# Clone the repository
git clone https://github.com/ACharaf06/cybersec.git
cd cybersec

# Build all containers (this may take several minutes on first run)
docker compose build

# Start the defense lab (nginx + patched app)
docker compose up -d nginx app

# Start the vulnerable app (for exploitation demo)
docker compose up -d app-vulnerable

# Verify services are running
docker compose ps

# Wait for services to be healthy (about 60 seconds)
sleep 60

# Check health endpoints
curl http://127.0.0.1:8080/struts-lab/health  # Defense lab
curl http://127.0.0.1:8081/struts-lab/health   # Vulnerable app

# Run the simulator container (tests defense mechanisms)
docker-compose run --rm simulator

# Or run individual tests manually:
# Legitimate upload
curl -X POST -F "[email protected]" http://127.0.0.1:8080/struts-lab/upload

# Suspicious Content-Type (will be blocked by WAF)
curl -v -X POST \
  -H "Content-Type: multipart/form-data; boundary=----SUSPICIOUS" \
  http://127.0.0.1:8080/struts-lab/upload

# Run the exploit container (demonstrates S2-045 exploitation)
docker-compose --profile exploit run --rm exploit

# Or use the Python exploit script directly
python3 exploit/exploit.py http://127.0.0.1:8081/struts-lab 'whoami'

# Or use the bash script
./exploit/demo_exploit.sh

# Defense lab logs
tail -f logs/nginx/access.log      # Nginx access logs
tail -f logs/nginx/error.log       # WAF blocks
tail -f logs/app/struts-lab.log    # Defense app logs

# Vulnerable app logs
tail -f logs/app-vulnerable/struts-lab.log  # Vulnerable app logs

# All logs combined
docker-compose logs -f

[WAF] Blocked suspicious Content-Type pattern - Request ID: abc123

[REQUEST] ID=abc123 Content-Type=multipart/form-data Method=POST URI=/upload
[UPLOAD] Processing file upload for request abc123

HTTP/1.1 200 OK
...
root
(Command output appears in response body)

.
├── docker-compose.yml          # Orchestrazione dei container
├── README.md                   # Questo file
├── EXPLOITATION_GUIDE.md      # Guida dettagliata allo sfruttamento
├── TECHNICAL_DETAILS.md        # Dettagli di implementazione tecnica
├── GLOSSARY.md                 # Glossario dei termini di sicurezza
├── nginx/
│   ├── nginx.conf              # Configurazione principale di nginx
│   └── waf-rules.conf          # Regole WAF per pattern S2-045
├── app/                        # Laboratorio di difesa (corretto)
│   ├── Dockerfile              # Build Tomcat + Maven
│   └── struts-app/
│       ├── pom.xml             # Progetto Maven (Struts 6.3.x)
│       └── src/main/
│           ├── java/           # Classi Action
│           ├── resources/      # Configurazione Struts + Log4j
│           └── webapp/         # Viste JSP + web.xml
├── app-vulnerable/             # App vulnerabile (per sfruttamento)
│   ├── Dockerfile              # Build Tomcat + Maven
│   └── struts-app/
│       ├── pom.xml             # Progetto Maven (Struts 2.3.31)
│       └── src/main/
│           ├── java/           # Classi Action
│           ├── resources/      # Configurazione Struts + Log4j
│           └── webapp/         # Viste JSP + web.xml
├── exploit/                    # Strumenti di sfruttamento
│   ├── Dockerfile              # Contenitore exploit
│   ├── demo_exploit.sh         # Script bash di exploit
│   └── exploit.py              # Script Python di exploit
├── simulator/
│   ├── Dockerfile              # Alpine + curl
│   └── simulate.sh             # Script di test
└── logs/                       # Directory log montata
    ├── nginx/
    ├── app/                    # Log del laboratorio di difesa
    └── app-vulnerable/         # Log dell'app vulnerabile

# Stop all containers
docker compose down

# Remove volumes and logs
docker compose down -v
rm -rf logs/

# Full cleanup (including images)
docker compose down --rmi all -v

# Rebuild only the vulnerable app
docker compose build app-vulnerable
docker compose up -d app-vulnerable

# Rebuild only the defense app
docker compose build app
docker compose up -d app

# Rebuild exploit container
docker compose build exploit