OWASP Mutillidae (2021) - Revision history

MVucinic: /* References */

2024-12-18T17:42:41Z

References

← Older revision		Revision as of 17:42, 18 December 2024
Line 236:		Line 236:

	* https://owasp.org/www-project-top-ten/		* https://owasp.org/www-project-top-ten/
	* https://github.com/webpwnized/mutillidae		* https://github.com/webpwnized/mutillidae.git
	* https://www.youtube.com/c/webpwnized/featured		* https://www.youtube.com/c/webpwnized/featured
	* https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial		* https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial

MVucinic: /* Installing Mutillidae */

2024-12-18T15:52:22Z

Installing Mutillidae

← Older revision		Revision as of 15:52, 18 December 2024
Line 111:		Line 111:

	=== Installing Mutillidae ===		=== Installing Mutillidae ===
	This ~~document~~ provides a detailed installation guide for OWASP Mutillidae II. The only prerequisite for this guide is a functioning Ubuntu server (or a similar Linux-based environment).		This section provides a detailed installation guide for OWASP Mutillidae II. The only prerequisite for this guide is a functioning Ubuntu server (or a similar Linux-based environment).

	====Apache Webserver====		====Apache Webserver====

MVucinic: /* Installing Mutillidae */

2024-12-18T15:52:10Z

Installing Mutillidae

← Older revision		Revision as of 15:52, 18 December 2024
Line 111:		Line 111:

	=== Installing Mutillidae ===		=== Installing Mutillidae ===
			This document provides a detailed installation guide for OWASP Mutillidae II. The only prerequisite for this guide is a functioning Ubuntu server (or a similar Linux-based environment).

	====Apache Webserver====		====Apache Webserver====

MVucinic: /* Installation */

2024-12-17T21:25:18Z

Installation

← Older revision		Revision as of 21:25, 17 December 2024
Line 111:		Line 111:

	=== Installing Mutillidae ===		=== Installing Mutillidae ===
			====Apache Webserver====

	The first thing ~~that will be installed,~~ is an Apache Webserver. ~~In oder to do that, run this~~ command:		The first thing to install is the Apache Webserver. Run the following command:

	* sudo apt install apache2 -y		* ''sudo apt install apache2 -y''

	~~Afterwards run this command~~, ~~in order to~~ allow ~~URL_Rewrites.~~		After installation, allow URL Rewrites:

	* sudo a2enmod rewrite		* ''sudo a2enmod rewrite''

	Restart the server ~~then.~~		Restart the Apache server:

	* sudo systemctl restart apache2		* ''sudo systemctl restart apache2''

	~~After the restart~~, ~~go into~~ the apache2.conf ~~and search the <Directory>. When found, change the AllowOverride None ->~~ AllowOverride All.		Next, edit the apache2.conf file to enable AllowOverride All:.

	* sudo nano /etc/apache2/apache2.conf		* ''sudo nano /etc/apache2/apache2.conf''

	[[File:Conf-file.PNG]]		[[File:Conf-file.PNG]]

	Afterwards restart the server and with http://ip-address-of-your-server this page should be seen.		Afterwards restart the server again and with http://ip-address-of-your-server this page should be seen.

	[[File:Apache2-page.PNG]]		[[File:Apache2-page.PNG]]
			====PHP====

	If ~~this~~ page ~~comes up~~, ~~Apache2~~ has been ~~succsesfully~~ installed. Now PHP ~~needs to be installed~~ with this:		If the Apache2 page is visible, Apache has been successfully installed. Now, install PHP with this command:

	* sudo apt install php libapache2-mod-php -y		* ''sudo apt install php libapache2-mod-php -y''

	~~Now we can edit the~~ index.php file ~~and can now write something like this~~:		To test PHP, create an index.php file:

	* sudo nano /var/www/html/index.php		* ''sudo nano /var/www/html/index.php''

	* <?php echo "Hello, PHP!"; ?>		Add the following content:

	~~After saving this~~ file and ~~going onto this site~~ http://ip-address-of-your-server/index.php ~~we are greeted with~~ this.		* ''<?php echo "Hello, PHP!"; ?>''

			Save the file and visit http://ip-address-of-your-server/index.php. You should see this result:

