From 99cee60d0a0fde246e162f56b9cfd4c2e024e976 Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Mon, 26 Jan 2026 19:00:53 +0100 Subject: [PATCH 01/11] feat: initial approach to v5 --- .gitignore | 2 ++ Dockerfile | 8 +++++--- 2 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ebbbc05 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +.env +sonar-project.properties diff --git a/Dockerfile b/Dockerfile index f3f17a5..692eb3e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,15 +1,17 @@ -FROM debian:bullseye-20251229-slim +FROM debian:bullseye-20260112-slim ARG DEBIAN_FRONTEND=noninteractive +ENV PATH="/root/osmedeus-base/external-binaries:/root/.local/bin:${PATH}" ENV LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ LC_ALL="en_US.UTF-8" RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list && \ apt-get update && \ - apt-get -yq install apt-utils locales curl && \ + apt-get -yq install apt-utils locales curl git && \ sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \ locale-gen && \ apt-get -yqu dist-upgrade && \ - bash -c "$(curl -fsSL https://raw.githubusercontent.com/osmedeus/osmedeus-base/master/install.sh)" && \ + bash -c "$(curl -sSL http://www.osmedeus.org/install.sh)" && \ + osmedeus health && \ apt-get -y autoremove && \ apt-get clean && \ rm -rf /var/lib/{apt,dpkg,cache,log} From 1b8b38f1c1d5adc876fa5d58f5df8d98cf0c1b28 Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Mon, 26 Jan 2026 22:19:34 +0100 Subject: [PATCH 02/11] feat: add preset step --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 692eb3e..f57e3f5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,6 +11,7 @@ RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list && \ locale-gen && \ apt-get -yqu dist-upgrade && \ bash -c "$(curl -sSL http://www.osmedeus.org/install.sh)" && \ + osmedeus install base --preset && \ osmedeus health && \ apt-get -y autoremove && \ apt-get clean && \ From 86b45cfd5f21913151f7f71672c131285013feaa Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Mon, 26 Jan 2026 22:19:50 +0100 Subject: [PATCH 03/11] feat: add rsync --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f57e3f5..5b1b690 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,7 @@ ENV LANG="en_US.UTF-8" \ LC_ALL="en_US.UTF-8" RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list && \ apt-get update && \ - apt-get -yq install apt-utils locales curl git && \ + apt-get -yq install apt-utils locales curl git rsync && \ sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \ locale-gen && \ apt-get -yqu dist-upgrade && \ From ce73884ab6b69e9a2f4065332ae918d8b71371cf Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Mon, 26 Jan 2026 22:22:23 +0100 Subject: [PATCH 04/11] feat: update base image to trixie --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5b1b690..4a251f8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,10 @@ -FROM debian:bullseye-20260112-slim +FROM debian:trixie-20260112-slim ARG DEBIAN_FRONTEND=noninteractive ENV PATH="/root/osmedeus-base/external-binaries:/root/.local/bin:${PATH}" ENV LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ LC_ALL="en_US.UTF-8" -RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list && \ +RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list.d/debian.sources && \ apt-get update && \ apt-get -yq install apt-utils locales curl git rsync && \ sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \ From 75b2129ea4f50a5bd616ac4007373ff40c9c4255 Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Mon, 26 Jan 2026 22:22:44 +0100 Subject: [PATCH 05/11] feat: add assetfinder --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 4a251f8..3f16b11 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,7 @@ ENV LANG="en_US.UTF-8" \ LC_ALL="en_US.UTF-8" RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list.d/debian.sources && \ apt-get update && \ - apt-get -yq install apt-utils locales curl git rsync && \ + apt-get -yq install apt-utils locales curl git rsync assetfinder && \ sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \ locale-gen && \ apt-get -yqu dist-upgrade && \ From 7463bf09632c7dc58bdf792fa9dd464727e76f7d Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Mon, 26 Jan 2026 22:23:31 +0100 Subject: [PATCH 06/11] feat: indent apt packages --- Dockerfile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3f16b11..e02bf5b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,13 @@ ENV LANG="en_US.UTF-8" \ LC_ALL="en_US.UTF-8" RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list.d/debian.sources && \ apt-get update && \ - apt-get -yq install apt-utils locales curl git rsync assetfinder && \ + apt-get -yq install \ + apt-utils \ + locales \ + curl \ + git \ + rsync \ + assetfinder && \ sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \ locale-gen && \ apt-get -yqu dist-upgrade && \ From 22eac7fc1fc1f44d0481f71d6bf935f949ed46a2 Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Mon, 26 Jan 2026 22:33:40 +0100 Subject: [PATCH 07/11] feat: migrate base image to kali linux --- Dockerfile | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index e02bf5b..6bf3bf3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,17 +1,18 @@ -FROM debian:trixie-20260112-slim +FROM kalilinux/kali-rolling@sha256:b1f67719a6d2c62f08ceadaebf2daf64a32cb56b5dbf5c6307ac48cd84cda3d4 ARG DEBIAN_FRONTEND=noninteractive ENV PATH="/root/osmedeus-base/external-binaries:/root/.local/bin:${PATH}" ENV LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ LC_ALL="en_US.UTF-8" -RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list.d/debian.sources && \ - apt-get update && \ +# RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list.d/debian.sources && \ +RUN apt-get update && \ apt-get -yq install \ apt-utils \ locales \ curl \ git \ rsync \ + massdns \ assetfinder && \ sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \ locale-gen && \ From 4651d8881636c229fbaf479742ac78565840a5e8 Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Tue, 27 Jan 2026 16:03:28 +0100 Subject: [PATCH 08/11] feat: update docs --- README.md | 36 ++++++++++----------- READMEv2.md | 91 ----------------------------------------------------- 2 files changed, 17 insertions(+), 110 deletions(-) delete mode 100644 READMEv2.md diff --git a/README.md b/README.md index a40dbe7..b4edf2f 100644 --- a/README.md +++ b/README.md @@ -1,37 +1,33 @@ -# docker-osmedeus v4 +# docker-osmedeus v5 ## Description -Docker image for Osmedeus, a fully automated offensive security tool for reconnaissance and vulnerability scanning (). This image is built upon Debian's Bullseye slim image. - -On 1st January 2022, Osmedeus' main developer (j3ssie) launched a beta of the new 4.0 version, which supersedes the previous v2 based on Django. While this README covers v4, the [READMEv2](READMEv2.md) file covers both the 1.5 and the 2.x versions. - -From v4.0.0 on, the Docker image `latest` tag references the newest 4.x available version. +Docker image for Osmedeus, a fully automated offensive security tool for reconnaissance and vulnerability scanning (). This image is built upon Kali Linux rolling image. ## How to use this image -The image launches Osmedeus' CLI tool without any arguments, so you have to provide your own to modify Osmedeus execution. Have a look at the inline help and the official documentation for basic and advanced usage examples. +The image launches Osmedeus' CLI tool without any arguments, so you have to provide your own to customise Osmedeus execution. Have a look at the inline help and the official documentation for basic and advanced usage examples. This will show Osmedeus inline help: ```bash -~ docker run -it --rm mablanco/osmedeus +docker run -it --rm mablanco/osmedeus ``` -This will start an analysis on domain `example.com` with logs on the console and deleting the container after finishing: +This will start a fast analysis of domain `example.com` with logs on the console, deleting the container after finishing: ```bash -~ docker run -it --rm mablanco/osmedeus osmedeus scan -t example.com +docker run -it --rm mablanco/osmedeus osmedeus run -f fast -t example.com ``` In case you want to persist the results of your analysis, you can create a volume for that purpose: ```bash -~ docker volume create osmedeus_workspaces +docker volume create osmedeus_workspaces ``` ```bash -~ docker run -it --rm -v osmedeus_workspaces:/root/.osmedeus/workspaces mablanco/osmedeus osmedeus scan -t example.com +docker run -it --rm -v osmedeus_workspaces:/root/.osmedeus/workspaces mablanco/osmedeus osmedeus scan -t example.com ``` ## Web UI @@ -39,15 +35,17 @@ In case you want to persist the results of your analysis, you can create a volum You can start the Web UI, as a daemonized process, with the following command: ```bash -~ docker run -d --name osmedeus-server -p 8000:8000 mablanco/osmedeus osmedeus server +docker run -d --name osmedeus-server -p 8002:8002 mablanco/osmedeus osmedeus server ``` -Now the Web UI is accesible at `https://127.0.0.1:8000/`. You can access an already existing volume containing Osmedeus workspaces adding the above volume