diff --git a/elasticsearch/exposedui/README.md b/elasticsearch/exposedui/README.md
new file mode 100644
index 00000000..5040cc7f
--- /dev/null
+++ b/elasticsearch/exposedui/README.md
@@ -0,0 +1,9 @@
+# Elasticsearch Exposed UI Testbed
+
+## Docker Compose
+```
+docker compose up
+```
+Vulnerable service will be at http://localhost:8081/
+Safe service will be at http://localhost:8082/
+
diff --git a/elasticsearch/exposedui/docker-compose.yml b/elasticsearch/exposedui/docker-compose.yml
new file mode 100644
index 00000000..db64b5ca
--- /dev/null
+++ b/elasticsearch/exposedui/docker-compose.yml
@@ -0,0 +1,31 @@
+services:
+  elasticsearch-vuln:
+    container_name: elasticsearch-vuln
+    environment:
+      - cluster.name=vuln-cluster
+      - node.name=vuln-node
+      - network.host=0.0.0.0
+      - xpack.security.enabled=false
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms512m -Xmx512m
+    image: elasticsearch:9.3.4
+    networks:
+      - vuln
+    ports:
+      - 8081:9200
+  elasticsearch-safe:
+    container_name: elasticsearch-safe
+    environment:
+      - cluster.name=safe-cluster
+      - node.name=safe-node
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms512m -Xmx512m
+    image: elasticsearch:9.3.4
+    networks:
+      - safe
+    ports:
+      - 8082:9200
+
+networks:
+  safe:
+  vuln:
\ No newline at end of file