Unsecure Webservices: bWAPP vs. JuiceShop - Revision history

NKirnbauer: fixed link

2024-10-03T09:33:16Z

fixed link

← Older revision		Revision as of 09:33, 3 October 2024
Line 193:		Line 193:
	[https://www.owasp.org Open Web Application Security Project (OWASP)]		[https://www.owasp.org Open Web Application Security Project (OWASP)]

	[https://www.mmebvba.com/~~sites/default~~ MME Security Audits & Training]		[https://www.mmebvba.com/ MME Security Audits & Training]

	[https://www.owasp.org/www-project-juice-shop OWASP Juice Shop Project]		[https://www.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

NKirnbauer: fixed link

2024-10-03T09:31:11Z

fixed link

← Older revision		Revision as of 09:31, 3 October 2024
Line 195:		Line 195:
	[https://www.mmebvba.com/sites/default MME Security Audits & Training]		[https://www.mmebvba.com/sites/default MME Security Audits & Training]

	[https://~~www2~~.owasp.org/www-project-juice-shop OWASP Juice Shop Project]		[https://www.owasp.org/www-project-juice-shop OWASP Juice Shop Project]

	[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]		[https://www.netsparker.com/blog/websecurity/sql-injection-vulnerability SQL-Injection Vulnerability]

	[[Category:Documentation]]		[[Category:Documentation]]

CEberhart: /* STEP 5: Cracking the hashed password with John the Ripper */

2020-12-21T18:27:51Z

STEP 5: Cracking the hashed password with John the Ripper

← Older revision		Revision as of 18:27, 21 December 2020
Line 162:		Line 162:
	----		----
	<br></br>		<br></br>

	== OWASP Juice Shop Challenge ==		== OWASP Juice Shop Challenge ==
	At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.		At OWASP Juice Shop there is a separate website where the Challenges are listed. You have to search for the possibility of executing these Challenges. If a Challenge was successful, a notification will appear on the screen.

CEberhart: /* Vulnerable Webservices */

2020-12-21T17:55:40Z

Vulnerable Webservices

← Older revision		Revision as of 17:55, 21 December 2020
Line 37:		Line 37:
	These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention</br>		These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention</br>
	Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:		Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
	*~~buggy web application (bWAPP)~~[[bWAPP]]		*[[bWAPP]] (buggy web application)
	*damn vulnerable web application ~~(DVWA~~)[[DVWA]]		*[[DVWA]](damn vulnerable web app)
	*~~OWASP Juice Shop~~[[OWASP_Juice_Shop]]		*[[OWASP_Juice_Shop]]

	=== bWAPP ===		=== bWAPP ===

CEberhart: /* Vulnerable Webservices */

2020-12-21T17:53:49Z

Vulnerable Webservices

← Older revision		Revision as of 17:53, 21 December 2020
Line 37:		Line 37:
	These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention</br>		These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention</br>
	Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:		Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
	*buggy web application (bWAPP) ~~https://wiki.elvis.science/index.php?title=OWASP_Juice_Shop~~		*buggy web application (bWAPP)[[bWAPP]]
	*damn vulnerable web application (DVWA)		*damn vulnerable web application (DVWA)[[DVWA]]
	*OWASP Juice Shop		*OWASP Juice Shop[[OWASP_Juice_Shop]]

	=== bWAPP ===		=== bWAPP ===

CEberhart: /* Vulnerable Webservices */

2020-12-21T17:49:25Z

Vulnerable Webservices

← Older revision		Revision as of 17:49, 21 December 2020
Line 37:		Line 37:
	These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention</br>		These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention</br>
	Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:		Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
	*buggy web application (bWAPP)		*buggy web application (bWAPP) https://wiki.elvis.science/index.php?title=OWASP_Juice_Shop
	~~#REDIRECT [[~~https://wiki.elvis.science/index.php?title=OWASP_Juice_Shop]]
	*damn vulnerable web application (DVWA)		*damn vulnerable web application (DVWA)
	*OWASP Juice Shop		*OWASP Juice Shop

CEberhart: /* Vulnerable Webservices */

2020-12-21T17:48:16Z

Vulnerable Webservices

← Older revision		Revision as of 17:48, 21 December 2020
Line 38:		Line 38:
	Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:		Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
	*buggy web application (bWAPP)		*buggy web application (bWAPP)
			#REDIRECT [[https://wiki.elvis.science/index.php?title=OWASP_Juice_Shop]]
	*damn vulnerable web application (DVWA)		*damn vulnerable web application (DVWA)
	*OWASP Juice Shop		*OWASP Juice Shop

