search

OWASP / OWASP-VWAD

The OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.
https://owasp.org/www-project-vulnerable-web-applications-directory/
Apache License 2.0
859 stars 219 forks source link

Add XXE Lab #152

Closed raulsiles closed 2 years ago

raulsiles commented 2 years ago

https://github.com/jbarone/xxelab

This vulnerable app, as well as the Log4j one in issue #148, can be a good reason to slightly change the "VM-ISO" category to add docker and/or containers.

The docker reference could be added to the title, "VM-IOS-Container", and to the "Technology(ies)" column: Docker.

kingthorin commented 2 years ago

@raulsiles @psiinon Do you thinks it's still worth maintaining distinction between Offline and VM-ISO (Container) ? Or given modern connectivity and the simplicity of grabbing VM Player or docker should we just lump them all as Offline?

psiinon commented 2 years ago

How about we have Offline and Container categories? I'd like to know which ones run in containers as for me those are much more useful...

kingthorin commented 2 years ago

Okay, I'll simply rename the VM-ISO category. At some future date I'll try to review the "offline" collection and make sure none of those are just dockerized apps (I'm not entirely sure I or others have always been careful with that, some will still be both I suppose.)

raulsiles commented 2 years ago

I agree. My main goal separating Offline and VM/ISO/Container always was to know that for Offline you will need to manually install or deploy the web application somehow in your own web server, web environment or VM/Cointainers, as for VM/ISO/Container you can easily run it out of the box (with no, or minimum, installation steps).

I also agree that some target apps can be in both, or even the three, categories, e.g. if an online version, a raw application version and a containerized version are offered. I would list them in the three categories, as someone (as an example) might be interested on testing something very quickly, so she only will go to the Online category (perhaps adding links or IDs between the three categories to easily identify they are the same app, but with a different distribution/deployment model).