I am preparing WAF video for my team and I want to test a sample ubuntu server which will be my victim.

I'd like to install "old version" of packages and deploy Wordpress on top of it and use some CVE.

In my video I want to show "the before" state and "after" state.

In my case, any Linux distribution will work. I selected Ubuntu as I have the most experience with it.


If you search for the package name (lets use nginx for now) you would search for the candidate like so :

$ apt-cache policy nginx nginx: Installed: (none) Candidate: 1.14.0-0ubuntu1.2 Version table: 1.14.0-0ubuntu1.2 500 500 http://us.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages 500 http://us.archive.ubuntu.com/ubuntu bionic-updates/main i386 Packages 500 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages 500 http://security.ubuntu.com/ubuntu bionic-security/main i386 Packages 1.14.0-0ubuntu1 500 500 http://us.archive.ubuntu.com/ubuntu bionic/main amd64 Packages 500 http://us.archive.ubuntu.com/ubuntu bionic/main i386 Packages

Using the version table given, you can specify an older version like so :

$ sudo apt install nginx=1.14.0-0ubuntu1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.