UPDATE OWASP Zed Attack Proxy(ZAP) v 2.0.0 - an easy-to-use integrated penetration testing tool for finding vulnerabilities in Web applications

OWASP Zed Attack Proxy (ZAP) is an easy-to-use integrated penetration testing tool for finding vulnerabilities in Web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen tester's toolbox. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
Some of ZAP's features:

• Intercepting Proxy
• Active scanner
• Passive scanner
• Brute Force scanner
• Spider
• Fuzzer
• Port Scanner
• Dynamic SSL certificates
• API
• Beanshell integration

Some of ZAP's characteristics:

• Easy to install (just requires java 1.7)
• Ease of use a priority
• Comprehensive help pages
• Fully Internationalized
• Under active development
• Open source
• Free (no paid for 'Pro' version)
• Cross platform
• Involvement actively encouraged

It supports the following languages:

• English
• Brazilian Portuguese
• Chinese
• Danish
• Filipino
• French
• German
• Greek
• Indonesian
• Italian
• Japanese
• Persian
• Polish
• Russian
• Spanish

Download version 2.0.0 from here
ZAP_2.0.0_Windows.exe
ZAP_2.0.0_Linux.tar.gz
ZAP_2.0.0_Mac_OS_X.zip

OWASP Zed Attack Proxy v 2.0.0 released on 30-Jan-2013

There is a new version of the OWASP Zed Attack Proxy (ZAP) available right now, and there are so many changes in it that we’ve decided to call it version 2.0.0.

If you just want to get stuck in and download it then head over to http://code.google.com/p/zaproxy/downloads/list : it's available for Windows, Linux and Mac OS. 

(Note that the Mac OS specific release is coming soon, but the Linux release is actually cross platform and will work fine on Macs)

And if you want to learn a bit more about the changes then read on...

We can only cover the new features at a high level in one blog post, but the plan is to host a Google hangout demonstrating many of these features at 17:00 UTC on Friday 8th Feb. Details to be announced via https://twitter.com/zaproxy 

Simon will also be presenting a talk at FOSDEM on Feb 2nd: Practical Security for developers, using OWASP ZAP

New features

An integrated add-ons marketplace

ZAP can be extended by add-ons that have full access to all of the ZAP internals. Anyone can write add-ons and upload them to the ZAP Add-on Marketplace (OK, so its a Google code project called zap-extensions, but you get the idea).

More importantly you can now browse, download and install those add-ons from within ZAP. Most add-ons can be dynamically installed (and uninstalled) so you wont even need a restart.

You can choose to be notified of updates, and even be automatically updated. And as the scan rules are now implemented as add-ons you can get the latest rules as soon as they are published.

A replacement for the 'standard' Spider

The ‘old’ Spider was showing its age, so its been completely rewritten, and is much faster and more comprehensive than the old one. This is still a 'traditional' spider that analyses the HTML code for any links it can find.

A new 'Ajax' spider

In addition to the 'traditional' spider we've added an Ajax spider which is more effective with applications that make heavy use of JavaScript. This uses the Crawljax project which drives a browser (using Selenium) and so can discover any links an application generates, even ones generated client side.

Web Socket support

ZAP now supports WebSockets, so ZAP can now see all WebSocket messages sent to and from your browser. As with HTTP based messages, ZAP can also intercept WebSocket messages and allows you to change them on the fly.

You can also fuzz WebSockets messages as well using all of the fuzzing payloads included in ZAP from projects like JBroFuzz and fuzzdb. And of course you can easily add your own fuzzing files.

Quick Start tab

The first main tab you will now see is a ‘Quick Start’ tab which allows you to just type in a URL and scan it with one click.

This is an ideal starting point for people new to application security, but experts can easily remove it if they find it distracting.

Session awareness

ZAP is now session aware, so it can recognise and keep track of multiple sessions. It allows you to create new sessions, switch between them, and applies to all of the other components, like the Spider and Active Scanner.

User defined Contexts

You can now define any number of ‘contexts’ - related sets of URLs which make up an application. You can then target all URLs in a context, for example using the Spider or Active Scanner. You can also add the contexts to the scope, and associate other information, such as authentication details.

Session scope

The session scope allows you to specify which contexts you are interested at any one time. You can restrict what you see in various tabs to just the URLs in scope, and prevent accidentally attacking URLs not in scope by using the Protected mode.

