OWASP - User contributions [en]

OWASP Vulnerable Web Applications Directory Project/Pages/Offline

2019-11-26T19:05:33Z

Abhi M Balakrishnan: Added Alert Labs

{| border="1" width="80%" cellspacing="0" cellpadding="2"
|-
! scope="col" | App Name / Link
! scope="col" | Technology
! scope="col" | Other links
! scope="col" | Author
! scope="col" | Notes
|-
|[https://github.com/Abhi-M/alert-labs Alert Labs]
|PHP
|[https://exploitme.info/alert-labs/ demo] [https://github.com/Abhi-M/alert-labs/archive/master.zip download] [https://exploitme.info/alert-labs/user-guide.php docs]
|Abhi M Balakrishnan
|Focusing only on XSS
|-
| [https://github.com/CSPF-Founder/btslab/ btslab]
| PHP
|
|
| Includes flash-based xss, SSRF, and SSI
|-
| [http://www.badstore.net/ BadStore]
| Perl(CGI)
|
|
|
|-
| [http://code.google.com/p/bodgeit/ BodgeIt Store]
| Java
| [http://code.google.com/p/bodgeit/downloads/list download]
|
|
|-
| [http://sechow.com/bricks/index.html Bricks]
| PHP
| [http://sechow.com/bricks/download.html download] [http://sechow.com/bricks/docs/ docs]
| OWASP
|
|-
| [http://sourceforge.net/projects/thebutterflytmp/files/ButterFly%20Project/ Butterfly Security Project]
| PHP
| [http://sourceforge.net/projects/thebutterflytmp/files/ download]
|
| Last updated in 2008
|-
| [http://www.itsecgames.com/ bWAPP]
| PHP
| [http://sourceforge.net/projects/bwapp/files/ download] [http://itsecgames.blogspot.be/2013/01/bwapp-installation.html docs]
|
|
|-
| [https://github.com/fridaygoldsmith/bwa_cyclone_transfers Cyclone Transfers]
| Ruby on Rails
|
|
|
|-
| [https://github.com/quantumfoam/DVNA/ Damn Vulnerable Node Application - DVNA]
| Node.js
| [https://github.com/quantumfoam/DVNA/ download]
| Claudio Lacayo
|
|-
| [http://www.dvwa.co.uk/ Damn Vulnerable Web Application - DVWA]
| PHP
| [http://code.google.com/p/dvwa/downloads/list download]
| RandomStorm
|
|-
| [http://dvws.secureideas.net/ Damn Vulnerable Web Service - DVWS]
| PHP
| [http://dvws.secureideas.net/downloads/files/dvws.tgz download]
| Secure Ideas (depriciated?)
|
|-
| [https://github.com/snoopysecurity/dvws Damn Vulnerable Web Services - DVWS]
| PHP
|
| snoopysecurity
|
|-
| [https://github.com/secvulture/dvta Damn Vulnerable Thick Client App - DVTA]
| C# .NET
|
| secvulture
|
|-
| [http://google-gruyere.appspot.com/ Gruyere]
| Python
| [http://google-gruyere.appspot.com/gruyere-code.zip download]
| Google
|
|-
| [https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project Hackademic Challenges Project]
| PHP
| [https://code.google.com/p/owasp-hackademic-challenges/ download]
| OWASP
|
|-
| [https://github.com/rapid7/hackazon Hackazon]
|
|
| Rapid7
| Has some REST and new-school web components.
|-
| [http://www.mcafee.com/us/downloads/free-tools/hacme-bank-android.aspx Hacme Bank - Android]
|
|
| McAfee / Foundstone
|
|-
| [http://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx Hacme Bank]
| .NET
| [http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-bank.aspx download]
| McAfee / Foundstone
|
|-
| [http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx Hacme Books]
| Java
| [http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmebooks.aspx download]
| McAfee / Foundstone
|
|-
| [http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx Hacme Casino]
| Ruby on Rails
| [http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-casino.aspx download]
| McAfee / Foundstone
|
|-
| [http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx Hacme Shipping]
| ColdFusion
| [http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmeshipping.aspx download]
| McAfee / Foundstone
|
|-
| [http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx Hacme Travel]
| C++
| [http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmetravel.aspx download]
| McAfee / Foundstone
|
|-
| [http://hackxor.sourceforge.net/cgi-bin/index.pl hackxor]
|
|
|
| First 2 levels online, rest offline
|-
| [https://www.owasp.org/index.php/OWASP_Juice_Shop_Project Juice Shop]
| Node/JS
| [https://github.com/bkimminich/juice-shop download] [https://hub.docker.com/r/bkimminich/juice-shop/ docker] [https://www.gitbook.com/book/bkimminich/pwning-owasp-juice-shop guide]
