diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaa b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaa
new file mode 100644
index 000000000..9f7473dfd
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaa differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partab b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partab
new file mode 100644
index 000000000..710f570a6
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partab differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partac b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partac
new file mode 100644
index 000000000..6128313fe
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partac differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partad b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partad
new file mode 100644
index 000000000..3f67ddfbd
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partad differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partae b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partae
new file mode 100644
index 000000000..2fc02b130
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partae differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaf b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaf
new file mode 100644
index 000000000..61defe063
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaf differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partag b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partag
new file mode 100644
index 000000000..23d5d09fc
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partag differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partah b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partah
new file mode 100644
index 000000000..e61ce27cd
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partah differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partai b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partai
new file mode 100644
index 000000000..9ac849512
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partai differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaj b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaj
new file mode 100644
index 000000000..a6a40192d
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaj differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partak b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partak
new file mode 100644
index 000000000..4c6d3ab77
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partak differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partal b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partal
new file mode 100644
index 000000000..9301879a4
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partal differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partam b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partam
new file mode 100644
index 000000000..909171dda
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partam differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partan b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partan
new file mode 100644
index 000000000..b7ce0a5da
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partan differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partao b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partao
new file mode 100644
index 000000000..2661ed5ff
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partao differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partap b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partap
new file mode 100644
index 000000000..f923ca3c7
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partap differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaq b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaq
new file mode 100644
index 000000000..2c804484b
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partaq differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partar b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partar
new file mode 100644
index 000000000..009e4fc65
Binary files /dev/null and b/modules/vulnerabilities/unix/webapp/gitlab_13102/files/gitlab-ce_13.10.2-ce.0_amd64.deb.partar differ
