OWASP Practice is a virtual environment to help people who want to begin their journey into web application security. Lots of material including videos are available on the Internet, both for free and for a fee, that teach web application security in a good manner. But this project has been started for the sole purpose of helping people to understand the basics behind vulnerability and gradually moving forward. OWASP Practice contains a learning environment which helps us to understand why and how vulnerabilities are triggered. This project or any other project alone cannot help anyone master everything. It just our contribution to the community. We were all beginners in this field at some point of time, and still we are in a continuous learning phase. We hope this project helps the community.

Coming back to “OWASP Practice”, OWASP released a list of top 10 vulnerabilities. “OWASP Top 10 Web Application Vulnerabilities 2013″ is one of the most popular projects by OWASP. The project starts with explaining every vulnerability in as easy words as possible, along with vulnerable demo applications and videos demonstrating the vulnerability in action.

OWASP Practice has been built with the OWASP Top 10 Web Application Vulnerabilities in mind. It is a virtual machine which hosts custom web applications which are vulnerable to OWASP Top 10 vulnerabilities. Every vulnerability has one or more practice lessons associated with it which can be used to exploit and trigger the vulnerability. Along with that, every lesson has a tutorial linked to it which can be accessed anytime to learn how the vulnerability is triggered and how to exploit it. Every lesson tutorial has screenshots in it for better understanding. Adding to the tutorials, videos demonstrating the vulnerabilities are also available for download separately.

Features of OWASP Practice:

  • Boot-to-Pwn VM with vulnerable web applications
  • Categorized lessons for OWASP vulnerabilities
  • Custom-made vulnerable practice lessons
  • Lessons covering everything from logic of vulnerability to how to trigger vulnerability
  • Tutorials explaining the vulnerability and its solution
  • Videos to demonstrate vulnerability in action
  • Source code and SQL file available

A few things that might come handy are:

  • Mozilla Firefox
  • Firefox Addons
  • Firebug
  • Live HTTP Headers
  • Tamper Data
  • User-Agent Switcher
  • Cookie Manager+
  • BurpSuite

Screenshots:

Main Page of OWASP Practice:

OWASP Top 10 Vulnerabilities:

XSS Vulnerability description and lessons:

One of the lessons of XSS vulnerability:

Want to learn more?? The InfoSec Institute Web Application Penetration Testing Boot Camp focuses on preparing you for the real world of Web App Pen Testing through extensive lab exercises, thought provoking lectures led by an expert instructor. We review of the entire body of knowledge as it pertains to web application pen testing through a high-energy seminar approach.

The Web Application Penetration Testing course from InfoSec Institute is a totally hands-on learning experience. From the first day to the last day, you will learn the ins and outs of Web App Pen Testing by attending thought provoking lectures led by an expert instructor. Every lecture is directly followed up by a comprehensive lab exercise (we also set up and provide lab workstations so you don't waste valuable class time installing tools and apps). Benefits to you are:

  • Get CWAPT Certified
  • Learn the Secrets of Web App Pen Testing in a totally hands-on classroom environment
  • Learn how to exploit and defend real-world web apps: not just silly sample code
  • Complete the 83 Step "Web App Pen Test Methodology", and bring a copy back to work with you
  • Learn how perform OWASP Top 10 Assessments: for PCI DSS compliance

Tutorial of XSS vulnerability:

Fill out the form below to for the OwaspPractice File Download: 

Downloads include:

  1. OwaspPractice Virtual Machine
  2. OwaspPractice Source Code and SQL file
  3. OwaspPractice Vulnerability Demo Videos

User Credentials:

Local User Accounts:

Username: root

Password: toor

Username: owasppractice

Password: owasppractice

Phpmyadmin:

Username: root

Password: NO_PASSWORD

Joomla Administrator:

Username: admin

Password: admin