gnh1201/Vulnerable-Web-Application
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: gnh1201:master
Branches Tags
gnh1201:master
gnh1201:add-license-1
..
compare: gnh1201:add-license-1
Branches Tags
gnh1201:master
gnh1201:add-license-1

No commits in common. "master" and "add-license-1" have entirely different histories.
master ... add-licens

3 changed files with 12 additions and 40 deletions
Show Stats Expand all files Collapse all files

1
CommandExecution/commandexec.html
View File

@ -15,7 +15,6 @@
<button class="button" type="button" name="comex2Button" onclick="location.href='CommandExec-2.php';">Command Execution Level 2</button>
<button class="button" type="button" name="comex3Button" onclick="location.href='CommandExec-3.php';">Command Execution Level 3</button>
<button class="button" type="button" name="comex4Button" onclick="location.href='CommandExec-4.php';">Command Execution Level 4</button>
<p align="center">NOTE: The purpose here is to find flags and roads to be used. Paste the paths to the URL is not a solution.</p>
</div>
</link>
<img src="../Resources/hmb.png" align="left" style="width:40%" alt="HummingbirdsCyberTeam">

3
FileInclusion/pages/2.php
View File

@ -3,8 +3,7 @@
<p>
<div align="center"><b><h1> Did you notice anything changed? Browse the site.</h1></b></div>
<!-- "There are 2 hints under the File Inclusion folder. They should be there -> " <!-->
<!-- "Hint1 : FileInclusion\pages\dontOpen\hint1.php <!-->
<!-- "Hint1 : FileInclusion\pages\dontOpen\hint1 <!-->
<!-- "Hint2 : FileInclusion\hint2\hint2.php" <!-->
<!-- "Paste the paths to the URL is not a solution!!" <!-->
</body>
</html>

48
README.md
View File

@ -1,17 +1,8 @@
# Vulnerable Web Application
# Vulnerable Web Application V1.0
![VulnWeb](https://github.com/OWASP/Vulnerable-Web-Application/blob/master/Resources/VulnWeb.png)
![VulnWeb](https://github.com/hummingbirdscyber/Vulnerable-Web-Application/blob/master/Resources/VulnWeb.png)
## What is Vulnerable-Web-Application
Vulnerable-Web-Application is a website that is prepared for people who are interested in web penetration and who want to have
information about this subject or to be working. In fact, the website is quite simple to install and use.
Vulnerable-Web-Application categorically includes Command Execution, File Inclusion, File Upload, SQL and XSS. For database-requiring
categories, it creates a database under localhost with one button during setup. In case of corrupted or changed databases, you can
create a database again.
## Installation Guide
<h2>Installation Guide</h2>
If you want to run this tool, first of all you need to download web server solution like "xampp"- you can download xampp from
[Xampp](https://www.apachefriends.org/tr/download.html). After your installation;
@ -23,32 +14,15 @@ For Mac Os you need to install mampp and copy the files into the mamp/htdocs f
For Linux after download our files first you need to open apache server and copy the files to /var/www/html
## Docker Container
You can also run the **Vulnerable Web Application** in Docker with the folowing command:
<b>Other Configurations:</b>
```
docker run -it --name vuln_app -p 9991:80 santosomar/vuln_app:latest /bin/bash
```
**Note**: You can change the port 9991 to any port you desire depending your implementation.
The php.ini file should be altered. You can find the location of your php.ini file under the folder which php is installed.
* allow_url_include = on - Allows for Remote File Inclusion
* allow_url_fopen = on - Allows for Remote File Inclusion
* safe_mode = off - (If PHP <= v5.4) Allows for SQL Injection
* magic_quotes_gpc = off - (If PHP <= v5.4) Allows for SQL Injection
### Other Configurations:
<b>Installation</b>
The `php.ini` file should be altered. You can find the location of your `php.ini` file under the folder which php is installed.
- `allow_url_include` = on - Allows for Remote File Inclusion
- `allow_url_fopen` = on - Allows for Remote File Inclusion
- `safe_mode` = off - (If PHP <= v5.4) Allows for SQL Injection
- `magic_quotes_gpc` = off - (If PHP <= v5.4) Allows for SQL Injection
After all these configurations, firstly, open Xampp Control Panel and start Apache,MySQL. Your MySQL credentials have to be default.<b>[username:root <-> password:""]</b> Then open up our index.php file in the <b>Vulnerable Web Application</b> directory. Follow the directions and create database. If you messed up with database, you can reset the database. If database is ready, you can go to homepage and start hacking.
## Application Setup
- After editing the previous configuration, open the Xampp Control Panel and start Apache,MySQL.
- Your MySQL credentials must stay the default credentials (e.g., username:root <-> password:"")
- Open up the `index.php` file in the <b>Vulnerable Web Application</b> directory. Follow the directions and create database.
**Note**: You can reset the database at any time, if needed or if you run into any problems. Once the database is ready, you can go to homepage and start hacking.
## License
The contents of this repository are licensed under the GNU General Public License v3.0.
## Version
1.0.0