SBOM Generation & Verification
devsecops · medium · +45 XP
Target
GET /api/lab/sbom-101/image (Docker image manifest + layers + installed packages)
POST /api/lab/sbom-101/submit body {package_name, version, cve_id}
Goal: scan the image manifest. One package has a known critical CVE (think log4j-2.14.0 or openssl 1.0.2). Submit the package name + version + CVE id. The mini-vuln-db has 4 entries.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/sbom-101/
// reuse on the cli
// submit flag
// no solves yet
2 of 12 · devsecops