| OWASP
|
|-
| [http://sourceforge.net/projects/lampsecurity/ LampSecurity]
| PHP
|
|
|
|-
| [http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10 Mutillidae]
| PHP
| [http://www.irongeek.com/mutillidae/ download]
|
|
|-
| [https://github.com/jerryhoff/WebGoat.NET .NET Goat]
| C#
| [https://github.com/jerryhoff/WebGoat.NET git repository]
| OWASP
|
|-
| [https://www.owasp.org/index.php/OWASP_Node_js_Goat_Project NodeGoat]
| Node.js
| [https://github.com/OWASP/NodeGoat git repository]
| OWASP
|
|-
| [http://peruggia.sourceforge.net/ Peruggia]
| PHP
| [http://sourceforge.net/projects/peruggia/files/ download]
|
|
|-
| [https://code.google.com/p/puzzlemall/ Puzzlemall]
| Java
| [https://code.google.com/p/puzzlemall/downloads/list download] [https://code.google.com/p/puzzlemall/downloads/list docs]
|
|
|-
| [https://www.owasp.org/index.php/OWASP_Rails_Goat_Project Rails Goat]
| Ruby on Rails
| [https://github.com/OWASP/railsgoat/archive/master.zip download] [http://railsgoat.cktricky.com/getting_started.html docs]
| OWASP
|
|-
| [http://suif.stanford.edu/%7Elivshits/securibench/ SecuriBench]
| Java
|
| Stanford
|
|-
| [http://suif.stanford.edu/%7Elivshits/work/securibench-micro/ SecuriBench Micro]
| Java
| [http://suif.stanford.edu/~livshits/securibench/download.html download]
| Stanford
|
|-
| [https://www.owasp.org/index.php/OWASP_Security_Shepherd Security Shepherd]
| Java
| [https://sourceforge.net/projects/owaspshepherd/ download]
| OWASP
|
|-
| [https://github.com/sqlmapproject/testenv SQL injection test environment]
| PHP
|
|
| SQLmap Project
|-
| [https://github.com/Audi-1/sqli-labs SQLI-labs]
| PHP
| [https://github.com/Audi-1/sqli-labs/archive/master.zip download] [http://dummy2dummies.blogspot.com/ blog]
|
|
|-
| [https://github.com/SpiderLabs/SQLol SQLol]
| PHP
| [https://github.com/SpiderLabs/SQLol/archive/master.zip download]
|
|
|-
| [https://github.com/SpiderLabs/SQLol SQLol]
| PHP
| [https://github.com/SpiderLabs/SQLol/archive/master.zip download]
|
|
|-
| [https://github.com/sakti/twitterlike twitterlike]
| PHP
| [https://github.com/sakti/twitterlike git repository]
| Sakti Dwi Cahyono
|
|-
| [http://www.nth-dimension.org.uk/blog.php?id=88 VulnApp]
| .NET
| [http://projects.nth-dimension.org.uk/dir?d=VulnApp CVS download] [http://projects.nth-dimension.org.uk/rptview?rn=6 vulns]
|
|
|-
| [http://exploit.co.il/hacking/exploit-kb-vulnerable-web-app/ Vulnerable Web App]
|
|
| Exploit.co.il
|
|-
|[https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Application Vulnerable Web Application Project]
|PHP
|[https://github.com/OWASP/Vulnerable-Web-Application Github]
|[https://github.com/hummingbirdscyber/ Hummingbirds Cyber Security Community]
|
|-
| [https://github.com/adamdoupe/WackoPicko WackoPicko]
| PHP
| [https://github.com/adamdoupe/WackoPicko/zipball/master download] [http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf whitepaper]
|
|
|-
| [https://github.com/sectooladdict/wavsep WAVSEP - Web Application Vulnerability Scanner Evaluation Project]
| Java
| [https://sourceforge.net/projects/wavsep/ download (builds)] [https://code.google.com/p/wavsep/downloads/list download (old)] [https://github.com/sectooladdict/wavsep/wiki wiki]
| Shay Chen
|
|-
| [https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project WebGoat]
| Java
| [http://code.google.com/p/webgoat/downloads/list download] [https://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents guide]
| OWASP
|
|-
| [https://www.owasp.org/index.php/WebGoatPHP WebGoatPHP]
| PHP
| [https://github.com/OWASP/OWASPWebGoatPHP download] [https://github.com/OWASP/OWASPWebGoatPHP/blob/master/README.md guide]
| OWASP
|
|-
| [https://code.google.com/p/wivet/ WIVET - Web Input Vector Extractor Teaser]
|
| [http://www.webguvenligi.org/projeler/wivet download] [https://code.google.com/p/wivet/downloads/list?can=1&q= tests]
|
|
|-
| [https://github.com/s4n7h0/xvwa Xtreme Vulnerable Web Application (XVWA)]
| PHP/MySQL
| [https://github.com/s4n7h0/xvwa download]
| @s4n7h0, @samanL33T
|
|-
|}

