Unguard

Unguard (🇦🇹 [ˈʊnˌɡuːat] like disquieting, 🇫🇷 [ãˈɡard] like the fencing command) is an insecure cloud-native microservices demo application. It consists of eight app services, a load generator, and two databases. Unguard encompasses vulnerabilities like server-side request forgery (SSRF), Command/SQL injection, JWT key confusion, remote code execution and many more.

The application is a web-based Twitter clone where users can register/login, post text, URLs and images and follow users. Unguard also features fake ads, a possibility to edit your biography and manage your membership.

Note This product is not officially supported by Dynatrace

🖼️ Screenshots

| Timeline | User profile | |---------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------| | | |

🏗️ Architecture

Unguard is composed of eight microservices written in different languages that talk to each other over REST.

| Service | Language | Service Account | Description | |------------------------------------------------------------|---------------------|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------| | envoy-proxy | | default | Routes to the frontend or the ad-service and also provides a vulnerable health endpoint. | | frontend | Next.js | default | Provides a modern frontend to allow the user to interact with the application. Includes an API that talks with the other microservices. | | ad-service | .NET 5 | default | Provide CRUD operation for images and serves a HTML page which displays an image like an ad. | | microblog-service | Java Spring | default | Serves a REST API for the frontend and saves data into redis (explicitly calls vulnerable functions of the jackson-databind library 2.9.9). | | proxy-service | Java Spring | unguard-proxy | Serves REST API for proxying requests from frontend (vulnerable to SSRF; no sanitization on the entered URL). | | profile-service | Java Spring | default | Serves REST API for updating biography information in a H2 database; vulnerable to SQL injection attacks | | membership-service | .NET 7 | default | Serves REST API for updating user memberships in a MariaDB; vulnerable to SQL injection attacks | | like-service | PHP | default | Serves REST API for adding likes to posts using MariaDB; vulnerable to SQL injection attacks | | user-auth-service | Node.js Express | default | Serves REST API for authenticating users with JWT tokens (vulnerable to JWT key confusion and SQL injection attacks). | | status-service | Go | unguard-status | Serves REST API for Kubernetes deployments health, as well as a user and user role list (vulnerable to SQL injection) | | payment-service | Python Flask | default | Serves REST API for adding and retrieving credit card payment information associated with a user. | | jaeger | | default | The Jaeger stack for distributed tracing. | | mariadb | | unguard-mariadb | Relational database that holds user and token data. | | redis | | default | Key-value store that holds all user data (except authentication-related stuff). | | user-simulator | Node.js (Puppeteer) | default | Creates synthetic user traffic by simulating an Unguard user using a real browser. Acts as a load generator. | | malicious-load-generator | | default | Malicious load generator that makes CMD, JNDI, and SQL injections. |

Quickstart

To quickly get started with Unguard, install the Unguard Helm chart using the Helm package manager

Warning \ Unguard is insecure by design and a careless installation will leave you exposed to severe security vulnerabilities. Make sure to restrict access and/or run it in a sandboxed environment.

1. Add the bitnami repository for the MariaDB dependency

sh helm repo add bitnami https://charts.bitnami.com/bitnami

1. Install MariaDB

sh helm install unguard-mariadb bitnami/mariadb --version 11.5.7 --set primary.persistence.enabled=false --wait --namespace unguard --create-namespace

1. Install Unguard

sh helm install unguard oci://ghcr.io/dynatrace-oss/unguard/chart/unguard --wait --namespace unguard --create-namespace

To customize your Unguard chart installation, see the chart README

🖥️ Local Development

See the Development Guide on how to set up and develop Unguard on a local Kubernetes cluster.

☁️ Kubernetes Deployment

See the Unguard Chart README on how to install Unguard in your Kubernetes cluster using the Helm package manager.

✨ Features

• Kubernetes/AWS: The app is designed to run on a local Kubernetes cluster, as well as on the cloud with AWS.
• Jaeger Tracing: Most services are instrumented using trace interceptors.
• Skaffold: Unguard is deployed to Kubernetes with a single command using Skaffold.
• Synthetic Load Generation: The application comes with a deployment that creates traffic using the Element browser-based load generation library.
• Exploits: Different automated attack scenarios like JWT key confusion attacks or remote code execution.
• Monitoring: Dynatrace monitoring by utilizing MONACO.

➕ Additional Deployment Options

• Tracing and Jaeger: See these instructions
• Malicious Load Generator: See these instructions

Hummingbird icon by Danil Polshin from the Noun Project.