New LAB · Damn Vulnerable NGINX Proxy
Source Reddit Cybersecurity
Discussion
Damn Vulnerable NGINX Proxy (DVNP) is a self-contained web security lab published by OWASP that simulates a multi-host NGINX reverse-proxy environment with over 20 real-world misconfigurations. It is designed for security professionals to practice identifying and exploiting chained web and reverse-proxy misconfigurations in a controlled setting. This lab includes backend Flask applications and shared resources to provide a realistic environment for pentesting and bug bounty training. It is not a vulnerability itself but a training tool to improve skills in finding NGINX-related security issues.
r/cybersecurity (opens in a new tab)u/OilOverall41900 points0 comments
Hello all,
If you do bug bounty hunting or pentests you surely came across many hosts served from an NGINX server, in this lab (published to OWASP) I combined over 20 misconfigurations found in real world bug disclosures and both classic and novel security research, with an extensive blog where I explained everything you need to level up your NGINX hunting game.
Feel free to check it out, give it a star on Github if you like it, and suggest any ideas you want me to add/fix...
https://vwad.owasp.org/app/damn-vulnerable-nginx-proxy-dvnp/
Happy hunting!