{"id":13842797,"url":"https://github.com/tombstoneghost/TIWAP","last_synced_at":"2025-07-11T15:33:12.598Z","repository":{"id":43730966,"uuid":"387472005","full_name":"tombstoneghost/TIWAP","owner":"tombstoneghost","description":"Totally Insecure Web Application Project (TIWAP)","archived":false,"fork":false,"pushed_at":"2023-12-29T17:46:37.000Z","size":294,"stargazers_count":167,"open_issues_count":1,"forks_count":42,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-08-05T17:33:19.891Z","etag":null,"topics":["flask","hacking","infosec","mongodb","penetration-testing","pentesting","python","security","sqlite3","tiwap","training","web"],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tombstoneghost.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2021-07-19T13:21:53.000Z","updated_at":"2024-07-22T06:46:00.000Z","dependencies_parsed_at":"2023-12-29T18:37:12.748Z","dependency_job_id":null,"html_url":"https://github.com/tombstoneghost/TIWAP","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tombstoneghost%2FTIWAP","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tombstoneghost%2FTIWAP/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tombstoneghost%2FTIWAP/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tombstoneghost%2FTIWAP/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tombstoneghost","download_url":"https://codeload.github.com/tombstoneghost/TIWAP/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225737132,"owners_count":17516293,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["flask","hacking","infosec","mongodb","penetration-testing","pentesting","python","security","sqlite3","tiwap","training","web"],"created_at":"2024-08-04T17:01:46.464Z","updated_at":"2024-11-21T13:31:09.971Z","avatar_url":"https://github.com/tombstoneghost.png","language":"HTML","readme":"# Totally Insecure Web Application Project (TIWAP)\n\n![Forks](https://img.shields.io/github/forks/tombstoneghost/TIWAP?style=for-the-badge)\n![Stars](https://img.shields.io/github/stars/tombstoneghost/TIWAP?style=for-the-badge)\n![OpenIssues](https://img.shields.io/github/issues/tombstoneghost/TIWAP?style=for-the-badge)\n![ClosedIssues](https://img.shields.io/github/issues-closed/tombstoneghost/TIWAP?style=for-the-badge)\n![Languages](https://img.shields.io/github/languages/count/tombstoneghost/TIWAP?style=for-the-badge)\n![License](https://img.shields.io/github/license/tombstoneghost/TIWAP?style=for-the-badge)\n\n\n\nTIWAP is a web security testing lab made using Flask for budding security enthusiasts to learn about various web \nvulnerabilities. Inspired by DVWA, the contributors have tried their best to regenerate various web vulnerabilities\n\nThe application is solely made for educational purpose and to learn web hacking in a legal environment. \n\nRead more about it [here](https://singh-simardeepsingh99.medium.com/tiwap-3a8b70043ce9)\n\n## Disclaimer\n\nWe highly recommend installing the lab on a Virtual Machine instead of a live web server (Internal or External).\n\nWe do not take responsibility for the way in which anyone uses this application (TIWAP). \nThe application has been made for educational purpose only and should not be used maliciously. \nIf your web servers are compromised due to installation of this application, \nit is not our responsibility, it is the responsibility of the person/s who uploaded and installed it.\n\n\n## Setup and Installation\nTo keep the installation and setup easy, we have configured everything for you. All you need is Docker on your system.\n\nOnce you are done with docker installation, run the following commands. \n\n\u003e git clone https://github.com/tombstoneghost/TIWAP \u003cbr/\u003e\n\u003e cd TIWAP \u003cbr/\u003e\n\u003e docker-compose up\n\n\u003cstrong\u003eNote: It works only on Linux as of now and windows compatibility is work under progress \u003c/strong\u003e\n\nOnce the lab is started, you can log in using the default credentials.\u003cbr/\u003e\nUsername: `admin` \u003cbr/\u003e\nPassword: `admin`\n\n## Tech Stack\n\nFront-End: HTML, CSS and JavaScript \u003cbr/\u003e\nBack-End: Python - Flask \u003cbr/\u003e\nDatabases: SQLite3 and MongoDB\n\n## Vulnerabilities\n\nCurrently, we have 22 vulnerabilities in the lab. All listed below:\n\n- SQL Injection\n- Blind SQL Injection\n- NoSQL Injection\n- Command Injection\n- Business Logic Flaw\n- Sensitive Data Exposure\n- XML External Entities\n- Security Misconfiguration\n- Reflected XSS\n- Stored XSS\n- DOM Based XSS\n- HTML Injection\n- Improper Certificate Validation\n- Hardcoded Credentials\n- Insecure File Upload\n- Brute Force\n- Directory Traversal\n- Cross-Site Request Forgery (CSRF)\n- Server-Side Request Forgery (SSRF)\n- Server-Side Template Injection (SSTI)\n- JWT Token\n- Insecure Deserialization\n\nEach vulnerability is having 3 difficulty levels, namely Low, Medium and Hard. \nThese levels can be set from the settings page.\n\n\n## Bugs and Issues\n\nIf you find any bugs or issues with the project, kindly raise the same on the below link.\n\nhttps://github.com/tombstoneghost/TIWAP/issues\n\n## Contributors\n\n1. Simardeep Singh - [LinkedIn](https://www.linkedin.com/in/simardeepsingh99/) | [Twitter](https://twitter.com/simardeep99)\n2. Yash Giri -  [LinkedIn](https://www.linkedin.com/in/yashgiri/)\n3. Sakshi Aggarwal - [LinkedIn](https://www.linkedin.com/in/s4ksh1/) | [Twitter](https://twitter.com/s4ksh1)\n4. Xavier Llauca - [GitHub](https://github.com/xllauca)\n\n### Want to be a contributor? \n\n1. Star this repository\n2. Fork this repository\n3. Clone the forked repository\n4. Navigate to the project directory\n5. Create a new branch with your name\n6. Make changes\n7. Stage your changes and commit\n8. Push your local changes to remote\n9. Create a Pull Request\n10. Congratulations! You did it. \n\n## License \n\nThis project is under the MIT License - Click [here](https://github.com/tombstoneghost/TIWAP/blob/master/LICENSE) for details.\n\n\u003cstrong\u003eHappy Hacking! :)\u003c/strong\u003e\n\n","funding_links":[],"categories":["其他_安全与渗透","HTML"],"sub_categories":["网络服务_其他"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftombstoneghost%2FTIWAP","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftombstoneghost%2FTIWAP","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftombstoneghost%2FTIWAP/lists"}