I was just wondering if there are already deliberate vulnerable Openstack images for penetration testing/training or research. Something in line with OWASP's DVWA e.t.c....there quite a lot out there for web applications especially. I am doing a research and will be very glad if someone already has something like that or possibly direct me to the right place. The similar projects as mentioned here differ from what I am seeking for. While most of the existing solutions focus on linux distributions and web applications, OpenStack composes of several cloud services which could have several types of vulnerabilities. Moreover, OpenStack could be installed standalone via ironic. Many thanks !!
After searching across the internet, it seems there are really no "ready made" vulnerable OpenStack images similar to web applications like OWASP DVWA. However, I think a starting point is to install old OpenStack releases and also install some vulnerable software on it. I have found icehouse easy install here. I will like to start working on this...any one interested in this topic is welcome.