Security Scans For Free For Everybody

That's it. Gauntlet.io now has a free forever plan for one application that lets you take advantage of all Gauntlet features, API and scanners for free. No strings attached, no credit card, etc. Simply free.

In the past few weeks I've been working in mitming ssl/tls connections as I posted before and put all scanners in docker containers for process isolation and ease of maintenance. That was all good, but on the other hand the disk space consumption sky rocketed because of those docker images.

OpenVAS for example takes 3.5GB of space alone. Zap 1.5GB. Without containers I didn't have this problem, but also didn't have the benefits as well.

Docker is pretty straightforward, easy to get started, but it has grown too big already. There are many things related to docker now. It's much more than Dockerfiles, docker pull and docker run. Nevertheless the experience was good and I recommend you to play a little bit in case if you haven't.

The main idea is to confinate software in containers, which look like virtual machines, but without that much overhead. By creating a simple file called "Dockerfile" you can pass instructions to build a image (e.g., use ubuntu as base image, install python and run these commands). From this image you create a container, which is what you'll use, run applications from the container that will or won't interact with the host machine. After executing what needs to be executed, you kill the container and that's it. If you need it again, you load from the image.

You don't need to know software dependencies anymore, just ask for a docker image and you're good to go.

Here's an example of a Dockerfile for Nmap:

# 
# Dockerfile --> Docker Image --> Docker Container
#
# Create image:
# $ docker build -t user/nmap build .
#
# Run nmap, as if it was a process in your machine
# Although it will create a container that will remove itself (--rm)
# When the process is over, i.e., nmap finishes:
# $ docker run -it --rm user/nmap -sT 192.168.1.1-100 -p 22
#
# Note: Alpine is lightweight linux distro, which will be the base
# for us to run some commands and generate the image
#

FROM alpine:3.3
MAINTAINER User <user@something.com>

# build initial cache | install binary | remove cache
RUN apk update \
    && apk add nmap \
    && rm -rf /var/cache/apk/*

ENTRYPOINT ["nmap"]

Backing to Gauntlet.io, the hotsite was updated, scan profile was introduced along with max execution time (ideal for pentesters who need to stop before business hours) and few UI updates as well. I hope you like it. If you don't, please tell me by pressing the "Feedback" button, available in almost every screen.

Thank you!