OWASP Mutillidae (2021)

Summary

OWASP Mutillidae is a free open source tool created for Pentesting of Web Applications. It is a "Vulnerable Web Application" that offers a Platform where the provided Exploits and Security flaws can be executed within a local environment. With over 40 different vulnerabilities and related training challenges, it provides a platform that shows the most common flaws of the last 15 years of web development. The main goal is to to offer security training for a wide range of uses, from teaching in classrooms to security enthusiasts exploring to functioning as testing ground for vulnerability assessment targets. The vulnerabilities shown in the program are actual vulnerabilities within the application, so the application should only be run in a protected environment - such as a virtual machine. Most of the Vulnerabilities are structured around the OWASP Top Ten List[1]. The current Version Mutillidae II was created by Jeremy Druin [2] (pseudonym: webpwnized), who also created the Tutorials for the Challanges and Installation Guides.

How it Operates

Every Vulnerability contained in the application is build in within a Webpage. By selecting the Exploit from a List (e.g. Authentication Bypass) a site with the corresponding explotable Webpage is loaded and ready to get "hacked". Since everything run at your local machine you can not harm anyone. The data such as "User Data" are stored in a Database which you set up when you install the Application (see Installation for more Information).

A1 SQL Injection Example

SQL_Injection-> SQLi Extract Data

Now here is a short example how one vulnerability exploit could look like. In this case there is a query where user can request their userinformation by providing their credentials.

Normally the query should only retrun only on record when correct credentials are entered.

But this website is totally unsecure so we can easily rewrite the SQL query to give us a list of every user in the database. But how can we do this?

Step 1:

get an Exception by typing in invalid characters such as (', #, --)

Step 2:

Since we got an error message with the syntax how the sql statement is written we can alter the statement by simply put another statement in the form.

In this case i wrote ’OR 1# in the username fields to alter the query which should be now

SELECT * FROM acccounts where username= ’ ’OR 1# AND password = ’’

1 means true in SQL language and # is a comment so it ignores the password query. So our SQL String says now that it should gives as all datasets for which the condition is true which lead to following output:

A5 Cross-Site-Request Forgery Example

Cross-Site-Request_Forgery_(CSRF)-> Cross-Site-Request Forgery This example can be found in the A5 section from the Owasp Top 10 examples, which is called 'Add to your blog'. Here we simulating an attack to vote for a security tool but without actually voting for it. In the screenshot below you can see the site which we are attacking. So this site is basically the good site.

The evil site is in this case the 'Add to your blog' site. Users can save a blog to a blog table. An attacker can you use this mechanism to manipulate a blog to fire an action. Instead of a normal blog you can also add a script to the blog table. This script calls a method when you hover over the blog and it redirects to the voting site and votes for a security tool.

The script can be found on the official github website for Mutillidae https://github.com/webpwnized/mutillidae/blob/master/src/labs/lab-files/cross-site-request-forgery-lab-files/vote-for-nmap-onmouseover-csrf.txt This script creates a form object in the background and sets some specific fields. Those fields are being sent over the URL to the voting site. Because how the site is constructed, it reads the parameter from the url to decide which security tool should be voted. This means that the form object consists of some input fields and those input fields contain some values. One input field is responsible for redirecting to the voting site. The other one is setting the value for security tool. A form also should have a submit button which is also set with the input fields. This whole script is contained in a method. This method gets fired when you hover over the mouse. You basically save a html tag with the name of the blog but this html tag calls the method which is containing the malicious script.

Features

over 40 vulnerabilities (OWASP Top Ten 2007, 2010, 2013 and 2017[3])
Actually Vulnerable
Simple Intallation and Maintaining
User can switch between 3 security levels (no security, Client-side Security, Server-side Security)
Used in web security courses
Tutorials and Guides included in Application
Updated frequently

Interface

By clicking on any Item on the right dropdown menu, you can select any of the OWASP Top Ten Challanges from the last 15 years.

