
    chmod +x /usr/local/bin/browserbruter

# Create workspace and wordlists directory
WORKDIR /workspace

# Download common wordlists if not present
RUN mkdir -p /usr/share/wordlists/dirb && \
    [ -f /usr/share/wordlists/rockyou.txt ] || \
    (curl -sL https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt -o /usr/share/wordlists/rockyou.txt 2>/dev/null || true) && \

    [ -f /usr/share/wordlists/dirb/common.txt ] || \
    curl -sL https://raw.githubusercontent.com/v0re/dirb/master/wordlists/common.txt \
    -o /usr/share/wordlists/dirb/common.txt 2>/dev/null || true

# Container stays alive for `docker exec` commands
CMD ["tail", "-f", "/dev/null"]