Different modes

ZAP now supports 3 modes:

• Safe, in which no potentially dangerous operations permitted
• Protected, in which you can perform any actions on URLs in scope
• Standard, in which you can do anything to any URLs

A scripting console

This allows you to access any internal ZAP data structures dynamically using any scripting language that supports JSR 223,

Authentication handling

You can now associate authentication details with any context, which allows ZAP to do things like detect if and when you are logged out and automatically log you back in again. This is especially useful when used via the API in security regression tests.

More API support

The REST API has been significantly extended, giving you much more access to the functionality ZAP provides.

Fine grained scanning controls

The active scan rules can now be tuned to adjust their strength (the number of attacks they perform) and the threshold at which they report potential issues.

New and improved active and passive scanning rules

We have uploaded the results from running ZAP 2.0.0 against wavsep (the most comprehensive open source evaluation project we are aware of) to the ZAP wiki: http://code.google.com/p/zaproxy/wiki/TestingWavsep

Many stability and usability fixes

Source-

http://owasp.blogspot.in/2013/01/owasp-zed-attack-proxy-v-200.html

For more information -
http://code.google.com/p/zaproxy/
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

Web Application Exploiter (WAppEx) 2.0

WAppEx is an integrated Web Application security assessment and exploitation platform designed with the whole spectrum of security professionals to web application hobbyists in mind. It suggests a security assessment model which revolves around an extensible exploit database. Further, it complements the power with various tools required to perform all stages of a web application attack.

The Exploit Database contains the all the logic associated with trivial fingerprinting, exploitation techniques, and payloads that address a wide range of web application vulnerabilities with the emphasis being on high-risk and zero-day vulnerabilities.

Some of the vulnerabilities already bundled within the Exploit Database include Local File Disclosure (LFD), Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL Injection (SQLI), Remote OS Command Execution (RCE), and Server-side Code Injection (SCI). WAppEx can detect these vulnerabilities in a target, take full advantage of it, and through neatly designed payload codes get as much access to the exploited target as possible in as short a time as possible. Some of the payloads included within the database are various reverse shells, arbitrary code execution, command execution, arbitrary file upload…

Since all the attack logic rests in the form of scripts within the Exploit Database, it is easily extensible, flexible and updatable through community servers. Users, too, can add mature, sophisticated exploits and payloads in the same fashion. The database grows on a daily basis, and our dedicated team of research and development are working non-stop to maintain the richest, most up-to-date aggregate of exploits. The number of exploits is soon bound to surpass hundreds. Meanwhile, users can share their own created exploits and payloads with the community and contribute to this growing momentum.

The scripting language used to create new exploits and payloads is JavaScript with the addition of a few accessory objects and functions that automate daily penetration testing tasks and help integrate the script with the database. Using this feature, you can easily create and execute an exploit based on a newly discovered vulnerability.

WAppEx is also equipped with a penetration testing toolbox that makes an effective synergy with the Exploit Database and a crafty security expert. The provided tools include Manual Request, Exploit Editor, Dork Finder, Hidden File Checker… More tools, such as a crawler, a multi-purpose fuzzer… are to be added to the arsenal in the future releases of WAppEx.

Still, keep your eyes peeled as this is just the beginning of a new, powerful war machine in the pentest battleground.

The full list features is as below:
An exploit database covering a wide range of vulnerabilities.
A set of tools useful for penetration testing:
Manual Request
Dork Finder
Exploit Editor
Hidden File Checker
Neighbor Site Finder
Find Login Page
Online Hash Cracker
Encoder/Decoder
Execute multiple instances of one or more exploits simultaneously.
Execute multiple instances of one or more payloads (for every running exploit) simultaneously.
Test a list of target URL’s against a number of selected exploits.
Allows you to create your own exploits and payloads and share them online.
A number of featured exploits (6) and payloads (39) bundled within the software exploit database:
Testing and exploiting of Local File Inclusion vulnerabilities
Testing and exploiting of Local File Disclosure vulnerabilities
Testing and exploiting of Remote File Inclusion vulnerabilities
Testing and exploiting of SQL Injection vulnerabilities
Testing and exploiting of Remote Command Execution Inclusion vulnerabilities
Testing and exploiting of Server-side Code Injection vulnerabilities

WAppEx 2.0, like its predecessor, has only been released a free trial. Click the download links below to download WAppEx 2.0, ITSecTeam End-User License Agreement, and the registration license file.

