ZEMPIRE | Academy

Name	Options	Details
AWStats	Online Play Download Documentation Discussion Report	Find various vulnerabilities in an old but live production of AWStats to see all the various vectors that can be opened up with a monitoring engine like this.
Bodgeit	Online Play Download Documentation Discussion Report	The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing. The Bodge It Store include the following significant vulnerabilities: Cross Site Scripting, SQL injection, Hidden (but unprotected) content, Cross Site Request Forgery, Debug code, Insecure Object References, Application logic vulnerabilities.
CSRFGuard Test Application	Online Play Download Documentation Discussion Report	CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks. Use this game to test vulnerable and invulnerable setups.
Damn Vulnerable Linux	Online Play Download Documentation Discussion Report	ACCESS SSH<br> <br> ssh dvl.openhacker.org -p 20022 -oHostKeyAlgorithms=+ssh-dss<br> USERNAME: openhacker<br> PASSWORD: openhacker<br> <br> ACCESS WEB<br> <br>http://dvl.openhacker.org:20080<br> PASSWORD: openhacker<br> <br> You will need various clients to play different areas of this game as many protocols are vulnerable.
Damn Vulnerable Web App	Online Play Download Documentation Discussion Report	Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.<br> <br> User: admin<br> Pass: password<br> <br> Please reset the Database under Setup when you are done. Resetting it will bring everything back to defaults.
ESAPI Java SwingSet Interactive	Online Play Download Documentation Discussion Report	The ESAPI Swingset INTERACTIVE is a web application which demonstrates common security vulnerabilities and asks users to secure the application against these vulnerabilities using the ESAPI library. The application is intended for Java Developers. The goal of the application is to teach developers about the functionality of the ESAPI library and give users a practical understanding of how it can be used to protect web applications against common security vulnerabilities.
Gallery2	Online Play Download Documentation Discussion Report	Gallery is a web based software product that lets you manage your photos on your own website. You must have your own website with PHP and database support in order to install and use it. With Gallery you can easily create and maintain albums of photos via an intuitive interface. Photo management includes automatic thumbnail creation, image resizing, rotation, ordering, captioning, searching and more. Albums and photos can have view, edit, delete and other permissions per individual authenticated user for an additional level of privacy. It's great for communities - give accounts to your friends and family and let them upload and manage their own photos on your website!
GetBoo	Online Play Download Documentation Discussion Report	GetBoo is a Web 2.0 bookmarking system, both social (with tags) and private (with folders). Import and export your bookmarks from multiple browsers. Admin management section with SPAM protection, translations, bookmarklets, Firefox extension, RSS feeds, and more!
Ghost	Online Play Download Documentation Discussion Report	Web based environment set to be vulnerable to: XSS, CSRF, IFrame Injection, RFI, LFI, Code Injection, Flash Injection and more...
Gruyere	Online Play Download Documentation Discussion Report	This codelab is built around Gruyere - a small, cheesy web application that allows its users to publish snippets of text and store assorted files. "Unfortunately," Gruyere has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The goal of this codelab is to guide you through discovering some of these bugs and learning ways to fix them both in Gruyere and in general. The codelab is organized by types of vulnerabilities. In each section, you'll find a brief description of a vulnerability and a task to find an instance of that vulnerability in Gruyere. Your job is to play the role of a malicious hacker and find and exploit the security bugs. In this codelab, you'll use both black-box hacking and white-box hacking. In black box hacking, you try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior. You do not have access to the source code, although understanding how to view source and being able to view http headers (as you can in Chrome or LiveHTTPHeaders for Firefox) is valuable. Using a web proxy like Burp or WebScarab may be helpful in creating or modifying requests. In white-box hacking, you have access to the source code and can use automated or manual analysis to identify bugs. You can treat Gruyere as if it's open source: you can read through the source code to try to find bugs. Gruyere is written in Python, so some familiarity with Python can be helpful. However, the security vulnerabilities covered are not Python-specific and you can do most of the lab without even looking at the code. You can run a local instance of Gruyere to assist in your hacking: for example, you can create an administrator account on your local instance to learn how administrative features work and then apply that knowledge to the instance you want to hack. Security researchers use both hacking techniques, often in combination, in real life.
GTD-PHP	Online Play Download Documentation Discussion Report	GTD-PHP is one of many possible tools for use with the productivity solution(s) described by David Allen in his book Getting Things Done. Please read his book; this summary does not do justice to his system, logic or years of experience. The basic idea behind his book is that you are at your most productive when you have a clear mind. His solution to "clearing your head" is to have a comprehensive, trusted, externalized organizational system to track everything in your life. Once you do so, your mind can let go of all the little things it previously spent a great deal of time tracking and repeatedly reminding. Only then can you truly focus on the task at hand, which should dramatically increase productivity. However, if your external tracking system is not complete and up to date, your mind will take back the task of worrying and nag you about things you could be or should be doing. That will continually distract you and cause stress.