Talk:XSS Filter Evasion Cheat Sheet

2016-10-12T20:22:51Z

Abhi M Balakrishnan: /* Filter bypass based polyglot */

I can speak from being on the receiving end of XSS Evasion Attacks :)

http://blog.spiderlabs.com/2013/09/modsecurity-xss-evasion-challenge-results.html
http://blog.spiderlabs.com/2013/08/the-web-is-vulnerable-xss-on-the-battlefront-part-1.html

Essentially what we need to do is to consolidate a couple of key resources. The top two being -

HTML5Sec Vectors - https://raw.githubusercontent.com/cure53/H5SC/master/vectors.txt. These are taken from Mario's awesome work - http://html5sec.org/
Shazzer's Successful Fuzzes - https://raw.githubusercontent.com/client9/libinjection/master/data/xss-shazzer.txt. These are from Gareth's equally awesome work - http://shazzer.co.uk/home.

I would start with these two resources as the base and build from there.

-Ryan

'''Outdated Examples?'''

According to https://www.owasp.org/index.php/Script_in_IMG_tags and due to my own observations, it seems that the examples with <img src="..."> provided here are outdated and irrelevant. Means: they are only relevant to Browsers <=IE6 . This makes it hard to collect the relevant (test-)cases from this page and may make people think that an application is not xss save if it does not handle these cases (as it was in my case).
Can these examples either be removed or moved to a dedicated sub-chapter?
Or I am completely wrong?
- Markus

== ha.ckers.org Down ==

The ha.ckers.org site has been down for quite some time now, breaking the examples listed on the page. I've setup a mirror for these files, so the samples will work again. If ha.ckers.org ever comes back, the change to use the xss.rocks mirror can be reverted.

If anyone objects to this, please let me know. --[[User:Adam Caudill|Adam Caudill]] ([[User talk:Adam Caudill|talk]]) 18:43, 3 March 2016 (CST)

== %tag ==

I searched online with <tt>"%tag" internet explorer</tt>, saw an example in [https://archive.org/stream/TheBrowserHackersHandbook2014/The%20Browser%20Hackers%20Handbook%202014_djvu.txt The Browser Hackers Handbook 2014] and a reference to the main article. I wonder if the main article should include the <tt><%tag style=xss:expression(alert(6))></tt> trick. Another article explained that IE ignored a possibility of code execution via the unexpected tag, http://real-hacker-network.blogspot.ca/2012/09/aspnet-cross-site-scripting.html --[[User:Eelgheez|Eelgheez]] ([[User talk:Eelgheez|talk]])
:: My attempt with <tt>%tag</tt> could not evade IE11's XSS filter. Oh well. --[[User:Eelgheez|Eelgheez]] ([[User talk:Eelgheez|talk]]) 17:14, 7 July 2016 (CDT)

== Filter bypass based polyglot ==

Why is this polyglot linking to a resource on a private website? (shellypalmer.com)
I believe it should link to localhost. In the case of a successful execution of the payload, the referrer header will get listed on the logs of shellypalmer.com