CEberhart: /* vulnerable Webservices */

2020-12-21T17:45:24Z

vulnerable Webservices

← Older revision		Revision as of 17:45, 21 December 2020
Line 34:		Line 34:
	Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.		Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

	== ~~vulnerable~~ Webservices ==		== Vulnerable Webservices ==
			These are web services that were intentionally implemented insecure, so that there are extremely vulnerable. Thus, security enthusiast such as developers, students or teachers can use it to discover and simulate various vulnerabilities in the web. This ensures that users are better at dealing with a wide variety of vulnerabilities, such as the OWASP Top 10 and many other weaknesses in the web. Moreover, it's like a workout to improve ethical hacking skills. In addition, it is possible to minimize the dangers, because you know what to pay attention</br>
			Three services are presented in detail referring to their architecture, installation, as well as a practical example with SQL Injection:
			*buggy web application (bWAPP)
			*damn vulnerable web application (DVWA)
			*OWASP Juice Shop

	=== bWAPP ===		=== bWAPP ===

CEberhart: /* Web Security Test-Application */

2020-12-21T17:25:22Z

Web Security Test-Application

← Older revision		Revision as of 17:25, 21 December 2020
Line 23:		Line 23:
	Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.		Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy.Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.

	~~== Web Security Test-Application ==~~		== Penetrating Testing ==

	=== Penetrating Testing ===

	Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.		Penetrating testing is a targeted, permitted attempt to penetrate an IT system. The main objective is to detect and eliminate vulnerabilities in order to improve IT security. Vulnerabilities should be identified before they arise. Methods such as SQL injection, XML External Entities (XEE) and Cross-Site scripting (XSS) are very popular by hackers. For web applications, the Open Web Application Security Project (OWASP) offers materials for pentests.

	=== SQL Injection Vulnerability ===		== SQL Injection Vulnerability ==

	With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.		With the growing popularity of the World Wide Web, there was an increasing use for advanced technology and dynamic websites.
Line 35:		Line 33:
	SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.		SQL injection vulnerability is one of the greatest dangers to confidentiality and integrity in Web applications and thus has been included in the OWASP Top 10 list of the most common vulnerabilities since its introduction. For example, attackers can insert malware into an SQL statement through an SQL injection vulnerability. The practical part of this thesis deals with the SQL injection attack.
	Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.		Attackers gain the ability to perform a series of actions if an SQL injection is applied to a vulnerable page. By exploiting this vulnerability, database contents can be added, edited, deleted or read.

			== vulnerable Webservices ==

	=== bWAPP ===		=== bWAPP ===
Line 41:		Line 41:
	=== OWASP Juice Shop ===		=== OWASP Juice Shop ===
	At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.		At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. The Juice Shop was designed in 2014 and is a so-called 'online juice shop' for safety training. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project. This step made the Juice Shop accessible to a large community of users within a short period of time.


	==Comparison and architecture of bWAPP and OWASP Juice Shop==		==Comparison and architecture of bWAPP and OWASP Juice Shop==

CEberhart: /* Introduction */

2020-12-21T17:21:54Z

Introduction

@@ Line 2: / Line 2: @@
 == Introduction ==
-The number of users of online services has increased significantly in the last years. Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.
+The number of users of online services has increased significantly in the last years. As a result, the relevance of security in the web is also increasing rapidly, because every organization and private person prefers that their data securely tranported and stored in the web. Moreover, Even though we are living in 2020, web application security is the most overlooked aspect of a business. Therefore, hackers' efforts are more focused on websites and the associated applications. To understand why web apps are a popular target of many cyber criminals a few important points are listed here.
-Most software errors are the result of inappropriate input validation. This leads to an attack targeting confidential information more frequently. SQL injection attacks are very popular because they are executed using simple scripts. Identifying SQL-injection vulnerabilities is often not that easy. A lot of software errors in web applications are the result of invalid entries. Even though the majority of security gaps on the web are performed directly and from a strategic distance, many web designers are surprisingly not security conscious. Testing vulnerabilities for web applications is one way to deal with such problems. Tools like bWAPP and OWASP Juice Shop offer users a fun way to uncover these vulnerabilities.
+Nowadays web applications represent a fundamental part in information technologies. Therefore the danger of attacks on the internet is growing and make so-called penetration tests necessary. A penetration test comprises a series of activities which record and identify security gaps. In the attached seminar paper, two intentionally insecure web services are compared with each other. The focus of the practical part includes the testing of the world's most frequently used SQL-injection Attack. In this case, attackers take advantage of specific weaknesses in order to gain access to confidential information. A variation of this SQL injection attack is described.</br>
 == Web Security Test-Application ==