Virtual Machines
single series all timeline

De-ICE are Penetration LiveCD images available from http://forum.heorot.net and provide scenarios where students can test their penetration testing skills and tools in a legal environment.

Courtesy of students Michael N. and Patrick B.

more...
----------------
bee-box - README
----------------

bee-box is a custom Linux VM pre-installed with bWAPP.

With bee-box you have the opportunity to explore all bWAPP vulnerabilities!
bee-box gives you several ways to hack and deface the bWAPP website.
It's even possible to hack the bee-box to get root access...

This project is part of the ITSEC GAMES project. ITSEC GAMES are a fun approach to IT security education. 
IT security, ethical hacking, training and fun... all mixed together.
You can find more about the ITSEC GAMES and bWAPP projects on our blog.

We offer a 2-day comprehensive web security course 'Attacking & Defending Web Apps with bWAPP'.
This course can be scheduled on demand, at your location!
More info: http://goo.gl/ASuPa1 (pdf)

Enjoy!

Cheers

Malik Mesellem
Twitter: @MME_IT

-----------------------
bee-box - Release notes
-----------------------

v1.6
****

Release date: 2/11/2014

bWAPP version: 2.2

New features:

- Vulnerable Drupal installation (Drupageddon)

Bug fixes: /

Modifications: /


v1.5
****

Release date: 27/09/2014

bWAPP version: 2.1

New features:

- CGI support (Shellshock ready)

Bug fixes: /

Modifications: /


v1.4
****

Release date: 12/05/2014

bWAPP version: 2.0

New features:

- Lighttpd web server installed, running on port TCP/9080 and TCP/9443
- PHP SQLite module installed
- SQLiteManager 1.2.4 installed
- Vulnerable bWAPP movie network service (BOF)

Bug fixes: /

Modifications: /


v1.3
****

Release date: 19/04/2014

bWAPP version: 1.9+

New features:

- Nginx web server installed, running on port TCP/8080 and TCP/8443
- Nginx web server configured with a vulnerable OpenSSL version (heartbleed vulnerability)
- Insecure distcc (a fast, free distributed C/C++ compiler)
- Insecure NTP configuration
- Insecure SNMP configuration
- Insecure VNC configuration

Bug fixes:

- bWAPP update script checks for Internet connectivity

Modifications: /


v1.2
****

Release date: 22/12/2013

bWAPP version: 1.8

New features:

- Apache modules enabled: rewrite, include, headers, dav, action
- Apache server-status directive enabled
- Insecure anonymous FTP configuration
- Insecure WebDAV configuration
- Server-Side Includes configuration
- Vulnerable PHP CGI configuration

Bug fixes: /

Modifications:

- MySQL listening on 0.0.0.0
- New bWAPP update script


v1.1
****

Release date: 12/09/2013

bWAPP version: 1.5

New features:

- bWAPP update script

Bug fixes: /

Modifications: /


v1.0
****

Release date: 15/07/2013

bWAPP version: 1.4

New features: /

Bug fixes: /

Modifications: /

-----------------
bee-box - INSTALL
-----------------

bee-box is a custom Linux VM pre-installed with bWAPP.

With bee-box you have the opportunity to explore all bWAPP vulnerabilities!
bee-box gives you several ways to hack and deface the bWAPP website.
It's even possible to hack the bee-box to get root access...


Requirements
////////////

*/ Windows, Linux or Mac OS
*/ VMware Player, Workstation, Fusion or Oracle VirtualBox


Installation steps
//////////////////

No! I will not explain how to install VMware or VirtualBox...

*/ Extract the compressed file.

*/ Double click on the VM configuration file (bee-box.vmx), or import the VM into the VMware software.

*/ Start the VM. It will login automatically.

*/ Check the IP address of the VM.

*/ Go to the bWAPP login page. If you browse the bWAPP root directory you will be redirected.

    example: http://[IP]/bWAPP/
    example: http://[IP]/bWAPP/login.php

*/ Login with the default bWAPP credentials, or make a new user.

    default credentials: bee/bug

*/ You are ready to explore and exploit the bee!


Notes
/////

*/ Linux credentials:

    bee/bug
    root/bug

*/ MySQL credentials:

    root/bug

*/ Modify the Postfix settings (relayhost,...) to your environment.

    config file: /etc/postfix/main.cf

*/ bee-box gives you several ways to deface the bWAPP website.
   It's even possible to hack the bee-box to get root access...

