If you are setting up a penetration testing lab you might was some insecure web applications for learning web application security. Irongeek has a great list that he is keeping up to date. I have copied a few of them into this post. Don’t forget to visit Irongeek for more information.
BadStore
Link: http://www.badstore.net/
Platform: Perl, Apache and MySQL
Install: Meant to run by booting a Live CD, but I’d recommend using my Live CD VMX
Notes: Easy to set up, and it’s nice that you can run it from a VM with a little work. Just make sure you set the VM to use the IP addresses that are only available from the local host OS (NAT or Host-only).
Damn Vulnerable Web App
Link: http://www.ethicalhack3r.co.uk/damn-vulnerable-web-app/
Platform: PHP, Apache and MySQL
Install: Should work on any box you can install Apache/PHP/MySQL on.
Notes: When I first posted Mutillidae, Ryan Dewhurst emailed me and told be about a project he started a few months before mine. His is also PHP/MySQL based, and looks prettier than mine. :) I’ve yet to play with it much, but I may be using some of his code in the near future to expand Mutillidae.
Hacme Series from Foundstone
Foundstone has put out a whole series of venerable web applications you can learn from and test your skills against. Some are harder to install than others since a few are quite old by web standards and the installers require outdated MSSQL services that don’t work the same way as the more up-to-date ones. Still, with a little work you should be able to get them installed on a modern system. I can’t guarantee all of them are designed to only listen to the local loopback, so if you decide to run them on a production network I highly recommend you use a VM set to use the IP addresses that are only available from the local host OS (NAT or Host-only). One of the great things about the Hackme series is the diverse programming platforms they are written in. As I said in the intro paragraph, most web development platforms have similar common vulnerabilities, but it’s nice to know what to look out for on your specific environment. Most of them I have limited install note on, but I’m working on testing them out.
Hacme Travel
Link: http://www.foundstone.com/us/resources/proddesc/hacmetravel.htm
Platform: Windows XP, MSDE 2000 Release A, Microsoft .NET Framework v1.1, C++
Install:
Notes:
Hacme Bank
Link: http://www.foundstone.com/us/resources/proddesc/hacmebank.htm
Platform: Windows, IIS, .Net 1.1
Install:
Notes:
Hacme Shipping
Link: http://www.foundstone.com/us/resources/proddesc/hacmeshipping.htm
Platform: Windows XP, Microsoft IIS, Adobe ColdFusion MX Server 7.0 for Windows, MySQL (4.x or 5.x with strict mode disabled)
Install:
Notes:
Hacme Casino
Link: http://www.foundstone.com/us/resources/proddesc/hacmecasino.htm
Platform: Ruby on Rails
Install: Installer that sets up a built in WEBrick server
Notes:
Hacme Books
Link: http://www.foundstone.com/us/resources/proddesc/hacmebooks.htm
Platform: J2EE application, Java Development Kit
Install:
Notes:
Foundstone also hosts video solutions for Hacme Travel v1.0 and Hacme Bank v2.0.
Mutillidae
Link: http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10
Platform: PHP, Apache and MySQL
Install: Should work on any box you can install Apache/PHP/MySQL on. I have personally tested it in XAMPP under Windows and Linux.
Notes: Mutillidae is my personal project to implement the OWASP Top 10 Vulnerabilities. It’s designed to be easy to follow and geared towards a classroom environment. Think of it as a noob’s WebGoat.
Stanford SecuriBench
Link: http://suif.stanford.edu/~livshits/securibench/
Platform: J2EE application, Java Development Kit
Install: Looks like it’s another “by hand” install.
Notes: Includes a bunch of venerable J2EE web apps, such as: jboard 0.30, blueblog 1.0, webgoat 0.9, blojsom 1.9.6, personalblog 1.2.6, snipsnap 1.0-BETA-1, road2hibernate 2.1.4, pebble 1.6-beta1 and roller 0.9.9 .
WebGoat
Link: http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
Platform: J2EE web application
Install: Self contained Tomcat server you can run from a directory under Windows or Linux
Notes: Love the fact it’s so self contained and easy to run. By default it only listens on the loopback address, so you can run it from your workstation a production network with little worries.
WebMaven (AKA: Buggy Bank)
Link: http://www.mavensecurity.com/WebMaven.php
Platform: Perl CGI scripts
Install: You have to install this on a box with a web server and Perl CGI support. The creators recommend Xitami for the sake of ease. Makes sure that you don’t put the server on a production network.
Notes: I’ve not played with this one much. The website for WebMaven says it was the basis for WebGoat v1.
Other Resources
The Heorot forum also has a collection of Live CDs you can use as targets in learning pen-testing. They are not necessarily web app focused, but they may still be useful to you.
