dvws: insecure web application to learn real world web service vulnerabilities

by do son · January 27, 2018

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real-world web service vulnerabilities. The aim of this project is to help security professionals learn about Web Application Security through the use of a practical lab environment.

This application includes the following vulnerabilities.

WSDL Enumeration
XML External Entity Injection
XML Bomb Denial-of-Service
XPATH Injection
WSDL Scanning
Cross Site-Tracing
OS Command Injection
Server Side Request Forgery
REST API SQL Injection
Same Origin Method Execution
JSON Web Token (JWT) Secret Key Brute Force
Cross-Origin Resource Sharing

Download

git clone https://github.com/snoopysecurity/dvws.git

DVWS can be used with a XAMPP setup. XAMPP is a free and open source cross-platform web server solution which mainly consists of an Apache Web Server and MySQL database. To setup, download and install the XAMPP setup first. Next, download the dvws folder and copy the folder to your htdocs directory. Lastly, Setup or reset the database by going to http://localhost/dvws/instructions.php