How to Safely "Detonate" Suspicious Content
summary
Demos show three concrete detonation setups and what actually works: a Firefox container from Docker Hub that runs a browser but leaves clipboard and persistent-storage traces and exposes the host IP; a Kali on WSL2 setup using winex for GUI apps that gives full Linux tooling, is easy to reset, and needs ~1 GB downloads and per-user assembly; and a cloud Azure VM image workflow that boots in ~5 minutes, supports auto‑shutdown, yields a ~5.5 GB export, costs money, and hides the attacker‑facing IP. Scripts and GitHub code accompany the demos.
AI-written summary · about
chapters (13)
- 0:00Detonating suspicious content
- 1:52Why this talk matters
- 3:38Meet the speaker and setup the demo environment
- 4:23Demo 1: Browser in container
- 9:20Strengths and weaknesses of browser containers
- 11:51Demo 2: OS in container
- 21:06Kali Linux setup
- 24:37Demo 3: Full OS in container
- 26:47VM image for detonation
- 27:08Demo 4: Azure VM
- 36:50Strengths and weaknesses of VM detonation
- 38:38Conclusion and final recommendations
- 40:26Q&A
related talks
41mIdentifying and Mitigating Cloud and Container Threats
37mSecuring Containers by Breaking In
33mOffensive Javascript Techniques for Red Teamers
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
50mContainer Attack Surface Reduction Beyond Name Space Isolation
32mHow to lose a container in 10 minutes
01h 06mHow hacking works
40mSecuring Containers by Breaking in