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/functions/cpandbuild.pp b/modules/vulnerabilities/unix/webapp/gitlab_13102/functions/cpandbuild.pp
new file mode 100644
index 000000000..8b0ee803f
--- /dev/null
+++ b/modules/vulnerabilities/unix/webapp/gitlab_13102/functions/cpandbuild.pp
@@ -0,0 +1,13 @@
+function gitlab_13102::cpandbuild(Array $collection, String $filename) {
+  $collection.each |String $item| {
+    file { "/tmp/${item}":
+      ensure => file,
+      source => "puppet:///modules/gitlab_13102/${item}",
+    }
+  }
+  exec { "rebuild-${filename}":
+    cwd     => '/tmp/',
+    command => "/bin/cat ${filename}.parta* > ${filename}",
+    creates => "/tmp/${filename}",
+  }
+}
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/gitlab_13102.pp b/modules/vulnerabilities/unix/webapp/gitlab_13102/gitlab_13102.pp
new file mode 100644
index 000000000..2fd35ca50
--- /dev/null
+++ b/modules/vulnerabilities/unix/webapp/gitlab_13102/gitlab_13102.pp
@@ -0,0 +1,4 @@
+contain gitlab_13102::install
+contain gitlab_13102::configure
+Class['gitlab_13102::install']
+-> Class['gitlab_13102::configure']
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/manifests/configure.pp b/modules/vulnerabilities/unix/webapp/gitlab_13102/manifests/configure.pp
new file mode 100644
index 000000000..1b0c1d0af
--- /dev/null
+++ b/modules/vulnerabilities/unix/webapp/gitlab_13102/manifests/configure.pp
@@ -0,0 +1,145 @@
+class gitlab_13102::configure {
+
+  $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
+
+  # First leaked string is the gitlab root password
+  $strings_to_leak     = $secgen_parameters['strings_to_leak']
+  $strings_to_pre_leak = $secgen_parameters['strings_to_pre_leak']
+  $difficulty          = $secgen_parameters['difficulty']
+  $leaked_filenames    = $secgen_parameters['leaked_filenames']
+
+  # Could amend in future to take port as parameter but threw error 502 in testing so leaving as default (80) for now
+
+  Exec { path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'] }
+
+  exec { 'set_gitlab_password':
+    command => "echo \"gitlab_rails['initial_root_password'] = '${strings_to_leak[0]}'\" >> /etc/gitlab/gitlab.rb",
+  }
+  ->
+  exec { 'set_gitlab_store_password':
+    command => "echo \"gitlab_rails['store_initial_root_password'] = true\" >> /etc/gitlab/gitlab.rb",
+  }
+  ->
+  exec { 'disable_monitoring': # Avoids race condition where monitoring services don't start before gitlab-ctl reconfigure completes
+    command => "echo \"prometheus_monitoring['enable'] = false\" >> /etc/gitlab/gitlab.rb && echo \"alertmanager['enable'] = false\" >> /etc/gitlab/gitlab.rb && echo \"grafana['enable'] = false\" >> /etc/gitlab/gitlab.rb",
+  }
+  ->
+  exec { 'reconfigure_gitlab':
+    command => '/usr/bin/gitlab-ctl reconfigure > /dev/null 2>&1', # Prevents output flooding the console
+    require => Exec['install_gitlab'],
+    timeout => 1800,
+    tries     => 3,
+    try_sleep => 30,
+  }
+
+  # Leak credentials via git user's home directory
+  exec { 'create_git_home':
+    command => 'mkdir -p /home/git',
+    creates => '/home/git',
+  }
+  ->
+  exec { 'set_git_home_ownership':
+    command => 'chown git:git /home/git',
+    require => Exec['create_git_home'],
+  }
+  ->
+  # Pre leak to robots.txt
+  file_line { 'pre-leak-robots-txt':
+    path => '/opt/gitlab/embedded/service/gitlab-rails/public/robots.txt',
+    line => "# ${strings_to_pre_leak[0]}",
+  }
+
+  # Leak sensitive info via git repo
+  file { '/home/git/.credentials':
+    ensure  => file,
+    content => "root:${strings_to_leak[0]}",
+    owner   => 'git',
+    group   => 'git',
+    mode    => '0600',
+    require => Exec['set_git_home_ownership'],
+  }
+  
+  if $difficulty[0] == 'hard' {
+    exec { 'create_project_dir':
+      command => 'mkdir -p /tmp/dev-notes',
+      creates => '/tmp/dev-notes',
+      require => Exec['reconfigure_gitlab'],
+    }
+    ->
+    exec { 'init_project':
+      command => 'git init',
+      cwd     => '/tmp/dev-notes',
+      creates => '/tmp/dev-notes/.git',
+    }
+    ->
+    exec { 'git_config_email':
+      command => 'git config user.email "root@example.com"',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    # Could be amended in future to use organisation information for realistic scenario
+    exec { 'git_config_name':
