Update readme

.ddev/commands/web/provision

+#!/bin/bash
+
+## #ddev-generated
+## Description: Provisioning of the web container
+## Usage: provision
+## Example: "ddev provision"
+
+DOCROOT=/var/www/html
+
+cd $DOCROOT && composer install
+cd $DOCROOT && cp .env.example .env
+cd $DOCROOT && php artisan key:generate
+cd $DOCROOT && php artisan migrate:fresh

.env.example

@@ -9,11 +9,11 @@ LOG_DEPRECATIONS_CHANNEL=null
 LOG_LEVEL=debug
 
 DB_CONNECTION=mysql
-DB_HOST=127.0.0.1
+DB_HOST=db
 DB_PORT=3306
-DB_DATABASE=laravel
-DB_USERNAME=root
-DB_PASSWORD=
+DB_DATABASE=db
+DB_USERNAME=db
+DB_PASSWORD=db
 
 BROADCAST_DRIVER=log
 CACHE_DRIVER=file

README.md

@@ -3,18 +3,24 @@
 This repository contains the code for demonstrating a SSRF vulnerability in a close-to real-world scenario.
 The demonstration is written in PHP and makes use of the [Laravel framework](https://laravel.com).
 
-To get started, set up the project on a web server (e.g. NGINX, Apache) and connect it to a database (MySQL, MariaSQL).
+To get started, clone the project and set it up on a web server with PHP 8.0 (e.g. NGINX, Apache), as well as connecting it to a database (MySQL, MariaSQL).
+The webserver needs to be pointed to the entry point of the application, which is `public/index.php`.
 Make sure the values are correctly set in the .env file.
-For more information on this, click [here](https://laravel.com/docs/8.x/installation) and also [here](https://laravel.com/docs/8.x/installation#environment-based-configuration).
-There are many options that aim to simplify this process, for example:
-- [DDEV](ddev.com)
+Install the PHP dependency manager Composer and run `composer install`.
+
+For more information on the installation steps, click [here](https://laravel.com/docs/8.x/installation) and also [here](https://laravel.com/docs/8.x/installation#environment-based-configuration).
+There are many options that aim to simplify the setup process, for example:
+- [DDEV](ddev.com) (This is probably the easiest way if you have Docker
+  installed, and also what I use to run this project. After the DDEV
+  installation, simply run `ddev provision && ddev launch profile` inside the
+  project directory.)
 - [Laravel Homestead](https://laravel.com/docs/8.x/homestead)
 - [Laravel Sail](https://laravel.com/docs/8.x/sail)
 - [Laradock](https://laradock.io/)
 
-With the project running, visit `/profile`.
+With the project running, visit `<domain>/profile` in your browser.
 This page will provide a minimal input form, in to which an URI can be entered.
-After clicking `Save`, the input will be persisted to the database. 
+After clicking `Save`, the input will be persisted to the database.
 
 When a valid URI pointing to an image was provided, that image will now be diplayed on the page.
 Other valid URIs will be rendered as broken `<img>` tags, but the content corresponding content is visible in the Browser's Dev Tools.
@@ -27,5 +33,5 @@ Possible inputs
    * file:///var/www/html/routes/web.php
    * http://localhost/admin
    * file:///var/www/html/.env
-   * file:///usr/passwd
- 
\ No newline at end of file
+   * file:///etc/passwd
+