Skip to content

Back to the catalog

HackingLZ/gibson
github.comrepo

HackingLZ/gibson

Gibson is a Rust-based network monitoring toolkit with a lightweight agent, server, and parser that maps process-to-network connections, detects cloud provider ownership (AWS/Azure/GCP/Cloudflare), flags beaconing candidates and EOL OS risk, and auto-generates iptables/Windows firewall rules. It supports AES-256-GCM encrypted uploads, ASN/ARIN-based IP ownership lookups, and SQL/JSON report exports for cross-host threat hunting.

TL;DR Rust agent/server/parser toolkit that maps host process-network connections, detects beaconing and cloud infra, and generates firewall rules.
Open original ↗
Document

What it is

Gibson (HackingLZ/gibson) is a Rust network-monitoring toolkit split into three subcommands — collect, parse, monitor — plus a standalone agent binary built as a drop-and-run deployment target. The README's operational detail (deployment model, parser flag semantics, an example collector server) is what goes beyond the catalog summary.

How it works

The agent binary is configured entirely at compile time: server URL, API key, interval, encryption key, etc. are read from environment variables during cargo build and burned into the binary, which then runs with no arguments and no external dependencies. The parse step has two mutually exclusive IP-ownership paths — a local ASN database (--asn-db, no network calls) or live ARIN lookups (--arin-lookup). When --asn-db is provided, --arin-lookup is silently ignored; --arin-cache persists ARIN results so re-runs skip already-queried IPs.

What to do

Build a zero-flag agent with config compiled in:

AGENT_SERVER="https://collector.internal/upload" \
AGENT_KEY="prod-api-key" \
AGENT_DURATION="0" \
AGENT_INTERVAL="30" \
AGENT_COMPRESS="true" \
AGENT_ENCRYPT_KEY="$(cat /etc/gibson/key)" \
cargo build --release --bin agent

Offline ownership lookup (fetch/refresh the DB weekly):

curl -O https://iptoasn.com/data/ip2asn-v4.tsv.gz && gunzip ip2asn-v4.tsv.gz
cargo run --release -- parse \
  --input connections.jsonl \
  --cloud-analysis cloud.json \
  --asn-db ip2asn-v4.tsv

Collect-and-upload with cleanup of local files after upload:

cargo run --release -- collect \
  --duration-seconds 3600 --interval-seconds 10 \
  --compress --encrypt-key "your-32-char-hex-key-or-password" \
  --upload-url "https://your-server.com/api/upload" \
  --api-key "your-api-key" --batch-size 50 \
  --delete-after-upload

--whitelist-processes "chrome,firefox,safari,edge" and --min-connections filter parser noise.

Caveats

  • The README ships an example Flask collector that distinguishes encrypted from plaintext uploads by checking whether the body starts with b'eyJ' (base64 {") — a fragile heuristic, and the server uses ssl_context='adhoc' with a comment to "use proper SSL in production." Treat it as a reference, not a deployment.
  • AGENT_DURATION="0" means indefinite collection; the interval/batch and encryption key are fixed at build time, so changing them requires a rebuild and redeploy of the binary.
  • Encryption, compression, and DNS resolution are all optional and off by default.

Technologies named here

Techniques named here

  • Process-to-network connection mapping
  • Cloud provider identification
  • Beaconing detection
  • Risk scoring of processes
  • EOL OS detection
  • Shared IP detection across hosts
  • Automated firewall rule generation
  • Encrypted data exfiltration/upload

Related in Blue Team & Detection