Setting up a web app pentesting lab

The Broken Web Application (BWA) is an OWASP project that provides a self-contained VM complete with a variety of applications with known vulnerabilities. The applications within this VM enable students to learn about web application security, practice and observe web attacks, and make use of penetration tools such as Burp.

To follow the recipes shown in this book, we will utilize OWASP's BWA VM. At the time of this writing, the OWASP BWA VM can be downloaded from https://sourceforge.net/projects/owaspbwa/files/.

Getting ready

We will download the OWASP BWA VM along with supportive tools to create our web app pentesting lab.

Software tool requirements

To complete this recipe, you will need the following:

• Oracle VirtualBox (https://www.virtualbox.org/wiki/Downloads)
  • Choose an executable specific to your platform
• Mozilla Firefox Browser (https://www.mozilla.org/en-US/firefox/new/)
• 7-Zip file archiver (https://www.7-zip.org/download.html)
• OWASP BWA VM (https://sourceforge.net/projects/owaspbwa/files/)
• Burp Proxy Community or Professional (https://portswigger.net/burp/)
• Oracle Java (https://www.java.com/en/download/)

How to do it...

For this recipe, you will need to download the OWASP BWA VM and install it by performing the following steps:

1. Click Download Latest Version from the OWASP BWA VM link provided earlier and unzip the file OWASP_Broken_Web_Apps_VM_1.2.7z.
2. You will be presented with a listing of several files, as follows:

3. All file extensions shown indicate the VM can be imported into Oracle VirtualBox or VMware Player/Workstation. For purposes of setting up the web application pentesting lab for this book, we will use Oracle VirtualBox.
4. Make a note of the OWASP Broken Web Apps-cl1.vmdk file. Open the VirtualBox Manager (that is, the Oracle VM VirtualBox program).
5. Within the VirtualBox Manager screen, select Machine | New from the top menu and type a name for the machine, OWASP BWA.
6. Set the type to Linux and version to Ubuntu (64-bit), and then click Next, as follows:

7. The next screen allows you to adjust the RAM or leave as suggested. Click Next.
8. On the next screen, choose Use an existing virtual hard disk file.
9. Use the folder icon on the right to select OWASP Broken Web Apps-cl1.vmdk file from the extracted list and click Create, as follows:

10. Your VM is now loaded in the VirtualBox Manager. Let's make some minor adjustments. Highlight the OWASP BWA entry and select Settings from the top menu.
11. Select the Network section in the left-hand pane and change to Host-only Adapter. Click OK.

12. Now let's start the virtual machine. Right-click then choose Start | Normal Start.

13. Wait until the Linux system is fully booted, which may take a few minutes. After the booting process is complete, you should see the following screen. However, the IP address shown will be different for your machine:

14. The information presented on this screen identifies the URL where you can access vulnerable web applications running on the VM. For example, in the previous screenshot, the URL is http://192.168.56.101/. You are given a prompt for administering the VM, but it is not necessary to log in at this time.
15. Open the Firefox browser on your host system, not in the VM. Using the Firefox Browser on your host machine, enter the URL provided (for example, http://192.168.56.101/), where the IP address is specific to your machine.

16. In your browser, you are presented with an index page containing links to vulnerable web applications. These applications will be used as targets throughout this book:

How it works

Leveraging a customized virtual machine created by OWASP, we can quickly set up a web app pentesting lab containing purposefully vulnerable applications, which we can use as legal targets for our exercises throughout this book.