TIWAP: Totally Insecure Web Application Project
Totally Insecure Web Application Project (TIWAP)
TIWAP is a web security testing lab made using Flask for budding security enthusiasts to learn about various web vulnerabilities. Inspired by DVWA, the contributors have tried their best to regenerate various web vulnerabilities
The application is solely made for educational purposes and to learn web hacking in a legal environment.
Vulnerabilities
Currently, we have 20 vulnerabilities in the lab. All listed below:
- SQL Injection
- Blind SQL Injection
- NoSQL Injection
- Command Injection
- Business Logic Flaw
- Sensitive Data Exposure
- XML External Entities
- Security Misconfiguration
- Reflected XSS
- Stored XSS
- DOM Based XSS
- HTML Injection
- Improper Certificate Validation
- Hardcoded Credentials
- Insecure File Upload
- Brute Force
- Directory Traversal
- Cross-Site Request Forgery (CSRF)
- Server-Side Request Forgery (SSRF)
- Server-Side Template Injection (SSTI)
Each vulnerability is having 3 difficulty levels, namely Low, Medium and Hard. These levels can be set from the settings page.
Setup and Installation
To keep the installation and setup easy, we have configured everything for you. All you need is Docker on your system.
Once you are done with docker installation, run the following commands.
git clone https://github.com/tombstoneghost/TIWAP.git
cd TIWAP
docker-compose up
Note: It works only on Linux as of now and windows compatibility is working under progress
Once the lab is started, you can log in using the default credentials.
Username: admin
Password: admin
Copyright (c) 2021 Simardeep Singh
