Again, make sure to watch the video if you are blocked. Once you’ve connected to your Debian 9 guest machine, run the following commands. It allows you to discover and experiment with new tools, especially with the increasing number of open-source tools published everyday.

Knowing how to install packages is a good skill to have in your learning journey. I’ve included it here so that you know how to install Java on your machine. How to install OWASP Webgoat and WebWolf using the JARįeel free to skip this part if you’d like to use Docker in your OWASP Top 10 training. For now, I’ll assume that you already have a Debian 9 VM running on your favorite Virtualization software.

I explain how to setup one in my video on Youtube. For this reason, I a m going to start on a fresh Debian 9 VM on Virtualbox. I strongly discourage running it on your host machine. In fact, this is a great opportunity to learn how Docker can be used to setup a lab and learn web application hacking.ĭisclaimer: this is a deliberately vulnerable Web application. So it is very convenient for our OWASP Top 10 training. It is really handy for testing things like out-of-band attacks.īoth OWASP WebGoat and WebWolf are released as jar files, Docker images and, of course, source code. OWASP WebGoat comes with another web application called OWASP WebWolf, which makes it easy for you to host malicious files, receive emails and HTTP requests. It is well maintained and contains most of the OWASP Top 10 vulnerabilities. OWASP WebGoat is a deliberately insecure web application to test Java-based applications against common web application vulnerabilities. What is OWASP Webgoat and why using it for this OWASP Top 10 training? I will be adding more episodes to it as we progress on this training. Or, if you prefer videos, I created the OWASP Top 10 video training series just for you. All you have to do is follow the instructions on OWASP Zap or Burp Suite setup blog posts.

If you haven’t been following along from the beginning, it’s not too late. We are slowly but surely building out our OWASP Top 10 lab to start practicing how to exploit the OWASP Top 10 vulnerabilities. Today, you are going to learn how to install OWASP WebGoat and OWASP WebWolf using both java and Docker. Welcome back to the OWASP Top 10 training series.

Burp suite pro java version