A free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo

What?

Various web application security testing tools and vulnerable web applications were added to a clean install of Ubuntu v10.04.2, which is patched with the appropriate updates and VM additions for easy use.

Why?

The Web Security Dojo is for learning and practicing web app security testing techniques. It is ideal for self-teaching and skill assessment, as well as training classes and conferences since it does not need a network connection. The Dojo contains everything needed to get started – tools, targets, and documentation.

Where?

Download Web Security Dojo from http://sourceforge.net/projects/websecuritydojo/files/ .

How?

To install Dojo you first install and run VirtualBox 3.2 or later, then “Import Appliance” using the Dojo’s OVF file. We have PDF or YouTube for instructions for Virtualbox. As of version 1.0 a VMware version is also provided, as well as video install instructions

Who?

Sponsored by Maven Security Consulting Inc (performing web app security testing & training since 1996). Also, could be you! Web Security Dojo is an open source and fully transparent project, with public build scripts and bug trackers on Sourceforge .

More?

Look for Dojo videos on our YouTube channel at http://www.youtube.com/user/MavenSecurity Hack your way to fame and glory 1 with our security challenges posted at Reddit (http://www.reddit.com/r/WebSecChallenges/). [1. Fame and glory not included; void where prohibited by law]

Difficulty

Beginner

Details

This exercise explains how you can from a SQL injection gain access to the administration console. Then in the administration console, how you can run commands on the system.

What you will learn?

• SQL injection exploitation using UNION
• Cracking md5 hashed passwords
• Writing a PHP webshell

Difficulty

Intermediate

Details

After a short brute force introduction, this exercice explains the tampering of rack cookie and how you can even manage to modify a signed cookie (if the secret is trivial). Using this issue, you will be able to escalate your privileges and gain commands execution.

What you will learn?

• Rack Cookies tampering
• Writing small web scripts in Ruby
• Commands injection attack

Difficulty

Beginner

Details

This exercice explains how to perform a Linux host review, what and how you can check the configuration of a Linux server to ensure it is securely configured. The reviewed system is a traditional Linux-Apache-Mysql-PHP (LAMP) server used to host a blog.

What you will learn?

• System review
• Users review
• File system review
• Network review
• Services review

  _________                                    
 /   _____/ ___________   ____ _____    _____  
 \_____  \_/ ___\_  __ \_/ __ \\__  \  /     \ 
 /        \  \___|  | \/\  ___/ / __ \|  Y Y  \
/_______  /\___  >__|    \___  >____  /__|_|  / .VM.
        \/     \/            \/     \/      \/ 
----------------------------------------------------------------------------
|  cReaTeD....: sagi-                |  DaTe......: 12-11-10               |
|  oS.........: Windows XP Home/Pro  |  oBJecTiVe.: Get the local user's   |
|               SP2/3 x86            |              password               |
|  iNSTaLLeR..: g0tmi1k              |  GReeTZ....: #vulnhub               |
----------------------------------------------------------------------------

Source: readme.nfo

Difficulty

Beginner

Details

This exercise explains how you can exploit CVE-2008-1930 to gain access to the administration interface of a Wordpress installation.

What you will learn?

• Exploiting CVE-2008-1930
• Cookies manipulation
• Mis-use of signature

Difficulty

Beginner

Details

This exercise explains how you can from a SQL injection gain access to the administration console. Then in the administration console, how you can run commands on the system. If you didn't go through From SQL injection to shell, you should start there and move to this exercise later.

What you will learn?

• SQL injection exploitation using UNION
• Cracking md5 hashed passwords
• Modifying Apache behavior with .htaccess files
• Writing a PHP webshell

This is the latest of several releases that are part of the LAMP Security project. The other exercises can be found under the 'Capture the Flag' folder. Note the PDF doesn't include the target image. Download the CTF7plusDocs.zip to get the target image as well as the documentation (in PDF format).

Difficulty

Intermediate

Details

This exercice explains the interactions between Tomcat and Apache, then it will show you how to call and attack an Axis2 Web service. Using information retrieved from this attack, you will be able to gain access to the Tomcat Manager and deploy a WebShell to gain commands execution.

What you will learn?

• Axis2 Web service
• Writing a WebShell in JSP (Java)
• Attacking the Tomcat Manager