https://elvis.hcw.ac.at/wiki/api.php?action=feedcontributions&feedformat=atom&user=FMayerhofer 2026-09-10T19:42:45Z User contributions MediaWiki 1.41.5 https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10901 2023-01-08T12:26:24Z

<p>FMayerhofer: /* Cross-Site-Request Forgery */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == A1 SQL Injection Example ==<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:===<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:===<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> == A5 Cross-Site-Request Forgery Example ==<br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10900 2023-01-08T12:26:11Z

<p>FMayerhofer: /* Step 2: */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == A1 SQL Injection Example ==<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:===<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:===<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> == Cross-Site-Request Forgery ==<br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10899 2023-01-08T12:25:40Z

<p>FMayerhofer: /* A1 SQL Injection Example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == A1 SQL Injection Example ==<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:===<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:===<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10898 2023-01-08T12:25:35Z

<p>FMayerhofer: /* Step 1: */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === A1 SQL Injection Example ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:===<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:===<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10897 2023-01-08T12:25:27Z

<p>FMayerhofer: /* Step 2: */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === A1 SQL Injection Example ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:===<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10896 2023-01-08T12:25:14Z

<p>FMayerhofer: /* Practical examples */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === A1 SQL Injection Example ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10895 2023-01-08T12:24:38Z

<p>FMayerhofer: /* Step 2: */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10894 2023-01-08T12:22:19Z

<p>FMayerhofer: /* Step 2: */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.<br /> Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.<br /> One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10893 2023-01-08T12:17:11Z

<p>FMayerhofer: /* Step 2: */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> This script creates a form object in the background and sets some specific fields to vote for a security tool.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10892 2023-01-08T12:15:01Z

<p>FMayerhofer: /* Practical examples */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10891 2023-01-08T12:14:55Z

<p>FMayerhofer: /* Practical examples */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> SQL Injection<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10890 2023-01-08T12:14:42Z

<p>FMayerhofer: /* SQL Injection */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> ==== SQL Injection ====<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10889 2023-01-08T12:14:30Z

<p>FMayerhofer: /* SQL Injection */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> === SQL Injection ===<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10888 2023-01-08T12:14:17Z

<p>FMayerhofer: /* SQL Injection */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> = SQL Injection =<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10887 2023-01-08T12:14:04Z

<p>FMayerhofer: /* Practical examples */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> == SQL Injection ==<br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10886 2023-01-08T12:13:32Z

<p>FMayerhofer: /* Practical examples */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> === Practical examples ===<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ==Step 1:==<br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ==Step 2:==<br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10885 2023-01-08T12:12:55Z

<p>FMayerhofer: /* Practical examples */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical examples ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> [[File:Blogs.PNG]]<br /> <br /> The script can be found on the official github webiste for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10884 2023-01-08T12:11:29Z

<p>FMayerhofer: /* Practical examples */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical examples ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> [[File:Blogs.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=File:Blogs.PNG&diff=10883 2023-01-08T12:11:10Z

<p>FMayerhofer: </p> <hr /> <div></div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10882 2023-01-08T12:09:47Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical examples ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can see the site which we are attacking. So this site is basically the good site.<br /> [[File:UserPoll.PNG]]<br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action.<br /> Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10881 2023-01-08T12:02:53Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can the site which we are attacking. So this site is basically the good site.<br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a table. An attacker can you use this mechanism to<br /> [[File:UserPoll.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10880 2023-01-08T12:01:27Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> In the screenshot below you can the site which we are attacking. So this site is basically the good site.<br /> The evil site is in this case the 'Add to your blog' site. Users can save a blog to a table. An attacker can you use this mechanism to<br /> [[File:UserPoll.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10878 2023-01-08T11:57:04Z

<p>FMayerhofer: /* Installing Mutillidae */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10877 2023-01-08T11:56:58Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10876 2023-01-08T11:56:45Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.PNG]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10875 2023-01-08T11:56:37Z

<p>FMayerhofer: /* Installation */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.PNG]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10874 2023-01-08T11:56:14Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> <br /> [[File:UserPoll.PNG]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10873 2023-01-08T11:55:34Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> <br /> [[File:UserPoll.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10872 2023-01-08T11:53:07Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> [[File:UserPoll.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10871 2023-01-08T11:51:45Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> [[File:UserPoll.png]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=File:UserPoll.PNG&diff=10870 2023-01-08T11:50:35Z

<p>FMayerhofer: Voting site for security tools</p> <hr /> <div>== Summary ==<br /> Voting site for security tools</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10869 2023-01-08T11:48:34Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'.<br /> Here we simulating an attack to vote for a security tool but without actually voting for it.<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10868 2023-01-08T11:39:33Z