	[[file:Index-php.PNG]]		[[file:Index-php.PNG]]
			====MySQL Server====

	~~With this out of the way~~, ~~the next step will be the installation of~~ the MySQL Server~~. Use this command to install the datasbase~~ and ~~also install~~ the ~~php~~ plugin ~~at the same time.~~		Next, install the MySQL Server and the PHP-MySQL plugin with this command:

	* sudo apt install mysql-server php-mysql -y		* ''sudo apt install mysql-server php-mysql -y''
			====Change root password====

	~~After installing it we need to change the password of root. The reason why we have to do that is, because~~ Mutillidae II uses the root user with the password "mutillidae". ~~If we dont change that~~, ~~Mutillidae II wont work properly.~~		Mutillidae II uses the root user with the password mutillidae. To ensure it works properly, set the root password as follows:
	~~Use this command in oder to access~~ the ~~database~~ as ~~root~~:

	* sudo mysql -u root		1) Access the MySQL database as root:
			* ''sudo mysql -u root''

	Once on it use this command to make changes in the database:		2) Once on it use this command to make changes in the database:

	* sudo mysql		* ''sudo mysql;''

	~~Afterwards run this command to cahnge~~ the password:		3) In the MySQL shell, update the root password:

	* ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'mutillidae';		* ''ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'mutillidae';''
	~~FLUSH PRIVILEGES;~~

	Once done, flush the old privilages with:		Once done, flush the old privilages with:

	* FLUSH PRIVILEGES;		* ''FLUSH PRIVILEGES;''

	Then write EXIT; to exit the database.		Then write EXIT; to exit the database.
			====PHP Libraries====

	With these steps done, we can now go and install the three PHP libraries. The first one will be the PHP XML Library.		With these steps done, we can now go and install the three PHP libraries. The first one will be the PHP XML Library.
	Run these commands:		Run these commands:

	* php --version (to now which version of PHP one has)		This in order to know which PHP Verion one has:
			* ''php --version (to now which version of PHP one has)''

	* sudo apt-get install php8.1-xml (my verison is 8.1, yours could be different)		After having figured out whcih version of PHP is installed run this:
			* ''sudo apt-get install php8.1-xml'' (my verison is 8.1, yours could be different)

	After the XML Library, the Curl Library will be installed next:		After the XML Library, the Curl Library will be installed next:

	* sudo apt-get install php8.1-curl		* ''sudo apt-get install php8.1-curl''

	The last Library will be the mbstring Library.		The last Library will be the mbstring Library.

	* sudo apt-get install php8.1-mbstring		* ''sudo apt-get install php8.1-mbstring''

			====Git====

			Install Git to download the OWASP Mutillidae II repository:

			* ''sudo apt install git -y''

			====Final step====

			Finally, install OWASP Mutillidae II:

			1) Move to the Apache webserver folder:

			* ''cd /var/www/html''

			2) Clone the repository:

			* ''sudo git clone https://github.com/webpwnized/mutillidae.git''

			After its done cloning, visit http://ip-address-of-your-server/mutillidae/src. There, if everythin worked, you should be greeted by this site:

	~~====test====~~		[[file:Owasp-page.PNG]]
	a

			On the page, press Reset DB. If everything worked correctly, the installation is successful.

	=== Installing Mutillidae with Metasploit ===		=== Installing Mutillidae with Metasploit ===

MVucinic: /* Installation */

2024-12-17T20:51:32Z

Installation

@@ Line 101: / Line 101: @@
 == Installation ==
 * Install Apache Webserver on your local Machine
 * Install PHP on your local Machine
@@ Line 133: / Line 132: @@
 Afterwards restart the server and with http://ip-address-of-your-server this page should be seen.

MVucinic: /* Installation */

2024-12-17T20:20:37Z

Installation

← Older revision		Revision as of 20:20, 17 December 2024
Line 130:		Line 130:

	[[File:Conf-file.PNG]]		[[File:Conf-file.PNG]]

			Afterwards restart the server and with http://ip-address-of-your-server this page should be seen.