parameters. +Now the Web UI is accesible at `http://127.0.0.1:8002/`. You can access an already existing volume containing Osmedeus workspaces adding the volume parameters described above. -The password to access the Web UI can be obtained executing this command: +The credentials to access the Web UI can be obtained executing these commands while the serve is running: ```bash -~ docker exec -it osmedeus-server grep password /root/.osmedeus/config.yaml | head -1 +docker exec -it osmedeus-server osmedeus config view server.username +docker exec -it osmedeus-server osmedeus config view server.password + ``` ## Building the image @@ -55,11 +53,11 @@ The password to access the Web UI can be obtained executing this command: Use the following command to build the image with the `latest` tag: ```bash -~ docker build -t mablanco/osmedeus . +docker build -t mablanco/osmedeus --progress=plain . ``` -In case you want to tag the image with a different version, use this command: +In case you want to tag the image with a custom version, use this command: ```bash -~ docker build -t mablanco/osmedeus: . +docker build -t mablanco/osmedeus: --progress=plain . ``` diff --git a/READMEv2.md b/READMEv2.md deleted file mode 100644 index 04c0b25..0000000 --- a/READMEv2.md +++ /dev/null @@ -1,91 +0,0 @@ -# docker-osmedeus v2 - -Docker image for Osmedeus, a fully automated offensive security tool for reconnaissance and vulnerability scanning (). This image is built upon Debian's Buster slim image. - -In early September 2019, Osmedeus' main developer (j3ssie) launched a beta of the new 2.0 version, which includes a new architecture based on Django and a new API. This README file covers both the 1.5 and the 2.x versions. - -## v2.x - -The image launches Osmedeus' CLI tool without any arguments, so you have to provide your own to modify Osmedeus execution. Have a look at the inline help and the official documentation for basic and advanced usage examples. - -From v2.1 on, the Docker image `latest` tag references the newest 2.x available version. - -### How to use this image - -This will show Osmedeus inline help: - - $ docker run -it --rm mablanco/osmedeus - -This will start an analysis on domain `example.com` with logs on the console: - - $ docker run -it --rm --name osmedeus -p 8000:8000 mablanco/osmedeus ./osmedeus.py -t example.com - -In case you want to persist the results of your analysis, you can create a volume for that purpose: - - $ docker volume create osmedeus_workspaces - $ docker run -it --rm --name osmedeus -v osmedeus_workspaces:/root/.osmedeus/workspaces -p 8000:8000 mablanco/osmedeus ./osmedeus.py -t example.com - -### Server-client architecture (as in v1.5) - -In case you'd like to work like in v1.5, i.e. launching separate server and client instances, you can do so modifying the running parameters. - -This will start a server instance listening on port 8000 using an existing data volume: - - $ docker run -d --rm --name osmedeus-server -v osmedeus_workspaces:/root/.osmedeus/workspaces -p 8000:8000 mablanco/osmedeus python3 server/manage.py runserver 0.0.0.0:8000 - -Use `-it` instead of `-d` if you want logs to debug the server. The API is now ready at 8000. You can also launch new scans against the server instance like this: - - $ docker run -it --rm --name osmedeus-scan mablanco/osmedeus ./osmedeus.py --remote http://:8000 --client -t example.com - -Remember not to use `localhost` as the server IP when running both containers in the same machine as the client one will then try to access the server instance inside itself. In order to improve this connection, you could use advanced Docker networking capabilities, like a private network, the legacy `--link` parameter or the more modern `--alias` parameter. - -This architecture is useful for e.g. running an Osmedeus central server or for accessing the results of previous scans without launching a new one. - -### Web UI - -The Web UI is accesible at `http://127.0.0.1:8000/`, thanks to the `-p 8000:8000` parameter. Omit it if you don't want the UI to be accessible. - -The password to access the Web UI can be obtained executing this command: - - $ docker exec -it osmedeus grep password /root/.osmedeus/client.conf - -## v1.5 - -The image launches Osmedeus' Web UI and API server using Python's development mode on port 5000 through SSL and a self generated certificated. - -### How to use this image - -This will start an Osmedeus instance listening on port 5000: - - $ docker run -d -p 5000:5000 --name osmedeus mablanco/osmedeus:1.5-20190812 - -In case you want to