[[User:Abhi M Balakrishnan|Abhi M Balakrishnan]] ([[User talk:Abhi M Balakrishnan|talk]])

Talk:XSS Filter Evasion Cheat Sheet

2016-10-12T20:22:29Z

Abhi M Balakrishnan: /* Filter bypass based polyglot */ new section

OWASP Bricks

2015-01-21T12:07:05Z

Abhi M Balakrishnan:

File:OWASP Bricks Mora.jpg

2013-11-16T02:46:06Z

Abhi M Balakrishnan:

Projects/OWASP Bricks/Releases/Mora

2013-11-16T02:45:29Z

Abhi M Balakrishnan: Created page with "{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude> | project_name = OWASP Bricks | project_home_page = OWASP Bricks | release_name = Mora | rel..."

{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude>
| project_name = OWASP Bricks
| project_home_page = OWASP Bricks
| release_name = Mora
| release_date = 16/11/2013
| release_description =

'''This is the 12th public release.'''

| release_license = [http://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0]
| release_download_link = http://sechow.com/bricks/download.html

| leader_name1 = Abhi M Balakrishnan
| leader_email1 = abhi@getmantra.com
| leader_username1 = Abhi_M_Balakrishnan

| release_notes = http://owaspbricks.blogspot.com/2013/11/owasp-bricks-21-mora-release.html

}}

==Screenshot==
[[Image:OWASP Bricks Mora.jpg|600px|OWASP Bricks Mora]]

Projects/OWASP Bricks/Releases/Current

2013-11-16T02:43:43Z

Abhi M Balakrishnan:

{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude>

| project_name = OWASP Bricks

| project_home_page = OWASP Bricks

| release_name = Mora

| release_date = 16 November 2013

| release_description = 12th public release

| release_license = [http://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0]

| release_download_link = http://sechow.com/bricks/download.html

| leader_name1 = Abhi M BalaKrishnan
| leader_email1 = abhi@getmantra.com
| leader_username1 = Abhi_M_Balakrishnan

| release_notes = http://owaspbricks.blogspot.com/2013/11/owasp-bricks-21-mora-release.html
}}

OWASP Bricks

2013-11-16T02:36:13Z

Abhi M Balakrishnan:

[[Image:OWASP Bricks logo.png|400px|OWASP Bricks]] 
<div style="font-size:112%;border:none;margin: 0;color:#000;">
* Bricks is a deliberately vulnerable web application built on PHP and MySQL.
* The project focuses on variations of commonly seen application security vulnerabilities and exploits.
* Each 'brick' has some sort of vulnerability which can be exploited using tools (Mantra and ZAP).
* The mission is to 'break the bricks' and thus learn the various aspects of web application security. 

'''[http://sechow.com/bricks/download.html Download Bricks] | [https://www.youtube.com/OWASPBricks Watch videos] | [http://sechow.com/bricks/docs/ Documentation] 
= Bricks =

