You could give Damn Vulnerable Web App (DVWA) a go. But I am biased. :)

Ryan Dewhurst

blog www.ethicalhack3r.co.uk
projects www.dvwa.co.uk | www.webwordcount.com
twitter www.twitter.com/ethicalhack3r

On 25 March 2011 10:32, Paul Johnston paul.johnston@pentest.co.uk wrote:

On 03/25/2011 06:32 AM, Paul Johnston wrote:

Web Security Dojo is a VM we built for our training classes, and others
have found it useful.  It has tools, targets, and documentation all
pre-installed and configured.

http://dojo.mavensecurity.com

Other similar projects are:
OWASP broken Web Applications - Just targets, but has a different
selection then Dojo with more old versions of real apps.
http://code.google.com/p/owaspbwa/

Ultimate Lamp - Old insecure open source software
http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/

Moth - test environment for w3af, has their own test app and a few
broken apps. Built to use mod_security and/or PHP-IDS easily.
http://www.bonsai-sec.com/en/research/moth.php

I know there's other that escape me at the moment, but those are the
ones I've used on a regular basis.

Also, I've got a new version of Dojo cooking that should be out next
week with WAVSEP, ZAP WAVE, a bunch of ruby tools, and updates. WAVSEP
and ZAP WAVE were built as test environments for scanner tools, but have
more of the "fancy" cases of vulns to solve then the typical broken web
app. There's still not one best test app, which is why all the VMs have
a number of different apps to test with.

Hope that helps!

| Steven Pinkham, Security Consultant    |
| http://www.mavensecurity.com          |
| GPG public key ID CD31CAFB            |

G'day,

as a trainer / teacher in this area. There are  a couple of resources -
other than the brilliant materials on OWASP :') - that I have used / am
using.

There is a bunch of stuff across the IronGeek site (irongeek.com) that is
useful for intro work. "How to break web software" by Mike Andrews
(formerly of Foundstone, and then McAfee) and "The Web Application Hacker's
Handbook" (Stuttard and Pinto). As the people I am teaching are developers
(or are becoming developers) I also use "Beginning ASP.NET security" by
Barry Dorrans (from Microsoft UK) as well as the OWASP resources incl. and
esp. ESAPI and such.

Then there is a bunch of other stuff I have gathered in bits and pieces
over the years, including stuff from this list :)

Then there are all the little tools and nick-nacks like Firebug, Selenium,
ParosProxy, Netcat, httpprint, ssl-digger, telnet, and the list goes on...

Hopefully there is something to chew on :)

have fun,

.h

On Fri, 25 Mar 2011 10:32:14 +0000, Paul Johnston

paul.johnston@pentest.co.uk wrote:

Hi,
If they don't have hands on web application development experience, make
them develop some web applications. Then make them test and fix their own
applications.
I don't think someone can really understand the real case if he/she does
not know how a web application works, what might the code actually be like,
what should be done to fix the problem.

Regards
Serkan Özkan

On Fri, Mar 25, 2011 at 12:32 PM, Paul Johnston <paul.johnston@pentest.co.uk

On Sat, Mar 26, 2011 at 6:26 PM, Steve Pinkham steve.pinkham@gmail.com wrote:

My suggested starting point is VirtualBox + owaspbwa.googlecode.com
but tweak it's /etc/php5/apache2/php.ini
display_errors = On
error_reporting = E_ALL | E_STRICT
register_globals = On
allow_url_fopen = On
allow_url_include = On

My favorite is the Burp Pro tool and the PortSwigger Ltd "Web
Application Hacker's Handbook: Live Edition" training, but these have
a cost to them. The other expensive classes that I think could
probably be valuable are the ones offered by Aspect Security.

If you are sticking with free tools -- WATOBO, WhatWeb, inspathx,
Fiddler2 (with Watcher and x5s), wcsa.googlecode.com,
securetomcat.googlecode.com, OWASP Code Crawler, PHP RIPS,
AppCodeScan, Eclipse with LAPSE+, and VisualStudio (Trial) with
CAT.NET -- are you best bets. For consolidation of testing data, both
The Dradis Framework and Gremwell MagicTree can be essential,
especially when combined with Metasploit and nmap. I'll occasionally
use SHODAN, OpenVAS, or standalone tools like Josh Abraham's Fierce
when leveraging network penetration-testing data for my web
application penetration-testing efforts (most of this stuff is covered
in Chris McNab's Network Security Assessment, Second Edition book).
There are some interesting tools for exploitation and
post-exploitation besides just Metasploit (which always seems to be
integrating with other tools like sqlmap, fimap, XSSF, etc), and I
tend to like Havij, Cain, hashkill (and hashkiller.com, unrelated),
lfi_sploiter.py 1.2, lfimap, Yokoso, etc.