Hackxor	Online Play Download Documentation Discussion Report	Hackxor is a webapp hacking game where players must locate and exploit vulnerabilities to progress through the story. Think WebGoat but with a plot and a focus on realism&difficulty. Contains XSS, CSRF, SQLi, ReDoS, DOR, command injection, etc Features: Client attack simulation using HtmlUnit; no alert('xss') here. Smooth difficulty gradient from moderately easy to fiendishly tricky. Realistic vulnerabilities modelled from Google, Mozilla, etc (No rot13!) Open ended play; progress by any means possible.
Joomla	Online Play Download Documentation Discussion Report	Exploit various vectors in an old vulnerable Joomla engine released to the public.
Mandiant Struts Forms	Online Play Download Documentation Discussion Report
Metasploitable 2	Online Play Download Documentation Discussion Report	Metasploitable is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques. Perfect for using Metasploit Framework against.<br> <br> ACCESS SSH<br> <br>ssh ms2.openhacker.org -p 30022 -oHostKeyAlgorithms=+ssh-dss<br> USERNAME: openhacker<br> PASSWORD: openhacker<br> <br> ACCESS WEB<br> <br>http://ms2.openhacker.org:30080<br> PASSWORD: openhacker<br> <br> ACCESS IRC<br> <br>irc://ms2.openhacker.org:36667<br> <br> You will need various clients to play different areas of this game as many protocols are vulnerable.
Mutillidae	Online Play Download Documentation Discussion Report	Mutillidae is a free, open source web application provided to allow security enthusiest to pen-test and hack a web application. Mutillidae can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to install or administrate their own webserver. It is already installed on Samurai WTF. Simply replace existing version with latest on Samurai. Mutillidae contains dozens of vulnerabilities and hints to help the user exploit them; providing an easy-to-use web hacking environment deliberately designed to be used as a hack-lab for security enthusiast, classroom labs, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, in corporate web sec training courses, and as an "assess the assessor" target for vulnerability software.
OrangeHRM	Online Play Download Documentation Discussion Report	The OrangeHRM Open Source system has an array of modules, all in one application that fulfills your main HR requirements. You can download the OrangeHRM application from our website and start using it with absolutely no cost or limitations. This version is prevulnerable from an older release.
Peruggia	Online Play Download Documentation Discussion Report	Peruggia is designed as a safe, legal environment to learn about and try common attacks on web applications. Peruggia looks similar to an image gallery, but contains several controlled vulnerabilities to practice on.
Tiki Wiki	Online Play Download Documentation Discussion Report	This is a vulnerable wiki system... If you have any more information, please submit it by using the 'Report' feature.
Vicnum	Online Play Download Documentation Discussion Report	A flexible web app showing vulnerabilities such as cross site scripting, sql injections, and session management issues. Helpful to IT auditors honing web security skills and setting up 'capture the flag'.
WackoPicko	Online Play Download Documentation Discussion Report	WackoPicko is a website that contains known vulnerabilities. It was first used for the paper Why Johnny Can't Pentest: An Analysis of Black-box Web Vulnerability Scanners. http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf
Wavsep	Online Play Download Documentation Discussion Report	The Web Application Vulnerability Scanner Evaluation Project. A vulnerable web application designed to help assessing the features, quality and accuracy of web application vulnerability scanners. This evaluation platform contains a collection of unique vulnerable web pages that can be used to test the various properties of web application scanners.
WebCalendar	Online Play Download Documentation Discussion Report	WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. This version is of a vulnerable previous release.
WebGoat	Online Play Download Documentation Discussion Report	WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat in either J2EE (this page) or WebGoat.Net in ASP.NET. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application is a realistic teaching environment, providing users with hints and code to further explain the lesson. Access username: guest password: guest
WebGoat .NET	Online Play Download Documentation Discussion Report	WebGoat.NET is a purposefully broken ASP.NET web application. It contains many common vulnerabilities, and is intended for use in classroom environments.
Wivet	Online Play Download Documentation Discussion Report	WIVET is a benchmarking project that aims to statistically analyze web link extractors. In general, web application vulnerability scanners fall into this category. These VAs, given a URL(s), try to extract as many input vectors as possibly they can to increase the coverage of the attack surface. WIVET provides a good sum of input vectors to any extractor and presents the results. In order an input extractor to run meaningfully, it has to provide some kind of session handling, which nearly all of the decent crawlers do.
WordPress	Online Play Download Documentation Discussion Report	WordPress is web software you can use to create a beautiful website or blog. We like to say that WordPress is both free and priceless at the same time. This is a previous release of a vulnerable wordpress.
Yazd	Online Play Download Documentation Discussion Report	Yazd is an open-source (Apache License) discussion forum software that you can download customize and use. Yazd is a Java based forum software that can easily be configured through an admin interface. This discussion forum software is highly flexible and uses JDBC to connect to a backend database. This is a previous release of a vulnerable engine.
Zap-Wave	Online Play Download Documentation Discussion Report	The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.