   Have fun!

*/ Take a snapshot of the VM before hacking the bee-box.
   There is also a backup of the bWAPP website (/var/www/bWAPP_BAK).

*/ To reinstall the bWAPP database, delete the database with phpmyadmin (http://[IP]/phpmyadmin/).
   Afterwards, browse to the following page: https://[IP]/bWAPP/install.php

*/ Don't upgrade the Linux operating system, you will lose all fun :)


This project is part of the ITSEC GAMES project. ITSEC GAMES are a fun approach to IT security education. 
IT security, ethical hacking, training and fun... all mixed together.
You can find more about the ITSEC GAMES and bWAPP projects on our blog.

We offer a 2-day comprehensive web security course 'Attacking & Defending Web Apps with bWAPP'.
This course can be scheduled on demand, at your location!
More info: http://goo.gl/ASuPa1 (pdf)

Enjoy!

Cheers

Malik Mesellem
Twitter: @MME_IT
more...

The idea behind VulnVPN is to exploit the VPN service to gain access to the sever and ‘internal’ services. Once you have an internal client address there are a number of ways of gaining root (some easier than others).

Client VPN Configuration

I have created/uploaded the relevant files which can be obtained from the compressed file here. You’ll need to configure Openswan/xl2tpd on your system, if you’re using an Ubuntu based Linux variant you can follow the below steps – please note that I’ve used Backtrack 5r3 for all client testing (mentioned as I know it works well):

  1. apt-get install openswan xl2tpd ppp

  2. Copy the downloaded client files into the following locations:

    /etc/ipsec.conf

    /etc/ipsec.secrets

    /etc/ppp/options.l2tpd.client

    /etc/xl2tpd/xl2tpd.conf

  3. VulnVPN is located at 192.168.0.10 and the client configuration files state that the client IP address is 192.168.0.11. If you want your client to have a different address ensure you change the relevant settings in /etc/ipsec.conf.

  4. To establish a VPN connection run the following command: ipsec auto –up vpn (that’s two hyphens before up, they get lost in the post formatting). If you’re viewing the logs you should see something along the lines of ‘IPsec SA established’.

  5. If the connection succeeds (remember you’ll need to obtain the PSK before this is possible) you can run the ‘start-vpn.sh’ script (included with client config files download) or run the following command to initialise the PPP adaptor: echo “c vpn” > /var/run/xl2tpd/l2tp-control

  6. Run ip list or ifconfig and you should see that a new PPP adapter has been created and assigned an IP address (this may not be instant, give it a few seconds). If the adaptor fails to come up run the script/command again – I’ve come across this issue a few times.

Note: If you change your configuration/IP settings etc you’ll need to reload the relevant configuration files i.e. /etc/init.d/ipsec restart and/or /etc/init.d/xl2tpd restart

Troubleshooting

I realise that VPN’s can be very troublesome (setting this challenge up was bad enough), so I have allowed access to auth and ufw logs. These should help highlight issues you may be experiencing and can be found at http://192.168.0.10:81 (note port 81). Please note that hacking this page and associated scripts are not part of the challenge, rather they have been provided for assistance.

A useful config reference can also be found here: https://wiki.archlinux.org/index.php/L2TP/IPsec_VPN_client_setup

Download Information

Architecture: x86 Format: VMware (vmx & vmdk) compatibility with version 4 onwards RAM: 1GB Network: NAT – Static IP 192.168.0.10 (no G/W or DNS configured) Extracted size: 1.57GB Compressed (download size): 368MB – 7zip format – 7zip can be obtained from here Download VulnVPN from -HERE-

MD5 Hash of VulnVPN.7z: 9568aa4c94bf0b5809cb0a282fffa5c2

Download Client files from -HERE-

MD5 Hash of client.7z: e598887f2e4b18cd415ea747606644f6

As per usual, I shall add a related solutions post shortly. Until then, enjoy

Source: http://www.rebootuser.com/?p=1307

more...

Main

The Broken Web Applications (BWA) Project produces a Virtual Machine running a variety of applications with known vulnerabilities for those interested in:

  • learning about web application security
  • testing manual assessment techniques
  • testing automated tools
  • testing source code analysis tools
  • observing web attacks
  • testing WAFs and similar code technologies

all the while saving people interested in doing either learning or testing the pain of having to compile, configure, and catalog all of the things normally involved in doing this process from scratch.

