yusufdalbudak/cve-2026-42945Dockerized lab for training on NGINX rewrite vulnerability (CVE-2026-42945) with vulnerable and patched instances, benign test scripts, and configuration auditing exercises.
Two Dockerized NGINX instances: pattern-based “risky rewrite” snippet vs remediated named-capture snippet, pinned to nginx:1.30.0-alpine / nginx:1.30.1-alpine. Scripts run benign curls, dump nginx -T, and archive evidence. For configuration review training only—/health, /nginx_status, /legacy/ are lab endpoints; tighten exposure outside a lab VLAN.
Scope: authorized hosts only. Vendor advisories and your own policy interpret [RISK] output from scripts/check-nginx-rewrite-risk.sh (heuristic grep over config, not a formal scanner).
Host 127.0.0.1:18080 -> nginx-rift-vulnerable (listens :8080 in container)
Host 127.0.0.1:18081 -> nginx-rift-patched
www/ -> RO -> /usr/share/nginx/html (both)
nginx-vulnerable/nginx-patched -> RO -> conf.d/default.conf
Network: nginx_rift_net (bridge)
Repo tree: docker-compose.yml, nginx-{vulnerable,patched}/default.conf, www/, scripts/, evidence/ (artifacts gitignored except .gitkeep), docs/.
Docker + docker compose, bash, curl. Once: chmod +x scripts/*.sh. Linux (or VM) exposes /proc/sys/kernel/randomize_va_space if you care about that collector line in collect-evidence.sh; macOS Docker Desktop often skips it—script notes that case.
cd nginx-rift-defensive-lab
docker compose pull # optional
docker compose up -d
docker compose ps
./scripts/benign-request-test.sh
./scripts/check-nginx-rewrite-risk.sh
./scripts/check-nginx-rewrite-risk.sh nginx-rift-patched
./scripts/collect-evidence.sh
./scripts/cleanup-lab.sh
# ./scripts/cleanup-lab.sh --purge-evidence
Change host ports if 18080/18081 collide (docker-compose.yml).
| Path | Role |
|---|---|
/health | Stable text for probes (vulnerable-nginx-alive / patched-nginx-alive) |
/nginx_status | stub_status (restrict in prod) |
/legacy/ | Rewrite demo |
| File | Purpose |
|---|---|
docs/LAB_GUIDE.md | Step-by-step lab |
docs/WEBINAR_FLOW.md | Presenter pacing |
docs/PRTG_MONITORING_NOTES.md | Sensor examples |
docs/REMEDIATION_SUMMARY_TEMPLATE.md | CAB/incident skeleton |
docs/NGINX_RIFT_DEFENSIVE_LAB_COMPLETE_GUIDE.md | Consolidated Markdown |
docs/TR_KAPSAMLI_SAVUNMA_LAB_REHBERI.md | Turkish handbook |
docs/PDF_GENERATION_NOTES.txt | Optional local PDF build (docs/*.pdf, gitignored) |
Use docker compose up -d with a hyphen. Shell globs such as *d can expand to unintended filenames.