Tuesday, 10 May 2011

Learn Web Hacking With WackoPicko

WackoPicko is a website that contains known vulnerabilities. It can prove as a very efficient way to master web hacking skills. This project is similar to Damn Vulnerable Web Application and is a collection of common web vulnerabilities.

For more information and downloads, you can check the WackoPicko github page.


Reflected XSS
The query parameter is vulnerable.

Stored XSS
The comment field is vulnerable.

SessionID vulnerability
The session cookie value is admin_session, which is an auto-incrementing value.

Stored SQL Injection
http://localhost/users/register.php -> http://localhost/users/similar.php
The first name field of the register users form contains a stored SQL injection which is then used unsanitized on the similar users page.

Reflected SQL Injection
The username field is vulnerable.

Directory Traversal
The tag field has a directory traversal vulnerability enabling a malicious users to overwrite any file the web server uses has access to.

Multi-Step Stored XSS
The comment field is vulnerable to XSS, however must go through a preview form.

Forceful Browsing
The user doesn't have to purchase the picture to see the high quality version.

Command-line Injection
The password field is vulnerable to a command line injections.

File Inclusion
The page is vulnerable to a file inclusion vulnerability, however you have to include at the end.

Parameter Manipulation
The userid parameter can be manipulated to see any user's page when you need to be logged in otherwise.

Reflected XSS Behind JavaScript
The name parameter is vulnerable.

Logic Flaw
A coupon can be applied multiple times reducing the price of an order to zero. The coupon in the initial data is SUPERYOU21.

Reflected XSS Behind a Flash Form
The value parameter is vulnerable.

Weak username/password
There is a default username/password combination of admin/admin.