Broken Web Applications (OWASP BWA): Beyond 1.0

on YouTube ↗49m

" summary

Overview of the OWASP Broken Web Applications project and its freely distributed virtual machine that bundles 25+ intentionally vulnerable web applications for training and tool testing. Covers background and demonstrates key features of the version 1.0 VM, then outlines planned future directions for the project.

AI-written summary · about

" chapters (14)

1. 0:00Start
2. 2:20Looking for web applications with vulnerabilities where I could
3. 5:06Realistic applications with vulnerabilities . Often closed source, which prevents some uses • Can conflict with one another . Can be difficult to install • Licensing restrictions
4. 6:06Free, Linux-based Virtual Machine • Contains a variety of web applications
5. 8:44Available in VMware and OVA formats • Compatible with
6. 10:09OS is Ubuntu Linux Server 10.04 LTS - No X-Windows / Graphical User Interface • Managed via
7. 32:49Application code can be edited via SMB shares, SSH, or the console • Updates to PHP, JSP, etc. application files will take place immediately • Scripts provided to rebuild and redeploy applications that require it
8. 34:49Scripts are provided to update VM from source code repositories
9. 35:33Web server on OWASP BWA is running mod_security • By default, no rules are enabled Scripts are provided to
10. 36:14Logging for the web and application servers are left in their default configuration - What you will most likely see when
11. 37:27Don't have a master list of vulnerabilities (yet)
12. 39:20Version 1.2 planned before the end of 2013
13. 40:27Will get increasingly difficult to support modern and old applications -Due to library and other dependency issues
14. 44:33Improved set of real applications with security issues - More applications

" related talks

• 44mSelected Vulnerabilities in Web ApplicationsM. Sajdak · 4Developers 2015
• 26mOpenSec and Why WebAppSec MattersShah Mijanur Rahman · FOSSASIA Summit 2017
• 23mWeb Application Security - owasp top 10 vulnerabilitiesShan Jun Ng · FOSSASIA Summit 2017
• 01h 30mCommon Webapp Vulnerabilities and What to Do About ThemEoin Woods · ACCU 2018
• 45mOWASP for DevelopersMatteo Meucci · Codemotion Rome 2016
• 45mOverview of Interesting Vulnerabilities in Web Applications - Live DemosMichał Sajdak · JDD 2025
• 48mWeb Application SecurityTaras Ivashchenko · ШРИ в Симферополе 2013
• 01h 02mLive Hacking: Breaking into your Web AppBrian Vermeer · Developers Summit 2021