<p>FMayerhofer: /* Practical example */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> <br /> [[Cross-Site-Request_Forgery_(CSRF)]]-&gt; Cross-Site-Request Forgery<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae&diff=10866 2023-01-08T11:23:44Z

<p>FMayerhofer: /* Installation */</p> <hr /> <div>OWASP Mutillidae is a &quot;Vulnerable Web Application&quot; (see also: [[Unsecure Webservices: bWAPP vs. JuiceShop]]) that allows users to test Exploits in a legal manner inside a insulated Sandbox Environment. A big advantage of Mutillidae is the fact that it doesn't rely on &quot;Magic Statements&quot; - user inputs that are checked against a predefined list of accepted solutions. Instead, the way to complete challenges is completely up to the users.<br /> Mutillidae Version II has been written by Jeremy Druin and currently contains about 40 Exploits and Skill Challenges, mainly picked from the [[Thread Modelling#Top 10 Web Application Security Risks|OWASP Top Ten Vulnerabilities]].<br /> <br /> == Installation ==<br /> <br /> In order to use Mutillidae &lt;ref&gt;https://github.com/webpwnized/mutillidae &lt;/ref&gt;, the XAMPP-Stack&lt;ref&gt;https://www.apachefriends.org/download.html&lt;/ref&gt; has to be running on the user's OS. The Mutillidae source code can then be placed inside XAMPP's &quot;htdocs&quot; folder. This will allow the website to be reached under http://127.0.0.1/mutillidae/.<br /> <br /> Another way to use Mutillidae is to install Metasploit. Metasploit has everything you need to run Mutillidae. After installing and starting it you can use for the credentials 'msfadmin' to login.<br /> Then you have to check the ip address of the machine where Metasploit is running on, so you know which ip address you have to use in the browser to access Metasploit.<br /> <br /> == User Interface ==<br /> [[File:Landing page.png|1200px]]<br /> <br /> As seen above, different features can be controlled on the landing page. The horizontal bar on top e.g. offers the possibility to hide or show hints, toggle through the three security levels or reset the backend database.<br /> On the left side, users can choose from different Vulnerabilities, sorted by the different published OWASP Vulnerabilities published throughout time. Pages will be offered, on which the specified Vulnerabilities can be tested. If hints are activated, the system will describe potential vulnerabilities presented by the different elements shown on the site.<br /> <br /> == Selected Vulnerabilities ==<br /> <br /> A list of offered vulnerabilities include:<br /> <br /> *[[SQL Injection]] (Data Extraction, Authentication Bypass)<br /> *Various other forms of Injection (CSS, HTML, JavaScript, [[Buffer Overflows]], XML)<br /> *[[Cross-Site-Scripting (XSS)]]<br /> *Various Security Missconfigurations<br /> *Various forms of Authentication Bypass and Priviledge Escalation<br /> <br /> == Unique Features ==<br /> <br /> *Actual environment instead of &quot;Magic Statements&quot;<br /> *3 Security Levels<br /> *Embedded Help System<br /> *A large amount of video tutorials by the creator &lt;ref&gt; https://www.youtube.com/user/webpwnized &lt;/ref&gt;<br /> *Fast backend reset<br /> <br /> == References ==<br /> <br /> &lt;references /&gt;<br /> <br /> <br /> [[Category:Pentesting]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10862 2023-01-08T11:12:25Z

<p>FMayerhofer: /* Installation */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install Metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10860 2023-01-08T11:08:11Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:database-config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10859 2023-01-08T11:06:36Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> <br /> [[File:Config.png]]<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10858 2023-01-08T11:02:30Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the CLI to find the ip address.<br /> Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set.<br /> To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'.<br /> In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.<br /> [[File:Config.png]]<br /> <br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10855 2023-01-08T10:52:13Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on.<br /> To look up the ip address you can use the 'ip a' command in the cli to find the ip address.<br /> [[File:Config.png]]<br /> <br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10854 2023-01-08T10:49:58Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> [[File:Config.png]]<br /> <br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=File:Config.PNG&diff=10852 2023-01-08T10:47:05Z

<p>FMayerhofer: </p> <hr /> <div></div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10851 2023-01-08T10:44:45Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit.<br /> <br /> <br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10814 2023-01-07T16:55:27Z

<p>FMayerhofer: /* Installing Mutillidae with Metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae.<br /> This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for.<br /> After installing you can use the credentials msfadmin for the username and password in order to get access.<br /> <br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10812 2023-01-07T16:53:57Z

<p>FMayerhofer: /* Installing Mutillidae with metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with Metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run mutillidae.<br /> <br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10811 2023-01-07T16:53:08Z