I prefer the Chrome Browser for application testing these days
(although I do not generally use it as my normal day-to-day browser),
but I run it with --disable-metrics --disable-metrics-reporting
--disable-databases --disable-ipv6 --disable-sync
--disable-sync-bookmarks --disable-nacl --disable-plugins. I also use
the following Extensions: Edit This Cookie, EXIF Viewer, Form Fuzzer,
KB SSL Enforcer, Proxy Switchy, Smooth Gestures (with File Protocols),
and Snap Links Lite.

Here's my "top 5" books:

1. The Art of Software Security Assessment
2. The Web Application Hacker's Handbook
3. Hunting Security Bugs
4. SQL Injection Attacks & Defenses
5. The ModSecurity Handbook

But if you're addicted to reading, then you also might want to check
out: Web Application Obfuscation:
'-/WAFs..Evasio?n..Filters//ale?rt(/Obfuscation?/)-', Beginning
ASP.NET Security (already mentioned), Ajax Security, Pro PHP Security:

Defenses, Seven Deadliest Web Application Attacks, 24 Deadly Sins of
Software Security: Programming Flaws and How to Fix Them, Hacking: The
Next Generation, SQL Server Forensic Analysis, Web Security Testing
Cookbook: Systematic Techniques to Find Problems Fast, Web 2.0
Security - Defending AJAX, RIA, AND SOA, Hacking Exposed Web 2.0: Web
2.0 Security Secrets and Solutions, Hacking Exposed Web Applications
Third Edition, and How to Break Web Software: Functional and Security
Testing of Web Applications. I feel that each of these books is unique
enough to cover something of interest.

Besides all of the authors and technical reviewers of the above books,
it's also good to follow the work of Cory Scott, Jim Manico, Chris
Schmidt, Mario Heiderich, Gareth Hayes, Pete Herzog, Brian Holyfield,
Bernardo Damele, Ferruh Mavituna, Roberto Salgado, Tate Hansen, Ryan
Barnett, and the work of SAMATE, OWASP, WASC, ISECOM, and
http://pentest.cryptocity.net.

I am looking forward to the new release of Web Security Dojo, but
currently prefer OWASPBWA. There is a lot out there to learn in web
app pen-testing, so it's best to stick to a game plan. I believed I
outlined the more important ones in my email, but others will have
their own likes and dislikes (which I think are often biased or
misguided). In this thread, it is clear that the authors of several
virtual machine learning environments want to push their own projects,
which is fine -- but it's really only convenient to have 1-2 guest VMs
running on your local laptop/desktop at any given time. I also think
that too many projects and tools take away the focus that is necessary
during the learning process.

Another example is this recent blog post --
http://resources.infosecinstitute.com/owasp-top-10-tools-and-tactics/
-- where the author suggests too many tools. For example, I don't
think that SQL Inject Me, ZAP, HackBar, Burp Suite Free Edition,
Tamper Data, Nikto/Wikto, Samurai WTF, FoxyProxy, W3AF, skipfish, or
Websecurify are really worth any discussion. I do not suggest using
Firefox as a testing platform: Chrome supports more efficient support
of DOM inspection and other performance optimizations.

I would say that mastery in WhatWeb, inspathx, and SHODAN will lead to
better early analysis efforts when pre-supposing black-box, or zero
knowledge testing (especially during the recon stage). The reason is
that the underlying platform and framework analysis should be
performed -- the pen-tester should learn how to create his or her own
idea of what Apache/IIS/nginx, PHP/ASP.NET/Tomcat configuration, etc
parameters and tweaks exist. The tester should be able to identify
existing open-source components in target web applications. Then, the
tester should download those components and find vulnerabilities in
them under the elicited configuration environment.

Cheers,
Andre

I would suggest

• http://google-gruyere.appspot.com/ (Google's hands-on tutorial on web defense)
• http://code.google.com/edu/security/index.html (Google's further video tutorials on the topic)

Best regards,
David

--
David Rajchenbach-Teller
CSO, MLstate

On Mar 27, 2011, at 10:56 PM, Andre Gironda wrote: