xvwa - XVWA is a badly coded web application written in P

项目说明

Xtreme Web Application (XVWA)
=========================================
XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security. It’s not ad to host this application online as it is designed to be “Xtremely ”. We recommend hosting this application in local/controlled en and sharpening your application security ninja skills with any tools of your own choice. It’s totally legal to break or hack into this. The idea is to e web application security to the community in possibly the easiest and fundamental way. Learn and acquire these skills for good purpose. How you use these skills and knowledge base is not our responsibility.

!Image of XVWA Home Page

XVWA is designed to understand following security issues.

+ SQL Injection – Error Based
+ SQL Injection – Blind
+ OS Command Injection
+ XPATH Injection
+ Formula Injection
+ PHP Object Injection
+ Unrestricted File Upload
+ Reflected Cross Site Scripting
+ Stored Cross Site Scripting
+ DOM Based Cross Site Scripting
+ Server Side Request Forgery (Cross Site Port Attacks)
+ File Inclusion
+ Session Issues
+ Insecure Direct Object Reference
+ Missing Functional Le Control
+ Cross Site Request Forgery (CSRF)
+ Cryptography
+ Un Redirect & Forwards
+ Server Side Template Injection

Good Luck and Happy Hacking!

Disclaimer

Do not host this application on live or production en. XVWA is totally application and giving online/li of this application could lead to complete compromise of your system. We are not responsible for any such bad incidents. Stay safe !

Copyright

This work is licensed under GNU GENERAL PUBLIC LICENSE 3
To view a copy of this license, visit

Instructions

XVWA is hassle-free to setup. You can set this up on windows, linux or Mac. Following are the basic steps you should be doing on your Apache-PHP-MYSQL en to get this working. Let that be WAMP, XAMP or anything you prefer to use.

Manual Installation Method

Copy the x in your web directory. Make sure the directory name remains xvwa itself. Make necessary changes in x.php for database connection. Example below:

Please note that mysql 5.7 and abo sudoer to access root user. This means apache user will not be able to use 'root' username to access the database. In such cases, a new username would need to be created and config.php file would also need to be changed accordingly.

Make following changes in PHP configuration file

XVWA will be accessible at

Setup or reset the database and table here

The login details

Automatic Installation Script

I ha a small script to easily automates X in linux distributions. Run this with *root* to install the dependencies if not found in your linux en
>

Alternati En

Docker

I have also seen a multiple dockers published to setup XVWA. Our thanks to all of them. Any docker lovers can also checkout below work.

Live ISO

made XVWA live ISO on minimal Ubuntu server 14.04.x (issue27)

About

XVWA is intentionally designed with many security flaws and enough technical ground to upskill application security knowledge. This whole idea is to e web application security issues. Do let us know your suggestions for impro or any more you would like to see in X releases.

Authors:

项目信息

开发语言：PHP

Star 数：1763

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。