+      command => 'git config user.name "Developer J"',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'create_env_file':
+      command => "echo -e 'DB_HOST=localhost\\nDB_PORT=5432\\nDB_USER=root\\nDB_PASSWORD=${strings_to_leak[1]}\\nAPI_KEY=abc123xyz' > .env",
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'create_python_script':
+      command => "echo -e '#!/usr/bin/env python3\\nimport os\\nfrom dotenv import load_dotenv\\n\\nload_dotenv()\\n\\ndb_host = os.getenv(\"DB_HOST\")\\ndb_user = os.getenv(\"DB_USER\")\\ndb_password = os.getenv(\"DB_PASSWORD\")\\n\\nprint(f\"Connecting to {db_host} as {db_user}\")' > app.py",
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'git_add_important':
+      command => 'git add .env app.py',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'git_commit_initial':
+      command => 'git commit -m "Initial commit"',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'remove_env_file':
+      command => 'git rm .env',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'create_gitignore':
+      command => 'echo ".env" > .gitignore',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'git_add_gitignore':
+      command => 'git add .gitignore',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'git_commit_update':
+      command => 'git commit -m "Removed .env file and added to .gitignore"',
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'git_add_remote':
+      command => "git remote add origin http://root:${strings_to_leak[0]}@localhost/root/dev-notes.git",
+      cwd     => '/tmp/dev-notes',
+    }
+    ->
+    exec { 'git_push_master':
+      command => 'git push -u origin master',
+      cwd     => '/tmp/dev-notes',
+    }
+  } else {
+    file { "/home/git/${leaked_filenames[0]}":
+      ensure  => file,
+      content => "${strings_to_leak[1]}",
+      owner   => 'git',
+      group   => 'git',
+      mode    => '0600',
+      require => Exec['set_git_home_ownership'],
+    }
+  }
+}
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/manifests/install.pp b/modules/vulnerabilities/unix/webapp/gitlab_13102/manifests/install.pp
new file mode 100644
index 000000000..e8356bcae
--- /dev/null
+++ b/modules/vulnerabilities/unix/webapp/gitlab_13102/manifests/install.pp
@@ -0,0 +1,35 @@
+class gitlab_13102::install {
+    Exec { path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin']}
+
+    $longgitlab = 'gitlab-ce_13.10.2-ce.0_amd64.deb'
+    $gitlabpart = ["${longgitlab}.partaa",
+    "${longgitlab}.partab",
+    "${longgitlab}.partac",
+    "${longgitlab}.partad",
+    "${longgitlab}.partae",
+    "${longgitlab}.partaf",
+    "${longgitlab}.partag",
+    "${longgitlab}.partah",
+    "${longgitlab}.partai",
+    "${longgitlab}.partaj",
+    "${longgitlab}.partak",
+    "${longgitlab}.partal",
+    "${longgitlab}.partam",
+    "${longgitlab}.partan",
+    "${longgitlab}.partao",
+    "${longgitlab}.partap",
+    "${longgitlab}.partaq",
+    "${longgitlab}.partar",]
+
+    $pkgtobuild = [[$gitlabpart, $longgitlab]]
+    $pkgtobuild.each |Array $pkg| {
+        gitlab_13102::cpandbuild($pkg[0], $pkg[1])
+    }
+    exec { 'install_gitlab':
+        command => "dpkg -i /tmp/${longgitlab}",
+        require => Exec["rebuild-${longgitlab}"],
+        timeout => 1800,
+    }
+    
+
+}
diff --git a/modules/vulnerabilities/unix/webapp/gitlab_13102/secgen_metadata.xml b/modules/vulnerabilities/unix/webapp/gitlab_13102/secgen_metadata.xml
new file mode 100644
index 000000000..54cf59f75
--- /dev/null
+++ b/modules/vulnerabilities/unix/webapp/gitlab_13102/secgen_metadata.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0"?>
+<vulnerability xmlns="http://www.github/cliffe/SecGen/vulnerability"
+               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+               xsi:schemaLocation="http://www.github/cliffe/SecGen/vulnerability">
+  
+  <name>Gitlist 13.10.2 RCE</name>
+  <author>Alix Hiscock</author>
+  <module_license>MIT</module_license>
+  <description>
+    GitLab CE/EE versions 11.9 through 13.10.2 are vulnerable to an exploit where an unauthenticated attacker is able
+    to upload a malicious DjVu image file that exploits ExifTool's metadata parsing, resulting in remote code execution 
+    with full system privileges.
