A comprehensive collection of secure automation scripts for setting up educational penetration testing laboratories. This repository provides tools for deploying intentionally vulnerable applications in isolated, controlled environments for legitimate security training and research.
Project Board: https://github.com/users/E7H31234L/projects/5
FOR EDUCATIONAL PURPOSES ONLY - NEVER DEPLOY IN PRODUCTION ENVIRONMENTS
This repository contains:
- 🎯 Intentionally vulnerable applications (DVWA, bWAPP, Mutillidae)
- 🛠️ Automated LAMP stack installation for lab environments
- 🔧 Secure configuration management for isolated testing
- 📊 Comprehensive security documentation and guidelines
- ❌ NEVER deploy these applications on production systems
- ❌ NEVER expose to public networks without isolation
- ❌ NEVER use default credentials in real environments
- ✅ Security education and training
- ✅ Penetration testing practice
- ✅ Security research in isolated VMs/containers
- ✅ Cybersecurity skill development
- ✅ Ethical hacking certification preparation
Pen-Testing/
├── 📋 SECURITY.md # Comprehensive security guidelines
├── 🔧 Scripts/
│ ├── lamp-install-secure.sh # Secure LAMP stack installation
│ ├── database-install-secure.sh # Vulnerable app deployment
│ └── uninstall-secure.sh # Complete environment cleanup
├── 🐳 Docker/ # Containerized lab environments
├── 📚 docs/ # Additional documentation
├── ⚙️ config/ # Configuration templates
└── 🔍 monitoring/ # Security monitoring tools
- System: Ubuntu 20.04+ / Debian 10+
- Memory: Minimum 4GB RAM (8GB recommended)
- Storage: Minimum 20GB available space
- Network: Isolated environment (VM/Container)
- Privileges: Sudo access without password prompt
# Clone the repository
git clone https://github.com/E7H31234L/Pen-Testing.git
cd Pen-Testing
# Review security documentation ⚠️
cat SECURITY.md
# Install LAMP stack for penetration testing
./lamp-install-secure.sh
# Deploy vulnerable applications
./database-install-secure.sh| Application | URL | Default Credentials |
|---|---|---|
| Lab Dashboard | http://your-server-ip/ | - |
| DVWA | http://dvwa.local/ | admin/password |
| PHP Info | http://your-server-ip/phpinfo.php | - |
- ✅ Input validation and sanitization in all scripts
- ✅ SQL injection prevention with parameterized queries
- ✅ Secure credential handling with encrypted storage
- ✅ Comprehensive error handling without information disclosure
- ✅ Audit logging for all administrative actions
# Create isolated network for labs
sudo docker network create --driver bridge --subnet=172.20.0.0/16 pentest-net
# Deploy with network isolation
./database-install-secure.sh --network pentest-net# Real-time security monitoring
./monitoring/security-monitor.sh --mode production
# Log analysis and alerting
./monitoring/log-analyzer.sh --alerts-onPurpose: Web application security training platform
Vulnerabilities Covered:
- SQL Injection
- Cross-Site Scripting (XSS)
- File Upload Vulnerabilities
- Authentication Bypass
- Command Injection
Installation:
# Deploy DVWA with secure defaults
./database-install-secure.sh --app dvwa --securePurpose: SQL injection practice environment
Features:
- Progressive difficulty levels
- Various SQL injection techniques
- Error-based and blind SQLi
- Time-based and boolean-based
Installation:
# Deploy SQLi labs
./database-install-secure.sh --app sqlilabs --difficulty easyPurpose: Comprehensive vulnerability testing
Vulnerability Categories:
- HTML5 Security
- Authentication
- Session Management
- Cryptography
- Business Logic
Installation:
# Deploy bWAPP
./database-install-secure.sh --app bwapp --setup advancedPurpose: OWASP Top 10 demonstration platform
Features:
- Real-world vulnerabilities
- Multiple security contexts
- Exploitation and remediation examples
- Challenge modes
Installation:
# Deploy Mutillidae II
./database-install-secure.sh --app mutillidae --mode training# Build penetration testing lab containers
docker-compose -f docker/docker-compose.yml up -d
# Access isolated lab environment
docker-compose exec dvwa /bin/bash# docker-compose.yml
version: '3.8'
services:
dvwa:
image: vulnerables/web-dvwa
networks:
- pentest-isolated
ports:
- "8080:80"
environment:
- MYSQL_DATABASE=dvwa
- MYSQL_USER=PenLabs
- MYSQL_PASSWORD=ChangeMeNow!
