Welcome to vulnerable.example.com
This web application runs on bare metal, virtual machines, or Kubernetes clusters utilizing CrowdStrike's Falcon sensor. All that is needed is a container runtime such as Docker or Podman. For Kubernetes, the Falcon sensor should be deployed as a DaemonSet or sidecar container.
The web application will allow you to execute various exploitation techniques as if it was an attacker exploiting the application. The Falcon sensor will recognize this malicious behavior and report it back to the Falcon Console.
You can view output of ps command to see processes running within the same pod as this application.
☠
Detections
- /credentials_dumping_collection - Attempts to dump credentials from /etc/passwd to /tmp/passwords.
- /reverse_shell-obfuscated - Attempts to connect to a remote IP address and will exit at
- /reverse_shell - Attempts to connect to a remote IP address and will exit at fork. Falcon Prevent will kill the attempt.
- /container_drift - Container Drift via file creation script. Creating a file and then executing it.
- /credentials_dumping - Runs mimipenguin and tries to dump passwords from inside the container environment.
- /rootkit - This script will change the group owner of /etc/ld.so.preload to 0, indicative of a Jynx Rootkit.
- /suspicious_commands - Emulate malicious activity related to suspicious CLI commands. Runs the command sh -c whoami '[S];pwd;echo [E]'.
- /data_exfiltration-alternate_protocol - Attempts to exfiltrate data using DNS dig requests that contain system data in the hostname.
- /ransomware - Simulates LockBit file encryption by renaming files with the
- /remote_service_persistence - Attempts to create persistence to 192.168.1.222 via External Remote Services via Python script. Falcon Prevent will kill the attempt.
- /reverse_shell_trojan - Executes an inert trojan that will attempt to connect to 192.168.0.1 on TCP port 444. Aggressive Machine Learning prevention policy settings will kill the attempt.
- /data_exfiltration-reverse_shell - Attempts Command Injection to execute reverse shell.
- /command_injection-suspicious_terminal - Executes a command injection to Spawn a Suspicious Terminal using PHP.
- /data_exfiltration-mysql - Executing Command Injection to dump MySQL Server tables.