NOTICE: BY CLICKING ON ANY OF THE DOWNLOAD LINKS BELOW YOU ADMIT THAT YOU HAVE READ AND ACCEPT ITSECTEAM END USER LISENCE AGREEMENT.

Download WAppEx End-User License Agreement
Download WAppEx 2.0
Download License File

Enter ITSecTeam as the license name during registration.

Change log of version 2.0

Source-

http://itsecteam.com/products/web-application-exploiter-wappex/

httest 2.2.13 - script based tool for testing and benchmarking web applications

httest is a script based tool for testing and benchmarking web applications, web servers, proxy servers and web browsers. httest can emulate clients and servers in the same test script, very useful for testing proxys.

The httest provides a large variety of HTTP-related functionality, useful for implementing all kinds of HTTP-based tests. Licenced under the Apache License Version 2.0.

Features

• HTTP server client simulation
• SSL support
• IPv6 support
• Request/response validation
• Cut and paste from request/response
• Execute shell commands and use output in HTTP stream
• Lua scripting engine
• Javascript engine
• Full ICAP support
• Websocket support
• XPath support
• NTLM authentication tool
• SOCKS support
• Simple SMTP support
• Simple POP3 support
• Distributed load test support

New httest 2.2.13 released on 25. January 2013 available. Recommended stable version.
With Lua, websocket, debugging, javascript, XPath, SSL tracing and load testing support.

Download httest-2.2.13-win.zip (3.4 MB)  updated on 26-Jan-2013

Download other versions from here

Components

• httest - main programm
• htproxy - generate httest scripts
• htntlm - enable ntlm in your httest scripts
• hturlext - extracts url from html (GNU General Public License 2.0)
• htremote - enable interactive scripts in your httest scripts

Use Cases

• UseCaseErrorReporting
• UseCaseFeatureSpezification
• UseCaseProxyServerTesting
• UseCaseWebAppTesting
• UseCaseWebBrowserTesting
• UseCaseWebServerTesting
• UseCaseWebServiceIntegrationTesting
• UseCaseWebServiceMonitoring
• UseCaseWebServiceStressing

Source-

http://sourceforge.net/projects/htt/

http://htt.sourceforge.net/cgi-bin/cwiki/bin/public

skipfish 2.10b - web application security scanner

Skipfish is an active web application security reconnaissance tool. It prepares aninteractive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

Key features:

• High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint - easily achieving 2000 requests per second with responsive targets.

• Ease of use: heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion.

• Cutting-edge security logic: high quality, low false positive, differential security checks, capable of spotting a range of subtle flaws, including blind injection vectors.

The tool is believed to support Linux, FreeBSD, MacOS X, and Windows (Cygwin) environments.

lastest update -

Download 2.10b

Skipfish version 2.10b with configuration file support, enhanced signatures and improved traversal tests.

Change log Version 2.10b:
  - Updated HTML tags and attributes that are checked for URL XSS
    injections to also include a few HTML5 specific ones

  - Updated test and description for semi-colon injection in HTML meta
    refresh tags (this is IE6 specific)

  - Relaxed HTML parsing a bit to allow spaces between HTML tag attributes
    and their values (e.g. "foo =bar").

  - Major update of LFI tests by adding more dynamic tests (double
    encoding, dynamic amount of ../'s for web.xml). The total amount of
    tests for this vulnerability is now 40 per injection point.

  - The RFI test is now a separate test and no longer requires special
    compile options. The default RFI URL and it's payload check are
    still defined in src/config.h.

  - Using the --flush-to-disk flag will cause requests and responses
    to be flushed to disk which reduces the memory footprint. (especially
    noticable in large scans)

  - Fixed a bug where in some conditions (e.g. a page looks similar to
    another) links were not scraped from responses which lead to links
    to be missed (thanks to Anurag Chaurasia for reporting)

  - Added configuration file support with the --config flag. In
    config/example.conf you can find flags and examples.

  - Several signature keyword enhancements have been made. Most
    significant are the "header" keyword, which allows header matching
    and the "depend" keyword which allows signature chaining.

  - Fixed basic authentication which was broken per 2.08b. Cheers to
    Michael Stevens for reporting.

  - Fixed -k scheduling where 1:0:0 would count as a second in stead of
    an hour (also visa versa). Cheers to Claudio Criscione for reporting.

