webpwnized/mutillidae

Web app is rendering a default page

JGillam opened this issue · 1 comments

JGillam commented

I did a build last night and then did a build this morning and am getting different results. My build from last night is rendering the web application correctly. My build from this morning is only rendering the default "It Works!" web page.

Additional context:
This is built from within SamuraiWTF, using the mutillidae katana script.

So it is making a few modifications to the docker-compose.yml file prior to running. However, these changes appeared to work fine yesterday so I have to believe something about the recent update is affecting it. Also, I am getting an html page for a response, it's just the wrong page (it's the default webserver page instead of the application's home page).

webpwnized commented

I think this is fix now in Mutillidae 2.10.0 and up. I had to try several iterations to find a method that works (no pun intended) with Google Cloud Platform, Azure Cloud, Samurai, Octagon, etc. Different techniques work in some but not others. I think the best method is to prevent the default Apache configuration from starting and only allow the mutillidae.conf to be loaded by Apache. This appears to work in all platforms.

There was another issue that popped up at the same time. Firefox is automatically upgrading connections to the ".local" top level domain. Apparently, ".local" is now pre-loaded into the HSTS list. I moved the project to the "mutillidae.localhost" domain which works in Octagon. I still need to test GCP and Azure.