{| class="wikitable"
|-
! Challenge
! Page
! URL
! Documentations
|-
| 1
| Log in page #1
| bricks/login-1/
| [http://sechow.com/bricks/docs/login-1.html Text], [http://www.youtube.com/watch?v=mCo6ajvBv50 Video]
|-
| 2
| File upload page #1
| bricks/upload-1/
| [http://sechow.com/bricks/docs/file-upload-1.html Text], [http://www.youtube.com/watch?v=N6SAzEkgJ3s Video]
|-
| 3
| Content page #1
| bricks/content-1/
| [http://sechow.com/bricks/docs/content-page-1.html Text], [http://www.youtube.com/watch?v=j5I0wPvQxTg Video]
|-
| 4
| Log in page #2
| bricks/login-2/
| [http://sechow.com/bricks/docs/login-2.html Text], [http://www.youtube.com/watch?v=nZYejElQxhk Video]
|-
| 5
| Content page #2
| bricks/content-2/
| [http://sechow.com/bricks/docs/content-page-2.html Text], [http://www.youtube.com/watch?v=7TkRBREYn6Y Video]
|-
| 6
| File upload page #2
| bricks/upload-2/
| [http://sechow.com/bricks/docs/file-upload-2.html Text], [http://www.youtube.com/watch?v=tsDClYorsXI Video]
|-
| 7
| Log in page #3
| bricks/login-3/
| [http://sechow.com/bricks/docs/login-3.html Text], [http://www.youtube.com/watch?v=Glsl-UR2OmU Video]
|-
| 8
| Content page #3
| bricks/content-3/
| [http://sechow.com/bricks/docs/content-page-3.html Text], [http://www.youtube.com/watch?v=qWpqZbymsl8 Video]
|-
| 9
| Log in page #4
| bricks/login-4/
| [http://sechow.com/bricks/docs/login-4.html Text], [https://www.youtube.com/watch?v=z4JUplVRG1U Video]
|-
| 10
| Content page #4
| bricks/content-4/
| [http://sechow.com/bricks/docs/content-page-4.html Text]
|-
| 11
| File upload page #3
| bricks/upload-3/
| [http://sechow.com/bricks/docs/file-upload-3.html Text]
|-
| 12
| Log in page #5
| bricks/login-5/
| [http://sechow.com/bricks/docs/login-5.html Text]
|-
| 13
| Content page #5
| bricks/content-5/
| [http://sechow.com/bricks/docs/content-page-5.html Text]
|-
| 14
| Login page #6
| bricks/login-6/
| Open for public
|-
|}
= Road map =
# Demonstrate maximum variations of most common vulnerabilities
# Help people to learn the need of secure codding practices and SSDLC
# Attract people to design more bricks
# Become a test bed for analyzing the performance of web application security scanners.
# Help people learn the manual method of testing the applications
# Demonstrate the possibilities of various security tools and techniques
# Become a platform to teach web application security in a class room/lab environment.
</div>
=Project About=
{{:Projects/OWASP_Bricks}}
[[Category:OWASP Project|Bricks]]
[[Category:OWASP Download|Bricks]]
[[Category:OWASP Tool|Bricks]]
[[Category:OWASP Alpha Quality Tool|Bricks]]

OWASP Bricks

2013-10-26T06:24:37Z

Abhi M Balakrishnan:

[[Image:OWASP Bricks logo.png|400px|OWASP Bricks]] 
<div style="font-size:112%;border:none;margin: 0;color:#000;">
* Bricks is a deliberately vulnerable web application built on PHP and MySQL.
* The project focuses on variations of commonly seen application security vulnerabilities and exploits.
* Each 'brick' has some sort of vulnerability which can be exploited using tools (Mantra and ZAP).
* The mission is to 'break the bricks' and thus learn the various aspects of web application security. 

'''[http://sechow.com/bricks/download.html Download Bricks] | [https://www.youtube.com/OWASPBricks Watch videos] | [http://sechow.com/bricks/docs/ Documentation] 
= Bricks =