MVucinic: /* Installation */

2024-12-17T20:17:54Z

Installation

← Older revision		Revision as of 20:17, 17 December 2024
Line 128:		Line 128:

	* sudo nano /etc/apache2/apache2.conf		* sudo nano /etc/apache2/apache2.conf

			[[File:Conf-file.PNG]]

MVucinic: /* Installation */

2024-12-17T20:14:57Z

Installation

← Older revision		Revision as of 20:14, 17 December 2024
Line 101:		Line 101:
	== Installation ==		== Installation ==

			test
	* Install Apache Webserver on your local Machine		* Install Apache Webserver on your local Machine
	* Install PHP on your local Machine		* Install PHP on your local Machine
	* Install a supported Database (e.g. MySQL, MariaDB)		* Install a supported Database (e.g. MySQL, MariaDB) (This installationguide will cover MySQL)
	* Install ~~Metasploit~~, ~~it includes everything you need to run mutillidae~~		* Install three PHP Libraries (php-xml, php-curl, php-mbstring)
			* Install Git

	If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae. Alternativly you can also use a docker build to run Mutillidae.		If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae. Alternativly you can also use a docker build to run Mutillidae.
	There ~~are Videos~~ from the creator which gives a ~~[https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md~~ Step-by-Step video ~~tutorial]~~		There is a Videoseries from the creator which gives a Step-by-Step video tutorialfor the installation.

	=== Installing Mutillidae ===		=== Installing Mutillidae ===

	~~Head to the Folder where Websites are stored in~~ Apache Webserver this ~~could be~~ the ~~"htdocs" folder under XAMPP or if manually installed under a linux distribution this might be~~ the ~~folder "/var~~/~~www~~/~~html~~/"		The first thing that will be installed, is an Apache Webserver. In oder to do that, run this command:

			* sudo apt install apache2 -y

			Afterwards run this command, in order to allow URL_Rewrites.

			* sudo a2enmod rewrite

			Restart the server then.

			* sudo systemctl restart apache2

			After the restart, go into the apache2.conf and search the <Directory>. When found, change the AllowOverride None -> AllowOverride All.

			* sudo nano /etc/apache2/apache2.conf

	Download the Repository from github (see [[#Requirements]]) and copy the contents of the Repository into the Webservers folder. After these steps go on your localhost webpage and make sure you can access Mutillidae Webinterface

	To see if the database is correctly installed press the "Reset DB" Button on the Webinterface. If you see the Message that no PHP or SQL errors were detected when resseting the database, the intallation of mutillidae succeded.
	~~[[File:Mutllidae-no-errors.png]]~~

	=== Installing Mutillidae with Metasploit ===		=== Installing Mutillidae with Metasploit ===

NKirnbauer: fixed link

2024-09-25T08:48:51Z

fixed link

← Older revision		Revision as of 08:48, 25 September 2024
Line 54:		Line 54:
	[[File:Blogs.PNG]]		[[File:Blogs.PNG]]

	The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt		The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/src/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt
	This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.		This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site.
	Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.		Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values.

LEbenbauer: Added a few details as well as a part about comparable vulnerable web applications. Checked if up to date

2024-01-08T16:14:51Z

Added a few details as well as a part about comparable vulnerable web applications. Checked if up to date

← Older revision		Revision as of 16:14, 8 January 2024
Line 1:		Line 1:
	== Summary ==		== Summary ==

	OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a "Vulnerable Web Application" that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides.		OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a "Vulnerable Web Application" that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The main goal is to to offer security training for a wide range of uses, from teaching in classrooms to security enthusiasts exploring to functioning as testing ground for vulnerability assessment targets. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. Most of the Vulnerabilities are structured around the OWASP Top Ten List[https://wiki.elvis.science/index.php?title=Thread_Modelling#Top_10_Web_Application_Security_Risks]. The current Version Mutillidae II was created by Jeremy Druin [https://www.youtube.com/c/webpwnized/featured] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides.


Line 87:		Line 87:
	* other Injection (CSS, HTML, JavaScript)		* other Injection (CSS, HTML, JavaScript)
	* and many more...		* and many more...

			== Comparable Vulnerable Web Applications ==

			* WebGoat [https://wiki.elvis.science/index.php?title=WebGoat]
			* bWAPP [https://wiki.elvis.science/index.php?title=BWAPP]

	== Requirements ==		== Requirements ==
Line 102:		Line 107:
	* Install Metasploit, it includes everything you need to run mutillidae		* Install Metasploit, it includes everything you need to run mutillidae

	If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae.		If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae. Alternativly you can also use a docker build to run Mutillidae.
	There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]		There are Videos from the creator which gives a [https://github.com/webpwnized/mutillidae/blob/master/README-INSTALLATION.md Step-by-Step video tutorial]