Copilotfree, in-browser
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
OWASP's deliberately broken PHP app. Injection all the way to command execution.
Mutillidae is a deliberately vulnerable PHP and MySQL application maintained under the OWASP project. Every page is filed under an OWASP Top 10 category, so the menu doubles as a hunting map. It is a great follow-on to a simpler web box because the same bug class shows up in more than one place, which teaches you to recognize the pattern rather than memorize a single trick.
Your two objectives here: pull the user table out through (user), then make the run a command you supply ().
You are running this on your own machine. That is the only reason it is legal to attack it. Never point these techniques at an application you do not own or have written permission to test.
Docker and bring-your-own-VM boxes use proof revealed through the hints once you have genuinely completed the objective. Capture a flag by doing the work, then submitting the token. Phase B hosted machines will issue real per-instance flags planted on the target.
Spin the container up and load http://localhost:8080. If a banner warns that
the database is not built, click the link it offers to set up or reset the DB,
then reload. Confirm the security level at the top reads 0, and if it does not,
hit Toggle Security until it does. Now work the objectives below. Use the hints
if you stall; each one costs a few points, so try on your own first.
Spin this up locally with Docker, then attack it from your Kali box.
$docker run --rm -p 8080:80 citizenstig/nowaspThen hit it at http://localhost:8080/