docker-compose.yml

version: '3.5'

services:
  dummyhttp:
    image: "svenstaro/dummyhttp:1.1.0@sha256:9bd5ee6432fbee297107529b1d96a59631f1cb9bcde92cc56b8fd17f688e1606"
  crs:
    image: "owasp/modsecurity-crs:4-apache-202404131004@sha256:9c20dd4756378de04c3587911efdf37c15614403c0540e008f16ca1cdbc63cba"
    environment:
      PORT: 8080
      BACKEND: "http://dummyhttp:8080"
      MODSEC_RULE_ENGINE: "On"
      BLOCKING_PARANOIA: 4
      MODSEC_AUDIT_LOG_FORMAT: JSON
      MODSEC_AUDIT_LOG_TYPE: concurrent
      MODSEC_TMP_DIR: "/tmp"
      # Apache only
      SERVERNAME: _default_
      MODSEC_ERROR_LOG: "/dev/stderr"
      MODSEC_AUDIT_LOG: "/var/log/apache2/modsec_audit.log"
    hostname: crs
  nuclei:
    image: projectdiscovery/nuclei:latest@sha256:cdb478b86aeb88def5453f18ab92d80d83c989de033c62f6b83881e701c3567e
    hostname: nuclei
    container_name: nuclei
    command: -u http://crs:8080 -t http/cves -type http -stats -ni -sresp -jle output.json
    volumes:
      - ./output:/output:rw
    depends_on:
      - dummyhttp
      - crs