Thanks for your suggestion, I tried to change HSTS setting by override the application in the Apache headers configuration file (/etc/apache2/sites-available/mutillidae.conf
), however apache2 was crashed when I restarted the service and it can't be brought up.
Here is the step by step to reproduced the error, let me know if I missed anything
- Start docker container
host:~/mutillidae-docker$ docker-compose up
Creating network "mutillidae-docker_datanet" with the default driver
Creating network "mutillidae-docker_ldapnet" with the default driver
Creating mutillidae-docker_directory_1 ... done
Creating mutillidae-docker_database_1 ... done
Creating mutillidae-docker_database_admin_1 ... done
Creating mutillidae-docker_www_1 ... done
Creating mutillidae-docker_directory_admin_1 ... done
...
- Docker is listening on port 80,81,82 and 443 which is normal
host:~/mutillidae-docker$ sudo ss -antp | grep docker
LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("docker-proxy",pid=9894,fd=4))
LISTEN 0 4096 0.0.0.0:81 0.0.0.0:* users:(("docker-proxy",pid=9788,fd=4))
LISTEN 0 4096 0.0.0.0:82 0.0.0.0:* users:(("docker-proxy",pid=9842,fd=4))
LISTEN 0 4096 0.0.0.0:443 0.0.0.0:* users:(("docker-proxy",pid=9855,fd=4))
host:~/mutillidae-docker$
- HSTS is disabled
host:~/mutillidae-docker$ curl -IL localhost
HTTP/1.1 302 Found
Server: Apache/2.4.52 (Debian)
X-Powered-By: PHP/8.1.2
Set-Cookie: PHPSESSID=c3a2a70d2e0d92c1c1d193dc13f9cff4; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: showhints=1; path=/; SameSite=Lax
Location: database-offline.php
Content-Type: text/html; charset=UTF-8
HTTP/1.1 200 OK
Server: Apache/2.4.52 (Debian)
X-Powered-By: PHP/8.1.2
Set-Cookie: PHPSESSID=36d10641d76f05201aba97d59f08d734; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
host:~/mutillidae-docker$
- Create database, however, HSTS is seen on HTTP response but still disabled (max-age=0)
host:~$ curl -skI http://localhost | grep Strict
Strict-Transport-Security: max-age=0
host:~$
- List containers
host:~/mutillidae-docker$ docker-compose ps
Name Command State Ports
-----------------------------------------------------------------------------------------------------------------------
mutillidae-docker_database_1 docker-entrypoint.sh mysqld Up 3306/tcp, 33060/tcp
mutillidae-docker_database_admin_1 /docker-entrypoint.sh apac ... Up 0.0.0.0:81->80/tcp
mutillidae-docker_directory_1 /container/tool/run Up 389/tcp, 636/tcp
mutillidae-docker_directory_admin_1 /container/tool/run Up 443/tcp, 0.0.0.0:82->80/tcp
mutillidae-docker_www_1 docker-php-entrypoint apac ... Up 0.0.0.0:443->443/tcp, 0.0.0.0:80->80/tcp
host:~/mutillidae-docker$
- Get into container's bash
host:~/mutillidae-docker$ docker exec -it mutillidae-docker_www_1 bash
root@9528fb465ddd:/var/www/html#
- View HSTS setting in mutillidae.conf (disabled)
root@9528fb465ddd:/var/www/html# cd /etc/apache2/sites-available/
root@9528fb465ddd:/etc/apache2/sites-available# ls -lh
total 16K
-rw-r--r-- 1 root root 1.4K Aug 8 2020 000-default.conf
-rw-r--r-- 1 root root 6.2K Aug 8 2020 default-ssl.conf
-rw-r--r-- 1 root root 2.4K Feb 27 11:20 mutillidae.conf
root@9528fb465ddd:/etc/apache2/sites-available#
root@9528fb465ddd:/etc/apache2/sites-available# nl mutillidae.conf | grep Strict-Transport-Security
21 #Header set Strict-Transport-Security "max-age=31536000;includeSubDomains;preload"
root@9528fb465ddd:/etc/apache2/sites-available#
root@9528fb465ddd:/etc/apache2/sites-available# nl mutillidae.conf | grep Header
21 #Header set Strict-Transport-Security "max-age=31536000;includeSubDomains;preload"
root@9528fb465ddd:/etc/apache2/sites-available#
- Enable it
root@9528fb465ddd:/etc/apache2/sites-available# sed -i 's/#Header/Header/' mutillidae.conf | grep Header
root@9528fb465ddd:/etc/apache2/sites-available# nl mutillidae.conf | grep Header
21 Header set Strict-Transport-Security "max-age=31536000;includeSubDomains;preload"
root@9528fb465ddd:/etc/apache2/sites-available#
- Restart Apache, apache2 was Terminated/crashed
root@9528fb465ddd:/etc/apache2/sites-available# service apache2 status
apache2 is running.
root@9528fb465ddd:/etc/apache2/sites-available#
root@9528fb465ddd:/etc/apache2/sites-available# service apache2 restart
Restarting Apache httpd web server: apache2Terminated
root@9528fb465ddd:/etc/apache2/sites-available# host:~/mutillidae-docker$
host:~/mutillidae-docker$
- State for "mutillidae-docker_www_1" is "Exit 0" after apache2 service restarted
host:~/mutillidae-docker$ docker-compose ps
Name Command State Ports
-----------------------------------------------------------------------------------------------------------
mutillidae-docker_database_1 docker-entrypoint.sh mysqld Up 3306/tcp, 33060/tcp
mutillidae-docker_database_admin_1 /docker-entrypoint.sh apac ... Up 0.0.0.0:81->80/tcp
mutillidae-docker_directory_1 /container/tool/run Up 389/tcp, 636/tcp
mutillidae-docker_directory_admin_1 /container/tool/run Up 443/tcp, 0.0.0.0:82->80/tcp
mutillidae-docker_www_1 docker-php-entrypoint apac ... Exit 0
host:~/mutillidae-docker$
- I stop the docker with Ctrl+C and tried to brought it up with "docker-compose up", however the State for "mutillidae-docker_www_1" changed to "Exit 1" now
host:~/mutillidae-docker$ docker-compose ps
Name Command State Ports
-----------------------------------------------------------------------------------------------------------
mutillidae-docker_database_1 docker-entrypoint.sh mysqld Up 3306/tcp, 33060/tcp
mutillidae-docker_database_admin_1 /docker-entrypoint.sh apac ... Up 0.0.0.0:81->80/tcp
mutillidae-docker_directory_1 /container/tool/run Up 389/tcp, 636/tcp
mutillidae-docker_directory_admin_1 /container/tool/run Up 443/tcp, 0.0.0.0:82->80/tcp
mutillidae-docker_www_1 docker-php-entrypoint apac ... Exit 1
host:~/mutillidae-docker$
- Port 80 & 443 are not listening now, only 81 & 82 are listening
host:~/mutillidae-docker$ sudo ss -antp | grep docker
LISTEN 0 4096 0.0.0.0:81 0.0.0.0:* users:(("docker-proxy",pid=12040,fd=4))
LISTEN 0 4096 0.0.0.0:82 0.0.0.0:* users:(("docker-proxy",pid=12060,fd=4))
host:~/mutillidae-docker$
- At this moment, I've no choice but to stop and remove containers, networks, images, and volumes with "docker-compose down" and "docker-compose up" again to use mutillidae again. However, the main issue which is to enabled HSTS by override the application in the Apache headers configuration file was not accomplished yet.
What's wrong in my steps? Please let me know the right way to do it. Thanks again