Research and Development

VulnApp is a vulnerable web application written in ASP.net.

Recently myself and a colleague were asked to give some training to a client’s ASP.net development team. My colleague was asked to give the main training session whilst I was asked to run a post training game to test the developers retention of the concepts. After looking at some of the existing ASP.net applications I decided I’d like to write my own. The result of this is VulnApp, a BSD licensed ASP.net application implementing some of the most common applications we come across on our penetration testing engagements. The source is also available from my CVS server so that others can, if they like, contribute.

To make it easier for developers to learn, I’ve logged tickets for all of the intentional vulnerabilities I’ve introduced along the way. Be aware that there might be others I’ve missed, particularly gaps in the enforcement of ACLs and logic bugs. I’d encourage you to log any other vulnerabilities you find along the way.

VulnApp-1.1 Tar
VulnApp-1.1.tar.gz
April 26, 2013
Version: 1.1
574.9 KiB
MD5 hash: 5f6cf3624eaa1d55a5cebe56b3c8f99d
Details
VulnApp-1.0 Tar
VulnApp-1.0.tar.gz
April 26, 2013
Version: 1.0
570.8 KiB
MD5 hash: 64e81706e98f6e643ed7cff33e0043a3
Details

Request to be added to the Portcullis Labs newsletter

We will email you whenever a new tool, or post is added to the site.

Your Name (required)

Your Email (required)