Simple vulnerability labs that created using PHP and MySQL. (Not for sale)
List of vulnerability:
- Arbitrary File Upload
- SQL Injection
- CSRF
- IDOR
- Host Header Injection
- Local File Inclusion
- Open Redirect
- Cross-Site Scripting
- CRLF Injection
You need to import env_email and env_password in order to make Host Header Injection work
- mysql-server
- php8.1-fpm
- php8.1-mysql
- php8.1
- nginx
$ docker build -t vulnerable-web:latest --build-arg [email protected] --build-arg password_email=changeme .
$ docker run -p80:80 --name vulnerable-web -d -t vulnerable-web:latest
$ curl "http:https://localhost:80"
$ docker run -p80:80 --name vulnerable-web -t daffainfo/vulnerable-web:latest
$ curl "http:https://localhost:80"