Mutillidae: A Deliberately Vulnerable Set Of PHP Scripts That Implement The OWASP Top 10
As I figure most people
reading this know, I make infosec tutorial videos for my site
Irongeek.com. I wanted to start covering more
web application pen-testing tools and concepts in some of these videos. Of
course, I need a vulnerable web app or two to use for these demos. I dig
WebGoat,
but sometimes it's a little hard to figure out exactly what they want you to do
to exploit a given web application. Also, WebGoat may be a little too complex to
use when introducing a web programming newbie to web application security (it's
easy to get lost in the code, especially J2EE). In an attempt to have something
to use as a demo in my videos and in class, I started the Mutillidae project.
What I'm attempting to do with
Mutillidae is implement the
OWASP Top 10
in PHP, and do it in such a way that it is easy to demonstrate common attacks to
others. Feel free to use it in your own classes or videos, but if you do I'd
love to hear about it. Many web app hobbyists and professionals used PHP, and
it's pretty easy to pick up the basics of the language. The Mutillidae webpage
is a set of related simple PHP scripts meant to illustrate the core concepts of the
OWASP Top 10
vulnerabilities list. For the sake if teaching core concepts, I plan to implement all
of the OWASP Top 10 vulnerabilities, in multiple ways (but I could always use some
help, especially in writing the hints sections).
Here are the core goals of the Mutillidae project:
1. Make the code and examples simple to understand so as to get the point across of
how a given vulnerability works. With
some of the stuff in Webgoat it is s a little hard to figure how to exploit the
code, Mutillidae almost exploits itself. My app won't be very realistic, but
it should illustrate the core concepts well.
2. Be geared in such a way that it's easy to update with new modules and hints.
3. Easy to install and run. Just download XAMPP Lite for Windows or Linux, put the scripts in the htdocs directory, and click the "Setup/reset the DB" link in the main menu .
4. When folks find bugs in my crappy code, I can legitimately say it's a feature. :)
Go to the OWASP Top 10 page to read about a vulnerability, then choose it from the list on the left to try it out. Feel free to play with the code and fix the vulnerabilities, it can be very educational. Most of the scripts are vulnerable to more than just one of the OWASP Top 10, so I organized them by their OWASP names in the menu system.
To install: Simply extract the files somewhere in the htdocs folder of XAMPP (for example htdocs/mutillidae), or run it from your Linux box after installing Apache/PHP/MySQL. Also, it should go with out saying that you should NOT run this code on a production network. Either run it on a private network, or restrict your web server software to only use the local loopback address.
If you would like to learn about other deliberately vulnerable web applications, check out my article on the subject:
Deliberately Insecure Web Applications For Learning Web App Security
If you would like to help with the project, please
contact me. Besides
just the code, I could also use help in writing the hints sections. Your name
and a link to your site will be added to the credits page.