SANS diary explains a local Ghidra Server for malware labs
Original title: Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
A shared Ghidra repository keeps analysis projects outside disposable VMs and supports versioning and multiple clients.
A SANS Internet Storm Center diary describes deploying the Ghidra Server included with the standard distribution for a malware-analysis lab. Shared projects persist annotations outside analysis VMs, add check-in versioning, and let several analysts use read, write, or admin permissions. The example uses Ghidra 12.1.4, JDK 21 or newer, local password authentication, and TCP ports 13100 and 13101. The author says the server stores raw sample bytes and should stay on the lab network, not the internet.
- Recommended host resources are 2 CPUs, 4 GB of memory, and 8 GB of storage.
- Server and clients should run the same Ghidra version to avoid incompatibility.
- New local users receive the initial password changeme and must change it.
- Authentication options cited are local passwords, PKI, and JAAS for LDAP or Active Directory.
- Importing a binary stays private until it is added to version control.
- Products
- GhidraGhidra Server
- Organizations
- SANS Internet Storm Center
From the original article
5 min read at isc.sans.edu
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.