docker-compose.yml

version: "3.8"

# ⚠️ FOR LOCAL TESTING ONLY
# These services are intentionally insecure/misconfigured so that the NSE
# scripts in this repository have real targets to detect issues against.
# Never expose these ports to the public internet or run this on a shared network.

services:

  # ---------------------------------------------------------------------
  # HTTP target — plain Nginx with no security headers, no HTTPS.
  # Used to test: HTTP/http-security-headers, HTTP/http-cookie-flags,
  # HTTP/http-cors-config, HTTP/http-methods-enum, HTTP/http-server-fingerprint,
  # HTTP/http-dir-listing, HTTP/http-trace-method, etc.
  # ---------------------------------------------------------------------
  http-target:
    image: nginx:1.25-alpine
    container_name: nse-test-http
    ports:
      - "8080:80"
    volumes:
      - ./test-fixtures/http/index.html:/usr/share/nginx/html/index.html:ro
    restart: unless-stopped

  # ---------------------------------------------------------------------
  # FTP target — anonymous login enabled, no TLS.
  # Used to test: FTP/ftp-anonymous-login, FTP/ftp-banner-grab,
  # FTP/ftp-cleartext-enforcement, FTP/ftp-passive-mode-check, FTP/ftp-tls-support,
  # FTP/ftp-writable-dirs, etc.
  # ---------------------------------------------------------------------
  ftp-target:
    image: fauria/vsftpd
    container_name: nse-test-ftp
    ports:
      - "2121:21"
      - "21100-21110:21100-21110"
    environment:
      FTP_USER: testuser
      FTP_PASS: testpass
      PASV_ADDRESS: 127.0.0.1
      PASV_MIN_PORT: 21100
      PASV_MAX_PORT: 21110
    restart: unless-stopped

  # ---------------------------------------------------------------------
  # Redis target — no authentication (default insecure config).
  # Used to test: DATABASE/redis-unauthenticated-access,
  # DATABASE/redis-admin-command-exposure.
  # ---------------------------------------------------------------------
  redis-target:
    image: redis:7-alpine
    container_name: nse-test-redis
    ports:
      - "6380:6379"
    command: redis-server --protected-mode no
    restart: unless-stopped

networks:
  default:
    name: nse-test-network