The BodgeIt Store - another vulnerable web app
psiinon <[email protected]>
| Newsgroups | gmane.comp.security.websecurity,gmane.comp.security.web-applications,gmane.comp.security.penetration,gmane.comp.security.basics,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <[email protected]> |
Hi folks, I've recently open sourced a vulnerable web app, called The BodgeIt Store: http://code.google.com/p/bodgeit/ Why? Well, you can never have too many vulnerable apps to test against, but also because I've found that many of the existing apps are non trivial to install - they either have a significant number of dependencies, are restricted to specific platforms, require dbs to be set up etc etc. At the moment all of the vulnerabilities are pretty basic, so its not suitable for security ninjas ;) However you may find it useful if you give introductory training courses, which is what I use it for. The BodgeIt Store is: * Easy to install - just requires java and a servlet engine, e.g. Tomcat * Self contained (no additional dependencies other than to 2 in the above line) * Easy to change on the fly - all the functionality is implemented in JSPs, so no IDE required * Cross platform * Open source * No separate db to install and configure - it uses an 'in memory' db that is automatically (re)initialized on start up There is also a 'scoring' page where you can see various hacking challenges and whether you have completed them or not. In the relatively near future I'm hoping to add things like: * Ajax requests * More vulnerabilities (of course) Any feedback (or offers of help to develop it further;) would be appreciated. Many thanks, Psiinon _______________________________________________ The Web Security Mailing List WebSecurity RSS Feed http://www.webappsec.org/rss/websecurity.rss Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA WASC on Twitter http://twitter.com/wascupdates [email protected] http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org