05. Stand up a practice target 🎯¶

To learn attacks, you need "a target it's okay to attack." Here we'll stand up a practice app made intentionally vulnerable inside your own machine.

The targets we'll stand up on this page¶

Target	Type	Vulnerability used
Vulhub's Struts2 (S2-045)	Server-side vulnerability	Remote code execution (the star of this guide)
OWASP Juice Shop	Web application vulnerability	SQLi / XSS, etc. (a bonus)

Why is Struts2 the star? → Because it's a standard target that Metasploit hits cleanly in one shot, making it ideal for learning the "recon → attack → post-exploitation" flow.

What is Vulhub¶

flowchart TB
    V["Vulhub repository"] --> A["struts2/<br>s2-045, s2-052..."]
    V --> B["log4j/<br>CVE-2021-44228"]
    V --> C["weblogic/ ..."]
    V --> D["(334 targets)"]
    style V fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3

Vulhub is a well-known repository that bundles together "a target per vulnerability." Each folder has a docker-compose.yml, and each one is the blueprint for "a target that has that vulnerability."

# Get Vulhub (a collection of target blueprints — harmless config files on their own)
cd ~/web          # put it anywhere you like
git clone --depth 1 https://github.com/vulhub/vulhub.git

💡 Start a target only when you're using it, and stop it when you're done (docker compose down). Since it's intentionally vulnerable, the cardinal rule is to never leave it running.

Stand up the Struts2 (S2-045) target¶

In this guide, so that we can later put it on the same network as the "attacker container," we'll use docker run instead of docker compose, exposing the port to localhost only.

# Start the target (127.0.0.1 = exposed so only you can access it)
docker run -d --name struts2-s2045 \
  -p 127.0.0.1:8088:8080 \
  vulhub/struts2:2.3.30

Option	Meaning
`-d`	Run in the background
`--name struts2-s2045`	Give the container a name
`-p 127.0.0.1:8088:8080`	Only you (127.0.0.1) can access it on port 8088. Not exposed to the outside

🔒 Safety point: writing -p 8088:8080 would expose it to the entire network. Always prefix it with 127.0.0.1: so that only you can access it.

Confirm it's up¶

The vulnerable target is Java (Tomcat/Jetty), so it takes a little while to start.

# Wait until it responds (an HTTP 200 means it's up)
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  http://localhost:8088/showcase.action

HTTP 200      ← when this appears, the target is ready

Open http://localhost:8088/showcase.action in a browser and you'll see a sample app called "Struts2 Showcase." It looks like just a sample, but this is the attack target.

(Bonus) Stand up Juice Shop¶

For when you want to get hands-on with web app vulnerabilities (SQLi/XSS).

docker run -d --name juice-shop \
  -p 127.0.0.1:3000:3000 \
  bkimminich/juice-shop:latest

Open http://localhost:3000 in a browser and it looks like an ordinary juice-store site, but practice vulnerabilities are planted all over it.

Stop or remove a target¶

# Stop it (to use again later)
docker stop struts2-s2045

# Remove it completely (practice finished)
docker rm -f struts2-s2045

Next, head to 06. Recon (nmap).