Hints and Videos - leads you directly to a structured guide how the exercise could be completed.
Toggle Security - you can choose between 3 Security levels for each exercise
Reset DB - Clear all user Data
Labs - Study Questions associated with the Exercises

Examples of Vulnerabilities

SQL Injections (SQLi)[4]
Cross-Site-Scripting [5]
Sensitive Data Exposure
other Injection (CSS, HTML, JavaScript)
and many more...

Comparable Vulnerable Web Applications

WebGoat [6]
bWAPP [7]

Requirements

Apache Webserver
Database (MySQL/MariaDb)
Packages: Sourcecode from git (https://github.com/webpwnized/mutillidae)

Installation

Install Apache Webserver on your local Machine
Install PHP on your local Machine
Install a supported Database (e.g. MySQL, MariaDB) (This installationguide will cover MySQL)
Install three PHP Libraries (php-xml, php-curl, php-mbstring)
Install Git

If you have a XAMPP/LAMPP stack set up aleady, you might skip directly to installing Mutillidae. Alternativly you can also use a docker build to run Mutillidae. There is a Videoseries from the creator which gives a Step-by-Step video tutorialfor the installation.

Installing Mutillidae

The first thing that will be installed, is an Apache Webserver. In oder to do that, run this command:

sudo apt install apache2 -y

Afterwards run this command, in order to allow URL_Rewrites.

sudo a2enmod rewrite

Restart the server then.

sudo systemctl restart apache2

After the restart, go into the apache2.conf and search the <Directory>. When found, change the AllowOverride None -> AllowOverride All.

sudo nano /etc/apache2/apache2.conf

Afterwards restart the server and with http://ip-address-of-your-server this page should be seen.

If this page comes up, Apache2 has been succsesfully installed. Now PHP needs to be installed with this:

sudo apt install php libapache2-mod-php -y

Now we can edit the index.php file and can now write something like this:

sudo nano /var/www/html/index.php

<?php echo "Hello, PHP!"; ?>

After saving this file and going onto this site http://ip-address-of-your-server/index.php we are greeted with this.

With this out of the way, the next step will be the installation of the MySQL Server. Use this command to install the datasbase and also install the php plugin at the same time.

sudo apt install mysql-server php-mysql -y

After installing it we need to change the password of root. The reason why we have to do that is, because Mutillidae II uses the root user with the password "mutillidae". If we dont change that, Mutillidae II wont work properly. Use this command in oder to access the database as root:

sudo mysql -u root

Once on it use this command to make changes in the database:

sudo mysql

Afterwards run this command to cahnge the password:

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'mutillidae';

FLUSH PRIVILEGES;

Once done, flush the old privilages with:

FLUSH PRIVILEGES;

Then write EXIT; to exit the database.

With these steps done, we can now go and install the three PHP libraries. The first one will be the PHP XML Library. Run these commands:

php --version (to now which version of PHP one has)

sudo apt-get install php8.1-xml (my verison is 8.1, yours could be different)

After the XML Library, the Curl Library will be installed next:

sudo apt-get install php8.1-curl

The last Library will be the mbstring Library.

sudo apt-get install php8.1-mbstring

test

a

Installing Mutillidae with Metasploit

A different method for installing Mutillidae is to install Metasploit. Metasploit is a penetration testing software which inlcudes everything you need to set up and run Mutillidae. This means that you don't have to install all the other components you need for example a database, because Metasploit is doing this for. After installing you can use the credentials msfadmin for the username and password in order to login into Metasploit. When Metasploit is running Mutillidae is also accessible and for that you use the ip address of the machine where Metasploit is running on. To look up the ip address you can use the 'ip a' command in the CLI to find the ip address. Sometimes it happens that Mutillidae cannot access the database. This problem occurs when the database name in the config file is not set. To fix this problem you have to navigate to this config file which is found in this destination '/var/www/mutillidae/config.inc'. In this config file you change the value of the variable called '$dbname' to 'owasp10'. After this configuration Mutillidae can access the database.

References

Internal Links