secbox

Conducting cybersecurity testing using the pi agent in a pre-built sandbox environment.

⚠️ Security Notice

This project is intended solely for CTF competitions or authorized security assessment work such as penetration testing, reverse engineering, and vulnerability research within permitted scope.

This project does not grant permission to test, access, scan, or otherwise affect any third-party system, network, service, account, or data. Before using this project, you must confirm that you have obtained lawful written authorization. Using this project for any unauthorized or illegal attack activity is prohibited.

The author assumes no responsibility for any consequences, losses, damages, legal liability, or illegal acts resulting from the user's individual actions.

secbox is a sandbox container built on Debian, integrating the pi agent with a commonly used toolchain for penetration testing, reverse engineering, and vulnerability research.

Preinstalled Capabilities

Category	Contents
Agent	pi command line, pi-web web interface (30141)
Information Gathering	nmap, httpx, dnsx, dig, nslookup, whois
Network Analysis	agent-browser-cli, openssl, curl, wget, nc
Reverse Engineering & Files	ghidra, jadx, apktool, binwalk, file, 7z, cpio, cabextract, unsquashfs
Vulnerability Research & Debugging	gdb + pwndbg, pwntools, strace, ltrace, gcc
Languages & Runtimes	Python3 + uv / uvx, Node.js 24, Java 21
Desktop & Browser	Xvfb + x11vnc + noVNC, Chrome for Testing

Usage

docker compose up -d --build

The compose file is already configured to use the host network. Before exposing it externally, set the PI_WEB_PASSWORD and PI_WEB_ALLOWED_HOSTS environment variables.

Access:

Service	Address
pi-web	http://<host>:30141
noVNC	http://<host>:8080/vnc.html?autoconnect=true&resize=remote

Environment Variables

Variable	Description
PI_WEB_PASSWORD	When set, pi-web enables authentication
PI_WEB_ALLOWED_HOSTS	Hostnames allowed to access pi-web

License

This project is released under the MIT license.