From 8db61daaebb531de6613e12649beef11124cd841 Mon Sep 17 00:00:00 2001 From: mcoder Date: Tue, 14 Apr 2026 14:04:22 +0330 Subject: [PATCH] Add --- docker-compose.yml | 41 ++++++++++++++++ docker/nginx/default.conf | 27 +++++++++++ docker/php/Dockerfile | 35 ++++++++++++++ package-lock.json | 28 +++++++++++ package.json | 1 + postcss.config.js | 2 +- resources/views/vulnerabilities/xss.blade.php | 48 ++++++++++++++----- 7 files changed, 168 insertions(+), 14 deletions(-) create mode 100644 docker-compose.yml create mode 100644 docker/nginx/default.conf create mode 100644 docker/php/Dockerfile diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..2de5de7 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,41 @@ +services: + # ---------------------------------------- + # NGINX (Web Server) + # ---------------------------------------- + nginx: + image: nginx:stable-alpine + container_name: sec_lab_nginx + ports: + - "58690:80" # روی سرور پورت 80 باز باشد + volumes: + - ./:/var/www/html:ro + - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro + depends_on: + php: + condition: service_started + networks: + - lab_net + restart: always + + # ---------------------------------------- + # PHP-FPM (Vulnerable Laravel Core) + # ---------------------------------------- + php: + container_name: sec_lab_php + build: + context: . + dockerfile: ./docker/php/Dockerfile + args: + # اینجا می‌توانید آدرس Nexus داخلی سرور خود را بدهید + - COMPOSER_REGISTRY=http://192.168.1.201:8081/ + - LINUX_REGISTRY=http://192.168.1.201:8081/ + - SECURITY_REGISTRY=http://192.168.1.201:8081/ + volumes: + - ./:/var/www/html:rw + networks: + - lab_net + restart: always + +networks: + lab_net: + driver: bridge \ No newline at end of file diff --git a/docker/nginx/default.conf b/docker/nginx/default.conf new file mode 100644 index 0000000..9bfd80d --- /dev/null +++ b/docker/nginx/default.conf @@ -0,0 +1,27 @@ +server { + listen 80; + + # شناسایی همزمان هر دو دامنه شبیه‌سازی شده + server_name victim.lab attacker.lab localhost; + + root /var/www/html/public; + index index.php index.html; + + # لاگ‌های مجزا برای تحلیل حملات + access_log /var/log/nginx/sec-lab-access.log; + error_log /var/log/nginx/sec-lab-error.log; + + location / { + try_files $uri $uri/ /index.php?$query_string; + } + + location ~ \.php$ { + fastcgi_pass php:9000; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include fastcgi_params; + } + + location ~ /\.ht { + deny all; + } +} \ No newline at end of file diff --git a/docker/php/Dockerfile b/docker/php/Dockerfile new file mode 100644 index 0000000..4b0fba8 --- /dev/null +++ b/docker/php/Dockerfile @@ -0,0 +1,35 @@ +FROM php:8.2-fpm-bookworm + +# متغیرهای ریجستری (قابل تنظیم از سمت docker-compose) +ARG COMPOSER_REGISTRY="https://mirror-composer.runflare.com" +ARG LINUX_REGISTRY="http://deb.debian.org/debian" +ARG SECURITY_REGISTRY="http://security.debian.org/debian-security" + +# تغییر سورس‌های apt به ریجستری لوکال/کاستوم شما +RUN sed -i "s|http://deb.debian.org/debian|${LINUX_REGISTRY}|g" /etc/apt/sources.list.d/debian.sources \ + && sed -i "s|http://security.debian.org/debian-security|${SECURITY_REGISTRY}|g" /etc/apt/sources.list.d/debian.sources \ + && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99ignore \ + && echo 'Acquire::AllowInsecureRepositories "true";' >> /etc/apt/apt.conf.d/99ignore + +# نصب وابستگی‌های پایه (بدون دیتابیس چون فعلاً نیاز نداریم) +RUN apt-get update && apt-get install -y --allow-downgrades --no-install-recommends \ + libzip-dev \ + unzip \ + git \ + curl \ + && apt-get clean && rm -rf /var/lib/apt/lists/* + +# نصب اکستنشن‌های پایه PHP +COPY --from=mlocati/php-extension-installer /usr/bin/install-php-extensions /usr/local/bin/ +RUN install-php-extensions zip bcmath + +# تنظیمات کامپوزر و استفاده از ریجستری +COPY --from=composer:latest /usr/bin/composer /usr/bin/composer +WORKDIR /var/www/html + +ENV COMPOSER_ALLOW_SUPERUSER=1 + +# غیرفعال کردن JIT برای جلوگیری از باگ‌های احتمالی PCRE +RUN echo "pcre.jit=0" > /usr/local/etc/php/conf.d/disable-pcre-jit.ini + +CMD ["php-fpm"] \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index 7a83110..d34d0aa 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5,6 +5,7 @@ "packages": { "": { "devDependencies": { + "@tailwindcss/postcss": "^4.2.2", "@tailwindcss/vite": "^4.0.0", "alpinejs": "^3.15.11", "autoprefixer": "^10.5.0", @@ -16,6 +17,19 @@ "vite": "^7.0.7" } }, + "node_modules/@alloc/quick-lru": { + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz", + "integrity": "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/@esbuild/aix-ppc64": { "version": "0.27.7", "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz", @@ -1115,6 +1129,20 @@ "node": ">= 20" } }, + "node_modules/@tailwindcss/postcss": { + "version": "4.2.2", + "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.2.2.tgz", + "integrity": "sha512-n4goKQbW8RVXIbNKRB/45LzyUqN451deQK0nzIeauVEqjlI49slUlgKYJM2QyUzap/PcpnS7kzSUmPb1sCRvYQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "@alloc/quick-lru": "^5.2.0", + "@tailwindcss/node": "4.2.2", + "@tailwindcss/oxide": "4.2.2", + "postcss": "^8.5.6", + "tailwindcss": "4.2.2" + } + }, "node_modules/@tailwindcss/vite": { "version": "4.2.2", "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.2.2.tgz", diff --git a/package.json b/package.json index e35f89b..05e25a5 100644 --- a/package.json +++ b/package.json @@ -7,6 +7,7 @@ "dev": "vite" }, "devDependencies": { + "@tailwindcss/postcss": "^4.2.2", "@tailwindcss/vite": "^4.0.0", "alpinejs": "^3.15.11", "autoprefixer": "^10.5.0", diff --git a/postcss.config.js b/postcss.config.js index e99ebc2..af9d8dc 100644 --- a/postcss.config.js +++ b/postcss.config.js @@ -1,6 +1,6 @@ export default { plugins: { - tailwindcss: {}, + '@tailwindcss/postcss': {}, autoprefixer: {}, }, } \ No newline at end of file diff --git a/resources/views/vulnerabilities/xss.blade.php b/resources/views/vulnerabilities/xss.blade.php index 820559c..caa322a 100644 --- a/resources/views/vulnerabilities/xss.blade.php +++ b/resources/views/vulnerabilities/xss.blade.php @@ -1,5 +1,5 @@ - + @@ -8,22 +8,44 @@
-

Reflected XSS Lab

+

آزمایشگاه Reflected XSS

-
-

ورودی شما در زیر به صورت Raw رندر می‌شود:

+
+
+ -
- {{-- استفاده از سینتکس خام برای اجرای اسکریپت --}} - {!! $payload !!} -
+
+ + +
+ + + +
+
+
-
-

تست در مرورگر:

- - /xss?payload=<script>alert('XSS by Browser-Sec-Lab')</script> - +
+

خروجی سرور (DOM Sink):

+

ورودی شما بدون فیلتر در کادر زیر رندر شده است:

+ +
+ {{-- آسیب‌پذیری ساختاریافته Blade --}} + {!! $payload ?? 'خروجی در اینجا نمایش داده می‌شود...' !!} +