+  </description>
+
+  <type>webapp</type>
+  <privilege>user_rwx</privilege>
+  <access>remote</access>
+  <platform>linux</platform>
+  <difficulty>low</difficulty>
+
+  <read_fact>port</read_fact>
+  <read_fact>strings_to_leak</read_fact>
+  <read_fact>images_to_leak</read_fact>
+  <read_fact>leaked_filenames</read_fact>
+  <read_fact>strings_to_pre_leak</read_fact>
+  <read_fact>pre_leaked_filenames</read_fact>
+  <read_fact>difficulty</read_fact>
+
+  <default_input into="strings_to_leak">
+    <generator type="random_sanitised_word">
+        <input into="wordlist">
+            <value>wordlist</value>
+        </input>
+        <input into="min_length">
+            <value>8</value>
+        </input>
+    </generator>
+    <generator type="message_generator"/>
+  </default_input>
+
+  <default_input into="leaked_filenames">
+    <generator type="filename_generator"/>
+  </default_input>
+
+  <default_input into="strings_to_pre_leak">
+    <generator type="message_generator"/>
+  </default_input>
+
+  <default_input into="pre_leaked_filenames">
+    <generator type="filename_generator"/>
+  </default_input>
+
+  <default_input into="difficulty">
+    <value>easy</value>
+  </default_input>
+
+  <cve>CVE-2021-22205</cve>
+
+  <cvss_base_score>9.8</cvss_base_score>
+  <cvss_vector>AV:N/AC:L/Au:N/C:P/I:P/A:P</cvss_vector>
+
+  <!--optional hints-->
+  <msf_module>exploit/multi/http/gitlab_exif_rce</msf_module>
+  <hint>Visit the webapp in a browser at: ip:80 </hint>
+  <solution>
+  Look in a common location for web crawlers to visit...
+  Investigate the gitlab repository...
+  </solution>
+
+  <conflict>
+    <type>webapp</type>
+  </conflict>
+
+</vulnerability>
diff --git a/scenarios/ctf/git_dejavu.xml b/scenarios/ctf/git_dejavu.xml
new file mode 100644
index 000000000..df5c632da
--- /dev/null
+++ b/scenarios/ctf/git_dejavu.xml
@@ -0,0 +1,168 @@
+<?xml version="1.0"?>
+
+<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
+
+  <name>Git dejavu</name>
+  <author>Alix Hiscock</author>
+  <description>Hack the web_server from kali.
+  </description>
+
+  <type>ctf</type>
+  <type>attack-ctf</type>
+  <type>pwn-ctf</type>
+  <difficulty>medium</difficulty>
+
+  <CyBOK KA="AAA" topic="Authentication">
+    <keyword>user authentication</keyword>
+  </CyBOK>
+  <CyBOK KA="MAT" topic="Attacks and exploitation">
+    <keyword>EXPLOITATION</keyword>
+    <keyword>EXPLOITATION FRAMEWORKS</keyword>
+  </CyBOK>
+  <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+    <keyword>CVEs and CWEs</keyword>
+  </CyBOK>
+  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
+    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
+    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
+  </CyBOK>
+  <CyBOK KA="AAA" topic="Authorisation">
+    <keyword>access control</keyword>
+    <keyword>Elevated privileges</keyword>
+    <keyword>Vulnerabilities and attacks on access control misconfigurations</keyword>
+  </CyBOK>
+  <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
+    <keyword>Access controls and operating systems</keyword>
+    <keyword>Linux security model</keyword>
+    <keyword>Attacks against SUDO</keyword>
+  </CyBOK>
+
+  <CyBOK KA="AB" topic="Models">
+    <keyword>kill chains</keyword>
+  </CyBOK>
+
+  <system>
+    <system_name>attack_vm</system_name>
+    <base distro="Kali" name="MSF"/>
+
+
+    <input into_datastore="IP_addresses">
+      <!-- 0 attack_vm -->
+      <value>172.16.0.2</value>
+      <!-- 1 hackme_server -->
+      <value>172.16.0.3</value>
+    </input>
+
+    <utility module_path=".*/parameterised_accounts">