  - Small fix to compile time warnings

Quick links

Download 2.10b (changelog)
How to run the scanner! (old)
View a sample screenshot


Documentation

Detailed documentation
Content signatures (updated)
Authenticated scans (updated)


Getting help

Known problems / workarounds
File a bug in the tracker

Source -

http://code.google.com/p/skipfish/

For more information -

https://www.owasp.org/index.php/Automated_Audit_using_SKIPFISH

Burp Suite v1.5rc2 released

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.

Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun.

Burp Suite contains the following key components:

• An intercepting proxy, which lets you inspect and modify traffic between your browser and the target application.
• An application-aware spider, for crawling content and functionality.
• An advanced web application scanner, for automating the detection of numerous types of vulnerability.
• An intruder tool, for performing powerful customized attacks to find and exploit unusual vulnerabilities.
• A repeater tool, for manipulating and resending individual requests.
• A sequencer tool, for testing the randomness of session tokens.
• The ability to save your work and resume working later.
• Extensibility, allowing you to easily write your own plugins, to perform complex and highly customized tasks within Burp.

Burp is easy to use and intuitive, allowing new users to begin working right away. Burp is also highly configurable, and contains numerous powerful features to assist the most experienced testers with their work.

Burp Suite v1.5rc2 released Friday, October 5, 2012

This release fixes a number of minor bugs.
The Burp Repeater UI has been modified to conserve screen space. The previous fields for host / port / protocol have been removed, since these details are automatically populated when a request is sent to Repeater, and typically do not need to be modified. The details of the target server for the current request are still displayed, and you can change these details by clicking on the target server label, to open a dialog.

Burp's memory handling has been further refined, particularly when actively scanning, to reduce the overall memory footprint and improve Burp's resilience in low memory conditions.
MD5: 913317eaee1a19eac9df47c23f08b179
SHA256: 4f119e3c841fa62c6fff4bbe03c424ffa581838222f567852ad8f4acaf623012

Download from here

Source -

http://portswigger.net/http://releases.portswigger.net/2012/10/v15rc2.html

Update HTTP Anti Flood/DoS Security Module V1.8.2 -Detect Flooder IPs, Reduce Attack Surface against HTTP Flood Attacks

CHANGES v.1.8.1 - v.1.8.2
- Improved Implicit Deny for Banned IP Addresses (Deny without detection)
- Minor Performance Tweaks

CHANGES v.1.8.2
- Improved Implicit Deny Mode for Banned IP(s) (without detection)
- Iptables Auto Ban Bash Script Included
- Request Cache Size Option
- Connection Limit Support
- Whitelist Support
- Reverse Proxy Support
- reCAPTCHA Support

You can use IOSEC under .NET see. http://phalanger.codeplex.com/

This module provides security enhancements against (HTTP) Flood & Brute Force Attacks for native PHP or .NET scripts at web application level. Massive crawling/scanning tools, HTTP flood tools can be detected and blocked by this module via htaccess or iptables, etc.
You can use this module by including "iosec.php" to any PHP file which wants to be protected.

You can test module here: http://www.iosec.org/test.php (demo)

Wordpress Plugin http://wordpress.org/extend/plugins/iosec-anti-flood-security-gateway-module

Features :
This is a unique project and it is the world's first web application flood guard script.
At web application (scripting) level you can,
- Block proxies. (only via HTTP header)
- Detect flooding IP addresses.
- Slow down or restrict access for automated tools (HTTP flood, brute force tools, vulnerability scanners, etc.)
- Save your server resources (database, cpu, ram, etc.) under an attack.
- Restrict access permanently or temporarily for listed IP addresses in "banlist" file.
- Notify yourself via email alerts when attacks begin.
- Implicit deny for DDoS attacks

Download : iosec.http.anti.flood.v.1.8.2_with_iptables_bash_script.zip (201.5 kB)
Wordpress Plug-in : iosec.http.anti.flood.current.version_wordpress_plugin.zip (44.6 kB)
Download Other Version from here
Read more in here : http://www.iosec.org/test.php

Source -

http://sourceforge.net/projects/iosec/

Previous posts regarding IOSEC -

http://santoshdudhade.blogspot.in/2012/09/http-anti-flooddos-security-module-v181.html

http://santoshdudhade.blogspot.in/2012/09/http-anti-flooddos-security-module-v17.html

http://santoshdudhade.blogspot.in/2012/07/http-anti-flooddos-security-module.html

