How to implement Web's Hospital

PoC || GTFO: #Docker + #Traefik + #Jenkins + #OWASP — BB 0.8

InfoSec in a wishful nutshell

الواجب على الناظر في كتب العلوم، إذا كان غرضه معرفة الحقائق، أن يجعل نفسه خصماً لكل ما ينظر فيه.‫

أبو علي الحسن بن الحسن بن الهيثم

Oh hai o/

make target:

[About DevOpsSec] Nop, it’s not over yet \o/

make dry-run:

  • 100% Open Source tech legos. Because the 2 muchData 1 API is not my cup of tea.
  • It needs to run on cheap servers. Coz I'm a 99% dealing with a lawsuit.
  • KISS and lazy coding. Don't judge the dev that I'm not.
  • Monitoring, Registry management and image scanning are out of scope, because I need to submit this paper tonight.

make build:

  • A vulnerable app,
  • A kinda State-Diagram, waterfall-proof \o/
Dia is so powerful …
… And ugly at the same time #kudos
user@yogosha:~/code/PoC$ tree
.
├── etc
│ └── traefik.toml <- Load Balancer config
├── Jenkinsfile <- Pipeline as Code
├── LICENSE <- MIT
├── Makefile <- RTFM
├── README.md <- You're reading it
└── src
├── php <- PHP sqli vulnerable
│ ├── debian.png
│ ├── Dockerfile <- Build recipe
│ ├── docker.png
│ ├── index.php <- App Code
│ ├── jenkins.png
│ ├── lamp.jpg
│ ├── owasp.png
│ ├── scaleway.svg
│ ├── star.png
│ └── traefik.png
└── sql
├── production.sql <- Prod Data
└── staging.sql <- Staging Data
4 directories, 17 files

Make run:

Get yourself comfortable behind your favorite terminal, and install docker.

SQLi & FrontEnd Skillz
Cheshire Cat eating Reblochon in HTTPS
docker run -d -p 8666:8080 -p 80:80 -p 443:443 -v /var/run/docker.sock:/var/run/docker.sock -v traefik:/data -v $PWD/etc/traefik.toml:/traefik.toml -v $PWD/conf/acme.json:/acme.json traefik
The White Rabbit
docker run -p 8080 -d -v  /data/jenkins/var/jenkins_home:/var/jenkins_home -v  /var/run/docker.sock:/var/run/docker.sock -v $(which docker):/usr/bin/docker -v $(which make):/usr/bin/make --label  traefik.backend='jenkins' --label traefik.port='8080' --label  traefik.protocol='http' --label traefik.weight='10' --label traefik.frontend.rule='Host:chocobo.yogosha.com'
--label traefik.frontend.passHostHeader='true'
--label traefik.priority='10'
jenkinsci/docker-workflow-demo
As simple as a git clone

The trick:

No tricks. Only code. One file that mimics the initial State Diagram.

BluePill

This is your last chance. After this, there is no turning back. You take the blue pill — the story ends, you wake up in your bed and believe whatever you want to believe. You take the red pill — you stay in Wonderland, and I show you how deep the rabbit hole goes. Remember: all I’m offering is the truth. Nothing more.

--

--

InfoSec Kepo ~ Yes, I am a criminal. My crime is that of curiosity. I'm a H. ~ It's not me, it's the #INTJ daemon.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
H.A.T

InfoSec Kepo ~ Yes, I am a criminal. My crime is that of curiosity. I'm a H. ~ It's not me, it's the #INTJ daemon.