murrypuppins/vulnerables-http-web2py repository overview

This is a vulnerable container designed to train/educate users in understanding real-world vulnerabilities

Setup:

1. It is highly recommended that you run this inside a disposable virtual machine, due to the interaction level and vulnerable state of this container
2. Pull the container via docker pull murrypuppins/vulnerables-http-web2py
3. Run the container via docker run -d --network=host vulnerables-http-web2py:latest
4. Connect to the webserver via your preferred browser via http://127.0.0.1:8000

Vulnerabilities:

There are in total 3 known vulnerabilities with the web2py application. If at any point, you get stuck or need guidance, check out the Exploit-DB report⁠ on this application

Note: If you do follow the Exploit-DB link, the Detailed POC links are not accurate, but the Video POC's are

1. Local File Inclusion

   • Utilize your preferred web interception software (e.g., Burp Suite) to intercept traffic on the http://127.0.0.1:8000/admin/default/pack_custom/ endpoint, and modify the file parameter
   • If successful, you'll receive a compressed download which will contain the file specified
   • Help, I'm stuck!⁠

2. Reflected Cross-Site-Scripting (XSS)

   • Explore the http://127.0.0.1:8000/admin/default/install_plugin/ page and find the XSS vulnerability (hint: check out the plugins)
   • Help, I'm stuck!⁠

3. Cross-Site-Request-Forgery (CSRF)

   • Explore the http://127.0.0.1:8000/admin/default/ page and see if you can find a way to trick the "admin/user" into interacting with installed applications
   • Help, I'm stuck!⁠