Adding an Article on Owasp VulnerableApp

[preetkaran20]

Is your feature request related to a problem? Please describe. We are not having much articles about What is VulnerableApp, How it solves the problem for Scan Rule implementers, How to write a new Vulnerability for a Scan Rule and Need to add my experience on adding JWT related Vulnerabilities and Scanner using TDD approach.

Describe the solution you'd like Need to add an article at various platforms for promoting the application. we tried writing documentation but some how reach of documentation is quite less. so this task requires adding an article/blog on platforms like medium or others and referring them in our website/documentation under blogs sections. Website Link: sasanlabs.github.io/vulnerableapp/

[hexxdump]

I would like to give it a try

[preetkaran20]

Hi @hexxdump ,

Great, Will assign this task to you.

thanks, Karan

[preetkaran20]

@hexxdump For pointers please visit: https://sasanlabs.github.io/VulnerableApp/ , https://owasp.org/www-project-vulnerableapp/ Little history: The problem encountered was, there was an enhancement for adding scan rule for Mongo Injection in Owasp ZAP and one developer is implementing it but there are no vulnerable apps present for mongo injection so the developer has to write his own application and that code is thrown away as no one is maintaining it also no one know if that application has any bugs and same application can be utilised by other scanner too if that part of code is written to some project which is maintained. Hence that some project is Owasp VulnerableApp.

Now other things can be clearer from the documentation links mentioned above. @hemantgs please add if you have any other pointers.

thanks, Karan

[hexxdump]

thanks @preetkaran20. Let me go through the documentation and list down the advantages of VulnerableApp compared to the ones already present.

[hexxdump]

@preetkaran20, I have started writing about this, can you please take a look at the document and suggest any improvements? https://docs.google.com/document/d/1myOVcb8D4zdlsH_2gIFQm0_6VQMStGgb-YFLOKKxAQs/edit?usp=sharing

[preetkaran20]

@hexxdump please give me the access to the document.

thanks, Karan

[preetkaran20]

@hemantgs please review it. @hexxdump i have added some points.

[hexxdump]

@hemantgs , please review the below content:

An extensible Vulnerable Application for testing the Vulnerability scanning tools

Anyone working in the cyber security domain or starting with cyber security will be introduced to one or the other Vulnerable applications as their playground. These applications are used to understand each vulnerability and to learn about how to mitigate them. I was introduced to BWAPP(Buggy Web Application) and DVWA(Damn Vulnerable Web Application).

The great thing about these applications(BWAPP and DVWA) is that they cover a lot of vulnerabilities from the OWASP list of vulnerabilities. However, whenever the Vulnerability Scanner Tool developer has a new requirement to add a new scan rule or to modify an existing scan rule, these existing vulnerability scanning applications will not be able to help.

The existing vulnerable applications are not meeting the demands of developers of vulnerability scanning tools, the developers end up writing their own vulnerable applications to test their scanning tools and those applications are not reviewed or maintained. They are usually forgotten once the testing needs are met for the vulnerability scanning tool.

These apps should be reviewed and maintained, so that multiple vulnerability scanning tools could make effective use of these vulnerable applications. A tweet by OWASP ZAP project lead highlighting the lack off well maintained vulnerable applications targeting vulnerability scanning tools - https://twitter.com/psiinon/status/1293844526390480896

I came across a new vulnerable web Application, named VulnerableApp(https://sasanlabs.github.io/VulnerableApp/), which has taken care of the above concerns and it can be easily extended to add yet another vulnerable scenario into the web application. The major advantage of this VulnerableApp is that developers need not spend extra effort in writing a new Vulnerable Application and have the new scenarios covered. VulnerableApp, since its open source application and its constantly being reviewed and updated, it can be used by various scanning tools.

VulnerableApp can be extended to include new code to test any new scan rule in the development. Scanner Tool development teams can leverage this property to have a TDD(test driven development) model, where the application should have the vulnerable code first, before a scan rule is written to identify the vulnerability.

All the new code that's added to the VulnerableApp will serve as the database of possible vulnerabilities and these can be used for learning/training or benchmarking a scanning tool or it can even be used for organizing CTFs. Currently, this application is developed using Java8, Spring Boots and Vanilla Javascript. It can be extended to use other technologies in future.

It also has various ways to deploy it, as a docker container or as an executable(jar file) or we can build the application and deploy it locally. To extend the VulnerableApp to include a new vulnerability or to modify the existing vulnerability, the below documentation link can be referred :https://sasanlabs.github.io/VulnerableApp/DesignDocumentation.html

VulnerableApp is also listed as an incubating project under owasp.org as a tool for scanning vulnerabilities: https://owasp.org/www-project-vulnerableapp/

[preetkaran20]

@hexxdump Everything seems very good in this writeup. Please go ahead and add this article to various platforms. Also we wanted to add this write up to /docs/blogs/ directory. please add there.

thanks, Karan

[hexxdump]

@hexxdump Everything seems very good in this writeup. Please go ahead and add this article to various platforms. Also we wanted to add this write up to /docs/blogs/ directory. please add there.

thanks, Karan

https://hussaina-begum.medium.com/an-extensible-vulnerable-application-for-testing-the-vulnerability-scanning-tools-cc98f0d94dbc https://hussaina-begum.blogspot.com/2020/10/an-extensible-vulnerable-application.html

[preetkaran20]

@hexxdump can you please give me your Linkedin profile and twitter profile as we need to publicise the article.

@hemantgs can you please add a small link in linkedin/reddit about this article.

thanks, Karan

[preetkaran20]

Closing this issye as @hexxdump has solved this.