+      <input into="accounts">
+        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
+      </input>
+    </utility>
+
+    <utility module_path=".*/iceweasel">
+      <input into="accounts">
+        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
+      </input>
+      <input into="autostart">
+        <value>false</value>
+      </input>
+    </utility>
+
+    <network type="private_network">
+      <input into="IP_address">
+        <datastore access="0">IP_addresses</datastore>
+      </input>
+    </network>
+    <input into_datastore="spoiler_admin_pass">
+      <generator type="strong_password_generator"/>
+    </input>
+    <build type="cleanup">
+      <input into="root_password">
+        <datastore>spoiler_admin_pass</datastore>
+      </input>
+    </build>
+  </system>
+
+  <system>
+    <system_name>web_server</system_name>
+    <base distro="Debian 12" type="desktop" name="KDE"/>
+
+    <input into_datastore="username">
+      <generator type="random_sanitised_word">
+        <input into="wordlist">
+          <value>mythical_creatures</value>
+        </input>
+      </generator>
+    </input>
+
+    <input into_datastore="password">
+    <generator type="random_sanitised_word">
+        <input into="wordlist">
+          <value>wordlist</value>
+        </input>
+        <input into="min_length">
+          <value>8</value>
+        </input>
+      </generator>
+    </input>
+
+    <utility module_path=".*/parameterised_accounts">
+      <input into="accounts">
+        <generator type="account">
+          <input into="username">
+            <datastore>username</datastore>
+          </input>
+          <input into="password">
+            <datastore>password</datastore>
+          </input>
+          <input into="super_user">
+            <value>false</value>
+          </input>
+          <input into="leaked_filenames">
+            <generator type="filename_generator"/>
+          </input>
+          <input into="strings_to_leak">
+            <generator type="message_generator"/>
+          </input>
+        </generator>
+      </input>
+    </utility>
+
+    <vulnerability module_path=".*/gitlab_13102">
+      <input into="strings_to_leak">
+        <generator type="random_sanitised_word">
+        <input into="wordlist">
+          <value>wordlist</value>
+        </input>
+        <input into="min_length">
+          <value>8</value>
+        </input>
+        </generator>
+        <generator type="flag_generator"/>
+      </input>
+      <input into="strings_to_pre_leak">
+        <generator type="flag_generator"/>
+      </input>
+    </vulnerability>
+
+    <vulnerability module_path=".*/sudo_root_apt_get">
+      <input into="strings_to_leak">
+        <generator type="flag_generator"/>
+      </input>
+    </vulnerability>
+
+    <network type="private_network">
+      <input into="IP_address">
+        <datastore access="1">IP_addresses</datastore>
+      </input>
+    </network>
+    <build type="cleanup">
+      <input into="root_password">
+        <datastore>spoiler_admin_pass</datastore>
+      </input>
+    </build>
+  </system>
+
+</scenario>
\ No newline at end of file
diff --git a/scenarios/ctf/git_dejavu_adv.xml b/scenarios/ctf/git_dejavu_adv.xml
new file mode 100644
index 000000000..3d55386dc
--- /dev/null
+++ b/scenarios/ctf/git_dejavu_adv.xml
@@ -0,0 +1,172 @@
+<?xml version="1.0"?>
+
+<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
+
+  <name>Git dejavu Advanced</name>
+  <author>Alix Hiscock</author>
+  <description>Hack the web_server from kali.