Web-Sorrow v1.4.7B - a versatile security scanner for the information disclosure phase of pentesting . written in perl

A perl based tool used for checking a Web server for misconfiguration, version detection, enumeration, and server information. I will build more Functionality in the future. what is's NOT: Vulnerably scanner, inspection proxy, DDoS tool, exploitation framework. It's entirely focused on Enumeration and collecting Info on the target server

CURRENT functionality:

-S - stands for standard. a set of Standard tests and includes: indexing of directories testing, banner grabbing, language detection (should be obvious), robots.txt, 200 response testing (some servers send a 200 ok for every req), and thumbs.db scanning

-auth - looks for login pages with a list of some of the most common login files and dirs and admin consoles. don't need to be very big list of URLs because what else are going to name it? notAlogin.php???

-Cp - scan with a huge list of plugins dirs. the list is a bit old (Drupal and wordpress plugins databases are now current but sorry joomla's still a bit old)

-I - searches the responses for interesting strings

-Ws - looks for web services such as hosting provider, blogging services, favicon fingerprinting, and cms version info

-Fd - look for generally things people don't want you to see. The list is generated form a TON of robot.txt so whatever it finds should be interesting.

-ninja - A light weight and undetectable scan that uses bits and peaces from other scans

-R - use http range headers to make scans faster

-Shadow - Use Google cache instead of requesting from the target host

-Sd - Bruteforce Sub Domains

-Db - Bruteforce Directories with the big dirbuster Database

-Df - Scan for Apache default files

-d - Only Scan with this Directory

-np - don't do passive testes (less verbose)

-ua - use a custom UserAgent. PUT UA IN QUOTES if there's spaces

-proxy - send all http reqs via a proxy. example: 255.255.255.254:8080

-e - run all the scans in the tool

web-sorrow also has false positives checking on most of it's requests (it pretty accurate but not perfect) 

EXAMPLES:

basic: perl Wsorrow.pl -host scanme.nmap.org -S

stealthy: perl Wsorrow.pl -host scanme.nmap.org -ninja -proxy 190.145.74.10:3128

scan for login pages: perl Wsorrow.pl -host 192.168.1.1 -auth

CMS intense scan: perl Wsorrow.pl -host 192.168.1.1 -Ws -Cp all -I

most intense scan possible: perl Wsorrow.pl -host 192.168.1.1 -e

dump http headers: perl headerDump.pl

Check if host is alive: perl hdt.pl -host 192.168.1.1

CHANGES v1.4.7B: -
fixed 2 bugs and minor changes (FYI: the "B" does not mean it's in beta)

Download latest Version : 

Web-Sorrow_1.4.7B.zip

Web-Sorrow_v1.4.6.zip

Web-Sorrow_v1.4.5.zip
read more in here : http://code.google.com/p/web-sorrow/

you need to install perl for running web-sorrow on linux.
If you are running on windows machine then
Download Perl from
http://strawberryperl.com/

our previous post on web sorrow-
http://santoshdudhade.blogspot.in/2012/06/web-sorrow-v-138-remote-security.html
http://santoshdudhade.blogspot.in/2012/06/update-web-sorrow-v-139-remote-web.html
http://santoshdudhade.blogspot.in/2012/05/web-sorrow-remote-web-scanner-for.html
http://santoshdudhade.blogspot.in/2012/06/web-sorrow-v140-remote-security-scanner.html

http://santoshdudhade.blogspot.in/2012/06/web-sorrow-v141-remote-security-scanner.html
http://santoshdudhade.blogspot.com/2012/07/web-sorrow-v142-remote-security-scanner.html

Source -
http://code.google.com/p/web-sorrow/
Snapshot -

NOWASP (Mutillidae) V2.3.7 - Web Pen-Test Practice Application

NOWASP (Mutillidae) is a free, open source web application provided to allow security enthusiest to pen-test a web application. NOWASP (Mutillidae) can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to administrate a webserver. It is already installed on Samurai WTF and Rapid7 Metasploitable-2. The existing version can be updated on either. NOWASP (Mutillidae) contains dozens of vulns and hints to help the user; providing an easy-to-use web hacking environment deliberately designed to be used as a lab for security enthusiast, classrooms, labs, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, in corporate web sec training courses, and as an "assess the assessor" target for vulnerability assessment software.