Source: http://owasp.com/index.php/OWASP_Broken_Web_Applications_Project

Release notes for the Open Web Application Security Project (OWASP) Broken Web Applications Project, a collection of vulnerable web applications that is distributed on a Virtual Machine in VMware format compatible with their no-cost and commercial VMware products.

More information about the project can be found at http://www.owaspbwa.org/.

The VM can be downloaded as a .zip file or as a much smaller .7z 7-zip Archive. BOTH FILES CONTAIN THE EXACT SAME VM! We recommend that you download the .7z archive if possible to save bandwidth (and time). 7-zip is available for Windows, Mac, Linux, and other Operating Systems.

!!! This VM has many serious security issues. We strongly recommend that you run it only on the "host only" or "NAT" network in the virtual machine settings !!!

Version 1.2 - 2015-08-03

  • Updated Mutillidae
  • Other miscellaneous, minor updates

Version 1.2rc1 - 2015-06-24

  • Updated Mutillidae and WAVSEP
  • Removed IP address restrictions on Mutillidae
  • Added script to rebuild WAVSEP
  • Added bWAPP application and script to automatically update bWAPP
  • Added OWASP Security Shepherd application and supporting scripts.
  • Likely updated other applications

Version 1.1.1 - 2013-09-27

  • Updated Mutillidae and transitioned to use its new Git repository
  • Fixed issue with Tomcat not starting in some circumstances

Version 1.1 - 2013-07-30

  • Updated Mutillidae, Cyclone, and WAVSEP
  • Updated OWASP Bricks and configured it to pull from SVN
  • Fixed ModSecurity CRS blocking and rebuilt ModSecurity to include Lua support
  • Increased VM's RAM allocation to 1Gb
  • Set Tomcat to run as root (to allow some traversal issues tested by WAVSEP)
  • Updated landing page for OWASP 1-Liner to reflect that the application is not fully functional

Version 1.1beta1 - 2013-07-10

  • Added new applications: OWASP 1-liner, OWASP RailsGoat, OWASP Bricks, SpiderLabs "Magical Code Injection Rainbow", Cyclone
  • Updated Mutillidae (name, version, and to use new SVN repository)
  • Updated DVWA to new Git repository
  • Added SSL support to web server
  • Updated ModSecurity and updated Core Rule Set to current in Git
  • Known issues:
  • ModSecurity CRS blocking does not work
  • OWASP 1-liner application appears to have functional issues (it was heavily modified to run on the VM through Apache)
  • Other new applications have not been fully tested
  • User Guide has not been updated

Version 1.0 - 2012-07-24

  • Added new application: WIVET (http://code.google.com/p/wivet/)
  • Updated WAVSEP, Mutillidae, Vicnum
  • Created new category for "Applications for Testing Tools", containing OWASP ZAP WAVE, WIVET, and WAVSEP
  • Major update to User Guide at http://code.google.com/p/owaspbwa/wiki/UserGuide. Removed some other project Wiki pages that were incorporated into User Guide.
  • More improvements to index.html

Version 1.0rc2 - 2012-07-14

  • Added new application: WAVSEP (http://code.google.com/p/wavsep/)
  • Updated WebGoat.NET, WebGoat (Java), and other applications from source repositories. Updated Mutillidae.
  • Removed links to OWASP ESAPI SwingSet (non-Interactive). That application has been deprecated and replaced by the SwingSet Interactive.
  • Changed version numbers in index.html to better indicate applications that are updated from public SVN or GIT repositories.
  • Layout improvements to index.html file (layout could still use some work).
  • Fixed bugs in Yazd (may have been present in 1.0rc1 or before)
  • Changes MySQL configuration to store database and table names as lower case (facilitates use of software written on Windows that may not strictly adhere to one case for identifiers)

