┌─────────────────────────────────────────────────────────────┐
│                     Host (127.0.0.1 only)                   │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌─────────────────┐    ┌─────────────────┐              │
│  │   Simulator     │───▶│  Nginx Proxy    │              │
│  │  (curl-based)   │    │  + WAF Rules    │              │
│  └─────────────────┘    └────────┬────────┘              │
│                                  │                        │
│                          ┌───────┴────────┐              │
│                          │                │                │
│                  ┌───────▼──────┐ ┌───────▼──────┐        │
│                  │  Defense App │ │ Vulnerable   │        │
│                  │ (Struts 6.3) │ │ App (2.3.31) │        │
│                  │ Port: 8080  │ │ Port: 8081  │        │
│                  └──────────────┘ └──────────────┘        │
│                                                             │
│  ┌─────────────────┐                                      │
│  │  Exploit        │───▶ Vulnerable App (8081)            │
│  │  Container      │                                      │
│  └─────────────────┘                                      │
│                                                             │
│  Logs mounted to: ./logs/nginx/, ./logs/app/,             │
│                   ./logs/app-vulnerable/                  │
└─────────────────────────────────────────────────────────────┘

# Clone the repository
git clone https://github.com/ACharaf06/cybersec.git
cd cybersec

# Build all containers (this may take several minutes on first run)
docker compose build

# Start the defense lab (nginx + patched app)
docker compose up -d nginx app

# Start the vulnerable app (for exploitation demo)
docker compose up -d app-vulnerable

# Verify services are running
docker compose ps

# Wait for services to be healthy (about 60 seconds)
sleep 60

# Check health endpoints
curl http://127.0.0.1:8080/struts-lab/health  # Defense lab
curl http://127.0.0.1:8081/struts-lab/health   # Vulnerable app

# Run the simulator container (tests defense mechanisms)
docker-compose run --rm simulator

# Or run individual tests manually:
# Legitimate upload
curl -X POST -F "[email protected]" http://127.0.0.1:8080/struts-lab/upload

# Suspicious Content-Type (will be blocked by WAF)
curl -v -X POST \
  -H "Content-Type: multipart/form-data; boundary=----SUSPICIOUS" \
  http://127.0.0.1:8080/struts-lab/upload

# Run the exploit container (demonstrates S2-045 exploitation)
docker-compose --profile exploit run --rm exploit

# Or use the Python exploit script directly
python3 exploit/exploit.py http://127.0.0.1:8081/struts-lab 'whoami'

# Or use the bash script
./exploit/demo_exploit.sh

# Defense lab logs
tail -f logs/nginx/access.log      # Nginx access logs
tail -f logs/nginx/error.log       # WAF blocks
tail -f logs/app/struts-lab.log    # Defense app logs

# Vulnerable app logs
tail -f logs/app-vulnerable/struts-lab.log  # Vulnerable app logs

# All logs combined
docker-compose logs -f

[WAF] Blocked suspicious Content-Type pattern - Request ID: abc123

[REQUEST] ID=abc123 Content-Type=multipart/form-data Method=POST URI=/upload
[UPLOAD] Processing file upload for request abc123

HTTP/1.1 200 OK
...
root
(Command output appears in response body)

.
├── docker-compose.yml          # تنسيق الحاويات
├── README.md                   # هذا الملف
├── EXPLOITATION_GUIDE.md      # دليل استغلال مفصل
├── TECHNICAL_DETAILS.md        # تفاصيل التنفيذ الفنية
├── GLOSSARY.md                 # مسرد مصطلحات الأمان
├── nginx/
│   ├── nginx.conf              # تكوين nginx الرئيسي
│   └── waf-rules.conf          # قواعد WAF لأنماط S2-045
├── app/                        # مختبر الدفاع (مُصحّح)
│   ├── Dockerfile              # بناء Tomcat + Maven
│   └── struts-app/
│       ├── pom.xml             # مشروع Maven (Struts 6.3.x)
│       └── src/main/
│           ├── java/           # فئات الإجراءات
│           ├── resources/      # تكوين Struts + Log4j
│           └── webapp/         # عروض JSP + web.xml
├── app-vulnerable/             # التطبيق الضعيف (للاستغلال)
│   ├── Dockerfile              # بناء Tomcat + Maven
│   └── struts-app/
│       ├── pom.xml             # مشروع Maven (Struts 2.3.31)
│       └── src/main/
│           ├── java/           # فئات الإجراءات
│           ├── resources/      # تكوين Struts + Log4j
│           └── webapp/         # عروض JSP + web.xml
├── exploit/                    # أدوات الاستغلال
│   ├── Dockerfile              # حاوية الاستغلال
│   ├── demo_exploit.sh         # نص Bash للاستغلال
│   └── exploit.py              # نص Python للاستغلال
├── simulator/
│   ├── Dockerfile              # Alpine + curl
│   └── simulate.sh             # نص الاختبار
└── logs/                       # دليل السجلات المثبت
    ├── nginx/
    ├── app/                    # سجلات مختبر الدفاع
    └── app-vulnerable/         # سجلات التطبيق الضعيف

# Stop all containers
docker compose down

# Remove volumes and logs
docker compose down -v
rm -rf logs/

# Full cleanup (including images)
docker compose down --rmi all -v

# Rebuild only the vulnerable app
docker compose build app-vulnerable
docker compose up -d app-vulnerable

# Rebuild only the defense app
docker compose build app
docker compose up -d app

# Rebuild exploit container
docker compose build exploit