NOWASP (Mutillidae) has been tested/attacked with Cenzic Hailstorm ARC, W3AF, SQLMAP, Samurai WTF, Backtrack, HP Web Inspect, Burp-Suite, NetSparker Community Edition, and other

Features :

1. Mutillidae can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to install or administrate their own webserver.
2. Installs easily by dropping project files into the "htdocs" folder of XAMPP.
3. Preinstalled on Rapid7 Metasploitable 2
4. Preinstalled on Samurai Web Testing Framework (WTF)
5. Has dozen of vulnerablities and challenges. Contains at least one vulnearbility for each of the OWASP Top Ten 2007 and 2010
6. System can be restored to default with single-click of "Setup" button
7. Switches between secure and insecure mode
8. Secure and insecure source code for each page stored in the same PHP file for easy comparison
9. Used in graduate security courses, in corporate web sec training courses, and as an "assess the assessor" target for vulnerability software
10. Contains 2 levels of hints to help users get started
11. Instructional Videos: http://www.youtube.com/user/webpwnized
12. Updates tweeted to @webpwnized
13. Mutillidae has been tested/attacked with Cenzic Hailstorm ARC, W3AF, SQLMAP, Samurai WTF, Backtrack, HP Web Inspect, Burp-Suite, NetSparker Community Edition, and other tools

Change Log for NOWASP 2.3.7 (Samurai 2.0 Version):

• Improved detection of incorrect database settings on the set-up-database script.
• Added code to make it easier to install on Samurai WTF. The MySQLHandler->openConnection() method will automatically try the password "samurai" if the configured password fails.
• Created installation video for updating NOWASP Mutillidae on Samurai WTF 2.0 on the webpwnized YouTube Channel.
• Cleaned up code in MySQLHandler.php
• Added code to set up database page to detect if user fixed errors. If the user came from the database error page but we do not have database errors anymore, send them to the home page.
• Changed font on the database error page
• Imporved error handling for database errors in index.php

Download : 

LATEST-mutillidae-2.3.7.zip (7.2 MB)
Find Other Version |
For more Information pls visit :-

 http://www.irongeek.com

For more information -

http://sourceforge.net/projects/mutillidae/
http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10

Downloads

• All Versions

Announcements

• Twitter @webpwnized

Quickstart Installation Video

• Quickstart Guide To Installing On Windows With Xampp

Documentation

• Documentation
• Change Log
• Mutillidae YouTube Channel
• Installation Options
• Windows 7 Installation Instructions PDF
• Vulnerabilities
• How to Access Mutillidae Over Virtual Box Network
• Tips on PHP "Strict" errors

Usage Instructions

Mutillidae contains all of the vulnerabilties from the OWASP Top 10.

Go to the OWASP Top 10 page to read about a vulnerability, then choose it from the list on the left to try it out. Hints may help.

Mutillidae currently has two modes: secure and insecure (default). In insecure mode, the project works like Mutillidae 1.0. Pages are vulnerable to at least the topic they fall under in the menu. Most pages are vulnerable to much more. In secure mode, Mutillidae attempts to protect the pages with server side scripts. Also, hints are disabled in secure mode. In the interest of making as many challenges as possible, this can be defeated.

In Mutillidae 2.0, the code has been commented to allow the user to see how the defense works. To get the most out of the project, avoid reading the source code until after learning how to exploit it. But if you get stuck, the comments should help. Learning how the attack works should help to understand the defense.

Get rid of PHP "Strict" Errors

Please see documentation at the Sourceforge documentation page. Please note help file "tips-on-php-strict-errors.txt" concerning PHP strict errors.

Notes

• Created by Irongeek.com.
• If you would like to learn about other deliberately vulnerable web applications, check out Deliberately Insecure Web Applications For Learning Web App Security.
• If you would like to help in writing the hints sections, please email. Your name and a link to your site will be added to the credits page.
• Do NOT  run this code on a production network. Either run it on a private network, or restrict your web server software to only use the local loopback address. By default Mutillidae only allows access from localhost (127.*.*.*). Edit the .htaccess file to change this behavior (not recommended on a public network). If for some reason .htaccess is not parsed you can restrict the IP by finding the "Listen" line in the http.conf file and changing it to read: Listen 127.0.0.1:80

Screenshot -