persist the results of your analysis, you can create a volume for that purpose: - - $ docker volume create osmedeus_workspaces - $ docker run -d -p 5000:5000 --name osmedeus -v osmedeus_workspaces:/root/.osmedeus/workspaces mablanco/osmedeus:1.5-20190812 - -Now you can interact with Osmedeus from the CLI using the `--client` parameter. For example: - - $ docker exec -it osmedeus ./osmedeus.py --client -t example.com - -Once you launch the first analysis, a password for the Web UI will be automatically generated, stored in the `core/config.conf` file inside the container. You can get it this way: - - $ docker exec -it osmedeus cat /root/.osmedeus/config.conf | grep password - -You can now access the Web UI with a web browser at port 5000 using HTTPS. Remember that the certificate is self generated, so you will have to instruct your web browser to accept it. - -### Note - -Osmedeus v1.5 has changed the location of the working directory and now lives at `.osmedeus` under the home directory of the running user. - -## Building the image - -Use the following command to build the image with the `latest` tag: - - $ docker build -t mablanco/osmedeus . - -It will fetch from the source code repository the release version specified in the OSMEDEUS_VERSION variable inside the Dockerfile. In case you want to build a different version, browse the available releases from and then use this command: - - $ docker build --build-arg OSMEDEUS_VERSION= -t mablanco/osmedeus: . - -If you want to build the bleeding edge code, use `master` as value for the OSMEDEUS_VERSION variable in the previous command. From d7c01bb5e9db337ae7b0107466575a786267972d Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Tue, 27 Jan 2026 19:32:37 +0100 Subject: [PATCH 09/11] feat: improve README --- README.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index b4edf2f..c578dfa 100644 --- a/README.md +++ b/README.md @@ -8,26 +8,30 @@ Docker image for Osmedeus, a fully automated offensive security tool for reconna The image launches Osmedeus' CLI tool without any arguments, so you have to provide your own to customise Osmedeus execution. Have a look at the inline help and the official documentation for basic and advanced usage examples. -This will show Osmedeus inline help: +This will show the inline help: ```bash docker run -it --rm mablanco/osmedeus ``` -This will start a fast analysis of domain `example.com` with logs on the console, deleting the container after finishing: +You can also get all usage examples: ```bash -docker run -it --rm mablanco/osmedeus osmedeus run -f fast -t example.com +docker run -it --rm mablanco/osmedeus osmedeus --usage-example ``` -In case you want to persist the results of your analysis, you can create a volume for that purpose: +This will start a fast analysis of domain `example.com` with logs on the console, deleting the container after finishing: ```bash -docker volume create osmedeus_workspaces +docker run -it --rm mablanco/osmedeus osmedeus run -f fast -t example.com ``` +In case you want to add persistance to your Osmedeus analysis, create the required volumes and mount them appropiately: + ```bash -docker run -it --rm -v osmedeus_workspaces:/root/.osmedeus/workspaces mablanco/osmedeus osmedeus scan -t example.com +docker volume create osmedeus_base +docker volume create osmedeus_workspaces +docker run -it --rm -v osmedeus_base:/root/osmedeus-base -v osmedeus_workspaces:/root/workspaces-osmedeus mablanco/osmedeus osmedeus run -t example.com ``` ## Web UI From a8f3244d6398871c920365d4fc690393e380c1dc Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Tue, 27 Jan 2026 19:34:44 +0100 Subject: [PATCH 10/11] feat: remove comment --- Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 6bf3bf3..8438fa2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,6 @@ ENV PATH="/root/osmedeus-base/external-binaries:/root/.local/bin:${PATH}" ENV LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ LC_ALL="en_US.UTF-8" -# RUN sed -i 's/main/main contrib non-free/' /etc/apt/sources.list.d/debian.sources && \ RUN apt-get update && \ apt-get -yq install \ apt-utils \ From f53f6d6ed603a54e381ec89b2614527fac1f6fad Mon Sep 17 00:00:00 2001 From: Marco Antonio Blanco Date: Tue, 27 Jan 2026 19:35:06 +0100 Subject: [PATCH 11/11] fix: exposed port --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 8438fa2..6e0923c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,5 +23,5 @@ RUN apt-get update && \ apt-get clean && \ rm -rf /var/lib/{apt,dpkg,cache,log} WORKDIR /root -EXPOSE 8000 +EXPOSE 8002 CMD ["osmedeus"]