Version 1.0rc1 - 2012-04-04

  • Added new applications:
  • Added OWASP WebGoat.NET (https://www.owasp.org/index.php/Category:OWASP_WebGoat.NET)
  • Added OWASP ESAPI SwingSet (https://www.owasp.org/index.php/ESAPI_Swingset)
  • Added OWASP ESAPI SwingSet Interactive (https://www.owasp.org/index.php/ESAPI_Swingset)
  • Added Jotto (from OWASP Vicnum project - http://www.owasp.org/index.php/Category:OWASP_Vicnum_Project)
  • Updated applications: Mutillidae, WebGoat (Java), ModSecurity, ModSecurity Core Rule Set, BodgeIt, OWASP ZAP WAVE, Damn Vulnerable Web Application, WackoPicko
  • Added owaspbwa-*-rebuild.sh scripts to build and deploy applications from source (WebGoat, Yazd, CSRFGuard Test Apps, SwingSet Apps)
  • Added owaspbwa-update-*.sh scripts to automatically pull updates from source repositories (OWASP BWA only and for all applications)
  • Cleaned up installations of WebGoat and Yazd
  • Fixed issue with PHP configuration to allow Remote File Include (RFI) vulnerabilities.
  • Created User Guide at http://code.google.com/p/owaspbwa/wiki/UserGuide (not yet complete).

Version 0.94 - 2011-07-24

  • No changes from 0.94rc3.

Version 0.94rc3 - 2011-07-14

  • More fixes to hackxor applications (thanks again to Albino Wax).

Version 0.94rc2 - 2011-07-13

  • Fixes to hackxor applications (thanks to Albino Wax for fixes).

Version 0.94rc1 - 2011-07-11

  • Added a number of new applications, including Gruyere, Hackxor, WackoPicko, BodgeIt, TikiWiki, Joomla, Gallery2, WebCalendar, AWStats, and ZAP-Wave (thanks to Mike Cyr for lots of work in this area).
  • New and improved "home" page in the VM (thanks again to Mike Cyr).

Version 0.93rc1 - 2011-01-19

  • Rebuilt OrangeHRM database to fix login issue (thanks to Dave van Stein for reporting this)
  • Configured mod_proxy on Apache web server to reverse proxy applications running on Tomcat web server. Disabled direct access to Tomcat server
  • Installed ModSecurity to 2.5.13 from source (needed by Core Rule Set)
  • Configured the ModSecurity Core Rule Set. It is disabled by default, but can be enabled through the use of new shell scripts in /usr/local/bin
  • Adjusted Samba shares to follow symlinks
  • Removed some miscellaneous old / duplicate files
  • Attempted to fix phpBB issues, but was unsuccessful. That application is broken for this release and marked as such in the index.html file (thanks to Dave van Stein for reporting this issue)

Version 0.92rc2 - 2010-11-15

  • Fixed bug with MySQL databases not starting properly (thanks to Tom Neaves for reporting this)

Version 0.92rc1 - 2010-11-10

  • Developed method for tracking known issues in the applications at http://sourceforge.net/apps/trac/owaspbwa/report/1.
  • Updated base OS to Ubuntu 10.04 LTS
  • Updated DVWA to SVN version > 1.07
  • Updated Mutillidae to version 1.5
  • Updated WebGoat to SVN version > 5.3
  • Added and configured three "real" applications suggested by Matt Tesauro:
  • Added application: GetBoo version 1.04 (http://sourceforge.net/projects/getboo/files/)
  • Added application: GTD-PHP version 0.7 (http://sourceforge.net/projects/gtd-php/files/)
  • Added application: OrangeHRM version 2.4.2 (http://www.orangehrm.com/)
  • Fixed bug in DVWA database permissions that was preventing stored XSS from working (thanks to Owen Wright for reporting this)

Version 0.91rc1 - 2010-03-24

  • Updated OWASP Vicnum to version 1.4 (http://www.owasp.org/index.php/Category:OWASP_Vicnum_Project)
  • Added application: Ghost (http://webdevelopmentsolutions.org/)
  • Added application: Peruggia version 1.2 (http://peruggia.sourceforge.net/)
  • Added application: OWASP AppSensor Demo (http://www.owasp.org/index.php/Category:OWASP_AppSensor_Project)
  • Fixed bug where VM would sometimes not get an address from DHCP on boot
  • Fixed bug where PHP magic quotes were enabled for some applications, preventing SQL Injection
  • Changed password for some applications to match standard users named 'admin' and 'user' with the password the same as the username
  • Moved databases, applications that run on Apache web server, some configuration files, and some applications that run on Tomcat web server into SVN with symlinks to the SVN directory in the normal file system.
  • Fixed bug in where permissions on /var/www/dvwa were not set properly (thanks to Dale Castle for reporting this)

Version 0.9 - 2009-11-11

  • Initial Release
more...