<p>FMayerhofer: /* Installing Mutillidae with metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with metasploit ===<br /> A different method for installing Mutillidae is to install metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run mutillidae.<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10810 2023-01-07T16:49:04Z

<p>FMayerhofer: /* Installing Mutillidae with metasploit */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> === Installing Mutillidae with metasploit ===<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10809 2023-01-07T16:48:38Z

<p>FMayerhofer: /* Installing Mutillidae */</p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> == Installing Mutillidae with metasploit ==<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer https://elvis.hcw.ac.at/wiki/index.php?title=OWASP_Mutillidae_(2021)&diff=10807 2023-01-07T16:42:12Z

<p>FMayerhofer: </p> <hr /> <div>== Summary == <br /> <br /> OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a &quot;Vulnerable Web Application&quot; that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides. <br /> <br /> <br /> <br /> == How it Operates ==<br /> <br /> Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get &quot;hacked&quot;. Since everything run at your local machine you can not harm anyone. The data such as &quot;User Data&quot; are stored in a Database which you set up when you install the Application (see Installation for more Information).<br /> <br /> [[File:Muti-Dropdown.png]]<br /> <br /> <br /> == Practical example ==<br /> <br /> [[SQL_Injection]]-&gt; SQLi Extract Data<br /> <br /> Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.<br /> <br /> [[File:Mutillidae-login.png]]<br /> <br /> Normally the query should only retrun only on record when correct credentials are entered.<br /> <br /> But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?<br /> <br /> ===Step 1:=== <br /> get an Exception by typing in invalid characters such as (', #, --)<br /> <br /> [[File:Mutillidae-Exception.png]]<br /> <br /> ===Step 2:=== <br /> <br /> Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.<br /> <br /> In this case i wrote ’OR 1# in the username fields to alter the query which should be now<br /> <br /> SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’<br /> <br /> 1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:<br /> <br /> [[File:Mutillidae-Extract-Data.png]]<br /> <br /> == Features ==<br /> <br /> * over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[https://owasp.org/www-project-top-ten/])<br /> * Actually Vulnerable<br /> * Simple Intallation and Maintaining<br /> * User can switch between 3 security levels (no security, Client-side Security, Server-side Security)<br /> * Used in web security courses<br /> * Tutorials and Guides included in Application<br /> * Updated frequently<br /> <br /> == Interface ==<br /> [[File:Mutillidae-Interface.png]]<br /> <br /> By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.<br /> <br /> * Hints and Videos - leads you directly to a structured guide how the exercise could be completed.<br /> * Toggle Security - you can choose between 3 Security levels for each exercise<br /> * Reset DB - Clear all user Data <br /> * Labs - Study Questions associated with the Exercises<br /> <br /> == Examples of Vulnerabilities ==<br /> <br /> * SQL Injections (SQLi)[https://wiki.elvis.science/index.php?title=SQL_Injection]<br /> * Cross-Site-Scripting [https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)]<br /> * Sensitive Data Exposure<br /> * other Injection (CSS, HTML, JavaScript)<br /> * and many more...<br /> <br /> == Requirements ==<br /> <br /> * Apache Webserver<br /> * Database (MySQL/MariaDb)<br /> * Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)<br /> <br /> == Installation ==<br /> <br /> <br /> * Install Apache Webserver on your local Machine<br /> * Install PHP on your local Machine<br /> * Install a supported Database (e.g. MySQL, MariaDB)<br /> * Install metasploit, it includes everything you need to run mutillidae<br /> <br /> If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.<br /> There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]<br /> <br /> === Installing Mutillidae ===<br /> <br /> Head to the Folder where Websites are stored in Apache Webserver this could be the &quot;htdocs&quot; folder under XAMPP or if manually installed under a linux distribution this might be the folder &quot;/var/www/html/&quot;<br /> <br /> Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface<br /> <br /> To see if the database is correctly installed press the &quot;Reset DB&quot; Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.<br /> <br /> [[File:Mutllidae-no-errors.png]]<br /> <br /> <br /> == References ==<br /> <br /> * https://owasp.org/www-project-top-ten/<br /> * https://github.com/webpwnized/mutillidae<br /> * https://www.youtube.com/c/webpwnized/featured<br /> * https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial<br /> <br /> Internal Links<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection<br /> * https://wiki.elvis.science/index.php?title=Cross-Site-Scripting_(XSS)<br /> * https://wiki.elvis.science/index.php?title=SQL_Injection_Examples_on_Known_Vulnerable_Web_Applications<br /> <br /> [[Category:Documentation]]</div>

FMayerhofer