search

splunk / attack_range

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
Apache License 2.0
2.08k stars 348 forks source link

Enhancement Request - Provide additional Templates of ranges #919

Open TheLawsOfChaos opened 3 weeks ago

TheLawsOfChaos commented 3 weeks ago

The configure option of attack_range.py contains some of the options and going through the actual code showcases many other good options that are available. Is it possible to provide some other example .yml configs of ranges?

Or allow for passing in our own default .yml to use (instead of always starting with attack_range/configs/attack_range_default.yml. Or making a second layer of defaults, similar to using splunk apps to layer together multiple configs into a single one.

Use case for allowing us to provide our own 'default' instead of or in additional to yours:

If I'm working in an environment, I would love to configure the general section once, and have all future iterations use that where I only define the machines I want to create etc for each individual attack range. i.e. if all of my ranges will be using the same AWS configuration, or the same local/vagrant etc I shouldn't have to define that each time, I could instead pass it my 'default' to start with.

P4T12ICK commented 3 weeks ago

Yes I think we could do some more examples to show the different options. You can create a folder outside of attack range project and create your own attack_range.yml master template which you always use. Then you can use the -c parameter to reference the attack_range.yml configs

python attack_range.py -c ../attack_range_configs/my_master_config.yml build
TheLawsOfChaos commented 3 weeks ago

But wouldn't that just take your template and then apply mine after it. I'm talking about creating like a template that would apply to future builds.

For example I make a template for a project I'm working on, say call it "OC'. I have OC_attac_range.yml. Then I can call : python attack_range.py -c ../attack_range_configs/OC_proj1.yml -m ../attack_range_configs/OC_master_config.ymlbuild

That would take the master config from -m, then apply it to the config provided with -c, similar to how all configs with -c get your master default template there.