Vulhub is an open-source collection of pre-built vulnerable Docker environments. No pre-existing knowledge of Docker is required; just execute two simple commands, and you have a vulnerable environment.
Vulhub is compatible with Linux systems and Windows via WSL2.
If you are using Windows, you will need to install WSL2 to enable a Linux environment. Follow the instructions below:
-
Enable the WSL feature:
dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart
-
Restart your computer.
-
Install the Linux kernel update package: Download and install the package from here.
-
Set WSL2 as the default version:
wsl --set-default-version 2
-
Install a Linux distribution from the Microsoft Store (e.g., Ubuntu).
For detailed instructions, visit the WSL2 Documentation.
If you are already using Linux, you can skip the WSL2 installation and proceed directly to the installation steps for Docker.
# Install the latest version of Docker
curl -s https://get.docker.com/ | sh
# Run Docker service
sudo systemctl start docker
# Install dialog
sudo apt install dialog
Note: As of April 2022, Docker Compose is merged into Docker as a subcommand (Docker Compose V2). The Python version of docker-compose will be deprecated after June 2023. Vulhub will no longer require the installation of additional docker-compose, and all documentation will be updated to use the docker compose subcommand.
The installation steps of Docker and Docker Compose for other operating systems might be slightly different. Please refer to the Docker documentation for details.
To get started, clone the Vulhub Labs repository:
git clone https://github.com/supdevinci/vulhub-labs.git
cd vulhub-labsThis script provides an interactive way to select vulnerable software and CVEs to explore. Follow these steps:
-
Run the script in the terminal:
chmod +x vulnerability_labs.sh ./vulnerability_labs.sh
-
You will be presented with a menu to select the software you want to test.
-
Once you select the software, you can choose the specific vulnerability (CVE) from the available options.
-
The script will launch the corresponding Docker environment and display the ports being used for the environment.
-
If there are port conflicts or any issues, the script will provide guidance on resolving them.
- Select the software from the main menu.
- Choose the specific CVE or subdirectory.
- The script will launch the environment and provide a list of URLs and ports for accessing the services.
- Ensure that you have the required permissions to run Docker commands on your system.
- Use the environments responsibly and only for educational or testing purposes.
If you encounter issues such as port conflicts:
-
The script will detect the port conflict and provide the container name causing the issue.
-
You can stop the conflicting container using:
docker stop <container_name>
If you want to contribute to the Vulhub Playground, fork the repository and submit a pull request.
- To prevent permission errors, please ensure that the docker container has permission to access all files in the current directory.
- Vulhub does not support running on machines with non-x86 architecture such as ARM for now.
Vulhub is licensed under the MIT License. See LICENSE for the full license text.