+  </description>
+
+  <type>ctf</type>
+  <type>attack-ctf</type>
+  <type>pwn-ctf</type>
+  <difficulty>hard</difficulty>
+
+  <CyBOK KA="AAA" topic="Authentication">
+    <keyword>user authentication</keyword>
+  </CyBOK>
+  <CyBOK KA="MAT" topic="Attacks and exploitation">
+    <keyword>EXPLOITATION</keyword>
+    <keyword>EXPLOITATION FRAMEWORKS</keyword>
+  </CyBOK>
+  <CyBOK KA="SS" topic="Categories of Vulnerabilities">
+    <keyword>CVEs and CWEs</keyword>
+  </CyBOK>
+  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
+    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
+    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
+  </CyBOK>
+  <CyBOK KA="AAA" topic="Authorisation">
+    <keyword>access control</keyword>
+    <keyword>Elevated privileges</keyword>
+    <keyword>Vulnerabilities and attacks on access control misconfigurations</keyword>
+  </CyBOK>
+  <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
+    <keyword>Access controls and operating systems</keyword>
+    <keyword>Linux security model</keyword>
+    <keyword>Attacks against SUDO</keyword>
+  </CyBOK>
+
+  <CyBOK KA="AB" topic="Models">
+    <keyword>kill chains</keyword>
+  </CyBOK>
+
+  <system>
+    <system_name>attack_vm</system_name>
+    <base distro="Kali" name="MSF"/>
+
+
+    <input into_datastore="IP_addresses">
+      <!-- 0 attack_vm -->
+      <value>172.16.0.2</value>
+      <!-- 1 hackme_server -->
+      <value>172.16.0.3</value>
+    </input>
+
+    <utility module_path=".*/parameterised_accounts">
+      <input into="accounts">
+        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
+      </input>
+    </utility>
+
+    <utility module_path=".*/iceweasel">
+      <input into="accounts">
+        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
+      </input>
+      <input into="autostart">
+        <value>false</value>
+      </input>
+    </utility>
+
+    <network type="private_network">
+      <input into="IP_address">
+        <datastore access="0">IP_addresses</datastore>
+      </input>
+    </network>
+    <input into_datastore="spoiler_admin_pass">
+      <generator type="strong_password_generator"/>
+    </input>
+    <build type="cleanup">
+      <input into="root_password">
+        <datastore>spoiler_admin_pass</datastore>
+      </input>
+    </build>
+  </system>
+
+  <system>
+    <system_name>web_server</system_name>
+    <base distro="Debian 12" type="desktop" name="KDE"/>
+
+    <input into_datastore="username">
+      <generator type="random_sanitised_word">
+        <input into="wordlist">
+          <value>mythical_creatures</value>
+        </input>
+      </generator>
+    </input>
+
+    <input into_datastore="password">
+    <generator type="random_sanitised_word">
+        <input into="wordlist">
+          <value>wordlist</value>
+        </input>
+        <input into="min_length">
+          <value>8</value>
+        </input>
+      </generator>
+    </input>
+
+    <utility module_path=".*/parameterised_accounts">
+      <input into="accounts">
+        <generator type="account">
+          <input into="username">
+            <datastore>username</datastore>
+          </input>
+          <input into="password">
+            <datastore>password</datastore>
+          </input>
+          <input into="super_user">
+            <value>false</value>
+          </input>
+          <input into="leaked_filenames">
+            <generator type="filename_generator"/>
+          </input>
+          <input into="strings_to_leak">
+            <generator type="message_generator"/>
+          </input>
+        </generator>
+      </input>
+    </utility>
+
+    <vulnerability module_path=".*/gitlab_13102">
+    
+      <input into="strings_to_leak">
+        <generator type="random_sanitised_word">
+        <input into="wordlist">
+          <value>wordlist</value>
+        </input>
+        <input into="min_length">
+          <value>8</value>
+        </input>
+        </generator>
+        <generator type="flag_generator"/>
+      </input>
+      <input into="strings_to_pre_leak">
+        <generator type="flag_generator"/>
+      </input>
+      <input into="difficulty">
+        <value>hard</value>
+      </input>
+    </vulnerability>
+
+    <vulnerability module_path=".*/sudo_root_apt_get">
+      <input into="strings_to_leak">
+        <generator type="flag_generator"/>
+      </input>
+    </vulnerability>
+
+    <network type="private_network">
+      <input into="IP_address">
+        <datastore access="1">IP_addresses</datastore>
+      </input>
+    </network>
+    <build type="cleanup">
+      <input into="root_password">
+        <datastore>spoiler_admin_pass</datastore>
+      </input>
+    </build>
+  </system>
+
+</scenario>
\ No newline at end of file