bugtraq - The BodgeIt Store - another vulnerable web app

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BANLkTimqnd8RLgt_pF3tcMgSZibQhmCbgQ@mail.gmail.com>
Date: Thu, 14 Apr 2011 04:10:01 +0100
From: psiinon <psiinon@...il.com>
To: websecurity@...appsec.org, webappsec@...urityfocus.com,
	pen-test@...urityfocus.com, security-basics@...urityfocus.com,
	bugtraq@...urityfocus.com
Subject: The BodgeIt Store - another vulnerable web app

Hi folks,

I've recently open sourced a vulnerable web app, called The BodgeIt Store:
http://code.google.com/p/bodgeit/

Why?

Well, you can never have too many vulnerable apps to test against, but
also because I've found that many of the existing apps are non trivial
to install - they either have a significant number of dependencies,
are restricted to specific platforms, require dbs to be set up etc
etc.

At the moment all of the vulnerabilities are pretty basic, so its not
suitable for security ninjas ;)
However you may find it useful if you give introductory training
courses, which is what I use it for.

The BodgeIt Store is:
   * Easy to install - just requires java and a servlet engine, e.g. Tomcat
   * Self contained (no additional dependencies other than to 2 in the
above line)
   * Easy to change on the fly - all the functionality is implemented
in JSPs, so no IDE required
   * Cross platform
   * Open source
   * No separate db to install and configure - it uses an 'in memory'
db that is automatically (re)initialized on start up

There is also a 'scoring' page where you can see various hacking
challenges and whether you have completed them or not.

In the relatively near future I'm hoping to add things like:
  * Ajax requests
  * More vulnerabilities (of course)

Any feedback (or offers of help to develop it further;) would be appreciated.

Many thanks,

Psiinon