volumes:
- ./logs:/var/log/apache2
networks:
pentest-isolated:
driver: bridge
ipam:
config:
- subnet: 172.20.0.0/16# Customize installation paths
export PENTEST_LOG=/var/log/pentest-labs/
export PENTEST_CONFIG=/etc/pentest-labs/
export PENTEST_DATA=/opt/pentest-labs/
# Security settings
export PENTEST_ISOLATION=strict
export PENTEST_MONITORING=enabled
export PENTEST_BACKUPS=enabled# ~/.pentest_labs.conf
MYSQL_USER="YourSecureUser"
MYSQL_PASSWORD="YourSecurePassword"
LAB_DOMAIN="pentest.local"
NETWORK_RANGE="192.168.100.0/24"
FIREWALL_ENABLED="yes"
MONITORING_ENABLED="yes"# Real-time threat detection
./monitoring/threat-detection.sh
# Network traffic analysis
./monitoring/network-monitor.sh --interface eth0
# File integrity monitoring
./monitoring/file-monitor.sh --directory /var/www# Centralized logging setup
./utils/setup-logging.sh --centralized
# Log rotation and archiving
./utils/log-rotation.sh --compress --retention 30d
# Security event correlation
./utils/correlate-events.sh --threshold high# Deploy custom vulnerability lab
./utils/create-lab.sh \
--name "Custom Lab" \
--domain custom.pentest \
--vulnerabilities "xss,sqli,rce" \
--difficulty "medium" \
--isolation "strict"# Deploy all labs at once
./utils/deploy-all-labs.sh --parallel --monitor
# Security assessment automation
./utils/security-assessment.sh --comprehensive --report-format json# Create lab snapshots
./utils/lab-backup.sh --full --compress
# Restore from backup
./utils/lab-restore.sh --backup-file /backups/lab-2024-01-24.tar.gz| Issue | Solution |
|---|---|
| Apache won't start | Check port 80 availability: `sudo netstat -tlnp |
| MySQL connection failed | Verify service: sudo systemctl status mysql |
| Permission denied | Check file permissions: sudo chown -R www-data:www-data /var/www |
| DVWA config error | Verify database credentials in config.inc.php |
| Network access denied | Check firewall rules: sudo ufw status |
# Enable verbose logging
export DEBUG=true
export LOG_LEVEL=DEBUG
# Run with debugging
./lamp-install-secure.sh --debug --verbose# Complete system health check
./utils/health-check.sh --comprehensive
# Service status overview
./utils/service-status.sh --all
# Security audit
./utils/security-audit.sh --full-report- SECURITY.md - Comprehensive security documentation
- INSTALLATION.md - Detailed installation guide
- API.md - Script API reference
- TRAINING.md - Learning path and exercises
- CHEATSHEETS.md - Quick reference guides
- BEST_PRACTICES.md - Security best practices
- CONTRIBUTING.md - Development guidelines
- CODE_OF_CONDUCT.md - Community guidelines
This toolkit is designed exclusively for:
- ✅ Educational institutions and cybersecurity training
- ✅ Security professionals conducting authorized testing
- ✅ Students learning penetration testing concepts
- ✅ Researchers working in controlled environments
Users must comply with:
- 🏛️ Local computer crime laws
- 🌐 International cybersecurity regulations
- 🏢 Organizational security policies
- 📋 Terms of service for all systems
This repository contains intentionally vulnerable applications for educational purposes only. Users are solely responsible for ensuring compliance with all applicable laws and regulations. The authors assume no liability for misuse or unauthorized use.
We welcome contributions from the security community!
# Development environment
git clone https://github.com/E7H31234L/Pen-Testing.git
cd Pen-Testing
virtualenv venv && source venv/bin/activate
pip install -r requirements-dev.txt
# Run tests and quality checks
pre-commit run --all-files
./tests/run-all-tests.sh- 🔒 Security-first development approach
- ✅ Comprehensive documentation for all changes
- 🧪 Automated testing for new features
- 📋 Code review process mandatory
- 🏷️ Semantic versioning for releases
- Documentation: Check SECURITY.md first
- Issues: GitHub Issues
- Discussions: GitHub Discussions
Vulnerability Reports: security@github.com/E7H31234L/Pen-Testing Security Questions: security-research@organization.com
- Reddit: r/netsec, r/AskNetsec
- Discord: Penetration Testing Laboratory Community
- LinkedIn: Security Research Groups
- 🔒 Complete security hardening of all scripts
- 🛡️ Added comprehensive input validation and sanitization
- 📝 Extensive security documentation and guidelines
- 🐳 Docker containerization support
- 🔍 Security monitoring and logging integration
- ⚙️ Configuration management and encryption
- 📦 Basic LAMP installation scripts
- 🎯 DVWA deployment automation
- 📋 Simple database setup utilities
This project is licensed under the MIT License - see LICENSE file for details.
- OWASP Foundation - Security guidelines and standards
- DVWA Project - Vulnerable web application
- bWAPP Project - Web application security training
- Mutillidae Project - OWASP Top 10 demonstration
- Security Community - Contributions and feedback
For educational security training and authorized testing only. 🎓