The web-pentest lab

A machine that fights back (on purpose)

This whole course runs on one Linux machine inside your browser. You are logged in as the ordinary user student, and the machine also hosts a small, deliberately vulnerable web application for you to attack. Nothing you do here leaves your browser, so you can be as aggressive as you like.

whoami
hostname
id

In the terminal

student@vulntech:~$ whoami
student
student@vulntech:~$ hostname
vulntech
student@vulntech:~$ id
uid=1000(student) gid=1000(student) groups=1000(student),27(sudo)

The practice target listens on http://127.0.0.1:8080 (127.0.0.1 is localhost — this same machine). Let's knock on its front door with curl, a command-line HTTP client:

curl -s http://127.0.0.1:8080/

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8080/
<!doctype html>
<title>VulnTech Target</title>
<h1>VulnTech Practice Target</h1>
<p>This machine hosts the deliberately-vulnerable apps for the Web Pentesting
labs. Everything here runs only inside your browser VM on 127.0.0.1.</p>
<ul>
  <li><a href="/api/ping?host=127.0.0.1">/api/ping?host=...</a> &mdash; network tool</li>
  <li><a href="/app/search?q=hello">/app/search?q=...</a> &mdash; search the site</li>
  <li><a href="/app/login">/app/login</a> &mdash; member login (POST username, password)</li>
  <li><a href="/app/note?id=2">/app/note?id=...</a> &mdash; read a saved note</li>
  <li><a href="/app/download?file=welcome.txt">/app/download?file=...</a> &mdash; download a file</li>
</ul>

That HTML is the landing page. Read it: it tells you what the target is and links to the endpoints it exposes. Reading what an app tells you about itself is the first move in every real engagement.

Tip: The machine ships with a pentester's toolkit already installed: curl, whatweb, nikto, dirb, sqlmap, hydra, jq and more. You'll meet them as you need them.