murrypuppins/vulnerables-ssh-http repository overview

This is a vulnerable container designed to train/educate users in understanding real-world vulnerabilities.

Setup

1. Pull/run the container
2. Start the SSH service inside the container via: docker exec -d <container-name> service ssh start
3. If needed, grab the IP of your container: docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' <container-name>

Vulnerabilities

1. Public SSH keys on alice user

   • The private/public key pair is from a test set of keys for chromium use, try to find the key using Google-dorking or a similar approach.
   • Help, I'm stuck!⁠

2. HTTP Directory Traversal

   • Attempt to gain access to various sensitive files through the use of directory traversal/HTTP requests
   • Help, I'm stuck!⁠