Vulnerable Web
Description
Simple vulnerability labs that created using PHP and MySQL. (Not for sale)
List of vulnerability:
- Arbitrary File Upload
- SQL Injection
- CSRF
- IDOR
- Host Header Injection
- Local File Inclusion
- Open Redirect
- Cross-Site Scripting
- CRLF Injection
Notes Vulnerability
-
Host Header Injection
You need to import env_email and env_password in order to make Host Header Injection work
Pre Requisite
- mysql-server
- php8.1-fpm
- php8.1-mysql
- php8.1
- nginx
Installation (Manual)
$ docker build -t vulnerable-web:latest --build-arg email=changeme@gmail.com --build-arg password_email=changeme .
$ docker run -p80:80 --name vulnerable-web -d -t vulnerable-web:latest
$ curl "http://localhost:80"
Installation (Docker Hub)
$ docker run -p80:80 --name vulnerable-web -t daffainfo/vulnerable-web:latest
$ curl "http://localhost:80"