└─$ docker run -p 80:80 -d docker.io/stuub/doomed:latest
Common vulnerabiltiies added for web server. Currently supporting:
- A3:2017-Sensitive Data Exposure (HTTP Logins)
- A2:2017-Broken Authentication (Login Page Bruteforcing)
- A7:2017-Cross-Site Scripting (Reflective XSS)
- A1:2017-Injection (Remote Code Execution)
What to expect of the Full CTF:
- Multi-Level Privilege Escalation
- Privilege Escalation via Cron Job Vulnerability
- Exploiting Set User ID (SUID) Permissions
3 Flags to capture! One at each level of privilege
Lite:
- Simplicity in mind
- Purely Python based
- Web Server hosted on users local file system
- HTTP & PHP Servers - Ports 8000 (HTTP) & 8001 (PHP)
Docker:
- Full CTF: Web to Root
- Initialised through a Python script for ease of access!
- Hugely greater scalability for vulnerabilities
- Dedicated Apache Web Server (Reverse Shells are reliable & accurate)
git clone https://github.com/Stuub/DoomBox