Share
## https://sploitus.com/exploit?id=DCB2198C-FBEF-526A-91B1-077D0C9A371C
# NGINX CVE-2026-42945 (Rift) — local defensive lab
Two Dockerized NGINX instances: pattern-based “risky rewrite” snippet vs remediated named-capture snippet, pinned to `nginx:1.30.0-alpine` / `nginx:1.30.1-alpine`. Scripts run benign curls, dump `nginx -T`, and archive evidence. For configuration review training only—`/health`, `/nginx_status`, `/legacy/` are lab endpoints; tighten exposure outside a lab VLAN.
Scope: authorized hosts only. Vendor advisories and your own policy interpret `[RISK]` output from [`scripts/check-nginx-rewrite-risk.sh`](scripts/check-nginx-rewrite-risk.sh) (heuristic grep over config, not a formal scanner).
## Layout
```
Host 127.0.0.1:18080 -> nginx-rift-vulnerable (listens :8080 in container)
Host 127.0.0.1:18081 -> nginx-rift-patched
www/ -> RO -> /usr/share/nginx/html (both)
nginx-vulnerable/nginx-patched -> RO -> conf.d/default.conf
Network: nginx_rift_net (bridge)
```
Repo tree: `docker-compose.yml`, `nginx-{vulnerable,patched}/default.conf`, `www/`, `scripts/`, `evidence/` (artifacts gitignored except `.gitkeep`), `docs/`.
## Prerequisites
Docker + `docker compose`, bash, `curl`. Once: `chmod +x scripts/*.sh`. Linux (or VM) exposes `/proc/sys/kernel/randomize_va_space` if you care about that collector line in `collect-evidence.sh`; macOS Docker Desktop often skips it—script notes that case.
## Commands
```bash
cd nginx-rift-defensive-lab
docker compose pull # optional
docker compose up -d
docker compose ps
./scripts/benign-request-test.sh
./scripts/check-nginx-rewrite-risk.sh
./scripts/check-nginx-rewrite-risk.sh nginx-rift-patched
./scripts/collect-evidence.sh
./scripts/cleanup-lab.sh
# ./scripts/cleanup-lab.sh --purge-evidence
```
Change host ports if 18080/18081 collide ([`docker-compose.yml`](docker-compose.yml)).
## Endpoints
| Path | Role |
|---|---|
| `/health` | Stable text for probes (`vulnerable-nginx-alive` / `patched-nginx-alive`) |
| `/nginx_status` | `stub_status` (restrict in prod) |
| `/legacy/` | Rewrite demo |
## Documentation
| File | Purpose |
|---|---|
| [`docs/LAB_GUIDE.md`](docs/LAB_GUIDE.md) | Step-by-step lab |
| [`docs/WEBINAR_FLOW.md`](docs/WEBINAR_FLOW.md) | Presenter pacing |
| [`docs/PRTG_MONITORING_NOTES.md`](docs/PRTG_MONITORING_NOTES.md) | Sensor examples |
| [`docs/REMEDIATION_SUMMARY_TEMPLATE.md`](docs/REMEDIATION_SUMMARY_TEMPLATE.md) | CAB/incident skeleton |
| [`docs/NGINX_RIFT_DEFENSIVE_LAB_COMPLETE_GUIDE.md`](docs/NGINX_RIFT_DEFENSIVE_LAB_COMPLETE_GUIDE.md) | Consolidated Markdown |
| [`docs/TR_KAPSAMLI_SAVUNMA_LAB_REHBERI.md`](docs/TR_KAPSAMLI_SAVUNMA_LAB_REHBERI.md) | Turkish handbook |
| [`docs/PDF_GENERATION_NOTES.txt`](docs/PDF_GENERATION_NOTES.txt) | Optional local PDF build (`docs/*.pdf`, gitignored) |
Use `docker compose up -d` with a hyphen. Shell globs such as `*d` can expand to unintended filenames.