{| class="wikitable"
|-
! Challenge
! Page
! URL
! Documentations
|-
| 1
| Log in page #1
| bricks/login-1/
| [http://sechow.com/bricks/docs/login-1.html Text], [http://www.youtube.com/watch?v=mCo6ajvBv50 Video]
|-
| 2
| File upload page #1
| bricks/upload-1/
| [http://sechow.com/bricks/docs/file-upload-1.html Text], [http://www.youtube.com/watch?v=N6SAzEkgJ3s Video]
|-
| 3
| Content page #1
| bricks/content-1/
| [http://sechow.com/bricks/docs/content-page-1.html Text], [http://www.youtube.com/watch?v=j5I0wPvQxTg Video]
|-
| 4
| Log in page #2
| bricks/login-2/
| [http://sechow.com/bricks/docs/login-2.html Text], [http://www.youtube.com/watch?v=nZYejElQxhk Video]
|-
| 5
| Content page #2
| bricks/content-2/
| [http://sechow.com/bricks/docs/content-page-2.html Text], [http://www.youtube.com/watch?v=7TkRBREYn6Y Video]
|-
| 6
| File upload page #2
| bricks/upload-2/
| [http://sechow.com/bricks/docs/file-upload-2.html Text], [http://www.youtube.com/watch?v=tsDClYorsXI Video]
|-
| 7
| Log in page #3
| bricks/login-3/
| [http://sechow.com/bricks/docs/login-3.html Text], [http://www.youtube.com/watch?v=Glsl-UR2OmU Video]
|-
| 8
| Content page #3
| bricks/content-3/
| [http://sechow.com/bricks/docs/content-page-3.html Text], [http://www.youtube.com/watch?v=qWpqZbymsl8 Video]
|-
| 9
| Log in page #4
| bricks/login-4/
| [http://sechow.com/bricks/docs/login-4.html Text], [https://www.youtube.com/watch?v=z4JUplVRG1U Video]
|-
| 10
| Content page #4
| bricks/content-4/
| [http://sechow.com/bricks/docs/content-page-4.html Text]
|-
| 11
| File upload page #3
| bricks/upload-3/
| Open for public
|-
| 12
| Log in page #5
| bricks/login-5/
| Open for public
|-
| 13
| Content page #5
| bricks/content-5/
| Open for public
|-
|}
= Road map =
# Demonstrate maximum variations of most common vulnerabilities
# Help people to learn the need of secure codding practices and SSDLC
# Attract people to design more bricks
# Become a test bed for analyzing the performance of web application security scanners.
# Help people learn the manual method of testing the applications
# Demonstrate the possibilities of various security tools and techniques
# Become a platform to teach web application security in a class room/lab environment.
</div>
=Project About=
{{:Projects/OWASP_Bricks}}
[[Category:OWASP Project|Bricks]]
[[Category:OWASP Download|Bricks]]
[[Category:OWASP Tool|Bricks]]
[[Category:OWASP Alpha Quality Tool|Bricks]]

Projects/OWASP Bricks

2013-10-26T06:23:54Z

Abhi M Balakrishnan:

File:OWASP Bricks Dakatua.jpg

2013-10-26T06:21:31Z

Abhi M Balakrishnan: Dakatua

Dakatua

Projects/OWASP Bricks/Releases/Dakatua

2013-10-26T06:20:59Z

Abhi M Balakrishnan: Dakatua

{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude>
| project_name = OWASP Bricks
| project_home_page = OWASP Bricks
| release_name = Dakatua
| release_date = 26/10/2013
| release_description =

'''This is the 11th public release.'''

| release_license = [http://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0]
| release_download_link = http://sechow.com/bricks/download.html

| leader_name1 = Abhi M Balakrishnan
| leader_email1 = abhi@getmantra.com
| leader_username1 = Abhi_M_Balakrishnan

| release_notes = http://owaspbricks.blogspot.com/2013/10/owasp-bricks-20-dakatua-release.html

}}

==Screenshot==
[[Image:OWASP Bricks Dakatua.jpg|600px|OWASP Bricks Dakatua]]

Projects/OWASP Bricks/Releases/Current

2013-10-26T06:19:50Z

Abhi M Balakrishnan: Dakatua

{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude>

| project_name = OWASP Bricks

| project_home_page = OWASP Bricks

| release_name = Dakatua

| release_date = 26 Octber 2013

| release_description = 11th public release

| release_license = [http://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0]

| release_download_link = http://sechow.com/bricks/download.html

| leader_name1 = Abhi M BalaKrishnan
| leader_email1 = abhi@getmantra.com
| leader_username1 = Abhi_M_Balakrishnan

| release_notes = http://owaspbricks.blogspot.com/2013/10/owasp-bricks-20-dakatua-release.html
}}

OWASP Bricks

2013-10-26T03:03:38Z

Abhi M Balakrishnan:

[[Image:OWASP Bricks logo.png|400px|OWASP Bricks]] 
<div style="font-size:112%;border:none;margin: 0;color:#000;">
* Bricks is a deliberately vulnerable web application built on PHP and MySQL.
* The project focuses on variations of commonly seen application security vulnerabilities and exploits.
* Each 'brick' has some sort of vulnerability which can be exploited using tools (Mantra and ZAP).
* The mission is to 'break the bricks' and thus learn the various aspects of web application security. 

