  A cyber range is a realistic simulation of an organization's network
infrastructure, commonly used for cyber security training purposes. It provides
a safe environment to assess competencies in both offensive and defensive
techniques. An important step during the realization of a cyber range is the
generation of vulnerable machines. This step is challenging and requires a
laborious manual configuration. Several works aim to reduce this overhead, but
the current state-of-the-art focuses on generating network services without
considering the effort required to build vulnerable environments for web
applications. A cyber range should represent a real system, and nowadays,
almost all the companies develop their company site by using WordPress, a
common Content Management System (CMS), which is also one of the most critical
attackers' entry points. The presented work proposes an approach to
automatically create and configure vulnerable WordPress applications by using
the information presented in public exploits. Our platform automatically
extracts information from the most well-known publicly available exploit
database in order to generate and configure vulnerable environments. The
container-based virtualization is used to generate lightweight and easily
deployable infrastructures. A final evaluation highlights promising results
regarding the possibility of automating the generation of vulnerable
environments through our approach.
