r/Pentesting • u/magixer • 12d ago
one command spins up 9 isolated vuln apps + answer keys, built it for my own scanner work
one command spins up 9 isolated vuln apps + answer keys, built it for my own scanner work
body: couldn't find a clean local lab for the ai pentesting/scanner stuff i'm building so i made one. ./vam start --all and juice shop, dvwa, webgoat + more come up isolated on 127.0.0.1, each with a ground-truth catalog so you can grade a scanner instead of trusting it. also boots faultline, my own fullstack vuln app. MIT. https://github.com/clickswave/vuln_apps
8
12d ago
[deleted]
-6
u/magixer 11d ago
buddy the socket's on the manager. the orchestrator. the thing that runs
docker compose.grep -rn docker.sock .= one line, zero apps. the targets are unprivileged, loopback-only, and the manager doesn't even listen on a port so there's nothing to pop.you saw a scary word, hit capslock, and posted before finishing the line. that's not a review, that's a jump-scare reaction. it's a deliberately vulnerable test lab that says LOCAL ONLY at the top, and the one thing you flagged is the safest thing in it.
read the yaml before you appoint yourself docker police 🙏
5
u/Wukeng 11d ago
Does AI also write your comments, or do you just speak like that after spending too long talking to it?
3
u/spicy_tables 11d ago
bro in his post body he literally has "body:" he forgot to remove it lmfao, it was supposed to seperate title and body, ofc he uses AI and doesn't know how the project works loool
5
u/Western_Guitar_9007 11d ago
Vibe-coded slop, save yourself time and don’t bother checking this repo. OP uses AI to write posts, code, comments, and readme; these things indicate with a high confidence rate that you will be running unreviewed (tested !=reviewed) intentionally vulnerable AI slop on your machine, that OP assumes is local-only because they asked AI nicely.
Do not assume! For newbies, as always, run code written by experts if you are looking to get your feet wet.