'''[http://sechow.com/bricks/download.html Download Bricks] | [https://www.youtube.com/OWASPBricks Watch videos] | [http://sechow.com/bricks/docs/ Documentation] 
= Bricks =

{| class="wikitable"
|-
! Challenge
! Page
! URL
! Documentations
|-
| 1
| Log in page #1
| bricks/login-1/
| [http://sechow.com/bricks/docs/login-1.html Text], [http://www.youtube.com/watch?v=mCo6ajvBv50 Video]
|-
| 2
| File upload page #1
| bricks/upload-1/
| [http://sechow.com/bricks/docs/file-upload-1.html Text], [http://www.youtube.com/watch?v=N6SAzEkgJ3s Video]
|-
| 3
| Content page #1
| bricks/content-1/
| [http://sechow.com/bricks/docs/content-page-1.html Text], [http://www.youtube.com/watch?v=j5I0wPvQxTg Video]
|-
| 4
| Log in page #2
| bricks/login-2/
| [http://sechow.com/bricks/docs/login-2.html Text], [http://www.youtube.com/watch?v=nZYejElQxhk Video]
|-
| 5
| Content page #2
| bricks/content-2/
| [http://sechow.com/bricks/docs/content-page-2.html Text], [http://www.youtube.com/watch?v=7TkRBREYn6Y Video]
|-
| 6
| File upload page #2
| bricks/upload-2/
| [http://sechow.com/bricks/docs/file-upload-2.html Text], [http://www.youtube.com/watch?v=tsDClYorsXI Video]
|-
| 7
| Log in page #3
| bricks/login-3/
| [http://sechow.com/bricks/docs/login-3.html Text], [http://www.youtube.com/watch?v=Glsl-UR2OmU Video]
|-
| 8
| Content page #3
| bricks/content-3/
| [http://sechow.com/bricks/docs/content-page-3.html Text], [http://www.youtube.com/watch?v=qWpqZbymsl8 Video]
|-
| 9
| Log in page #4
| bricks/login-4/
| [http://sechow.com/bricks/docs/login-4.html Text], [https://www.youtube.com/watch?v=z4JUplVRG1U Video]
|-
| 10
| Content page #4
| bricks/content-4/
| [http://sechow.com/bricks/docs/content-page-4.html Text]
|-
| 11
| File upload page #3
| bricks/upload-3/
| Open for public
|-
| 12
| Log in page #5
| bricks/login-5/
| Open for public
|-
|}
= Road map =
# Demonstrate maximum variations of most common vulnerabilities
# Help people to learn the need of secure codding practices and SSDLC
# Attract people to design more bricks
# Become a test bed for analyzing the performance of web application security scanners.
# Help people learn the manual method of testing the applications
# Demonstrate the possibilities of various security tools and techniques
# Become a platform to teach web application security in a class room/lab environment.
</div>
=Project About=
{{:Projects/OWASP_Bricks}}
[[Category:OWASP Project|Bricks]]
[[Category:OWASP Download|Bricks]]
[[Category:OWASP Tool|Bricks]]
[[Category:OWASP Alpha Quality Tool|Bricks]]

Projects/OWASP Bricks

2013-10-05T06:56:07Z

Abhi M Balakrishnan:

File:OWASP Bricks Barak.jpg

2013-10-05T06:54:01Z

Abhi M Balakrishnan: http://owaspbricks.blogspot.in/2013/10/owasp-bricks-19-barak-release.html

http://owaspbricks.blogspot.in/2013/10/owasp-bricks-19-barak-release.html

Projects/OWASP Bricks/Releases/Barak

2013-10-05T06:51:42Z

Abhi M Balakrishnan: Barak

{{Template: <includeonly>{{{1}}}</includeonly><noinclude>Release About</noinclude>
| project_name = OWASP Bricks
| project_home_page = OWASP Bricks
| release_name = Barak
| release_date = 05/10/2013
| release_description =

'''This is the tenth public release.'''

| release_license = [http://www.apache.org/licenses/LICENSE-2.0 Apache License 2.0]
| release_download_link = http://sechow.com/bricks/download.html

| leader_name1 = Abhi M Balakrishnan
| leader_email1 = abhi@getmantra.com
| leader_username1 = Abhi_M_Balakrishnan

| release_notes = http://owaspbricks.blogspot.in/2013/10/owasp-bricks-19-barak-release.html

}}

==Screenshot==
[[Image:OWASP Bricks Barak.jpg|600px|OWASP Bricks Barak]]