Welcome to Badstore.net

Badstore.net is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.

Features

UltimateLAMP includes a long list of popular LAMP stack applications. For more information take a look a the UltimateLAMP products list.

With the success of this first product, research has already commenced in our next two products UltimateLAMJ (Open Source Java Based Applications) and UltimateLAMR (Open Source Ruby Applications).

Latest News

• Oct 27 2006 - Information regarding Passwords.
• Aug 14 2006 - And the winners are?
• May 20 2006 - VMware Appliance Challenge Application.
• May 15 2006 - Version 0.2 release of UltimateLAMP.
• May 12 2006 - Initial Version 0.1 release of UltimateLAMP.

-- S1.100

SCENARIO

The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company. The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities (using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted you to look at only one server - a old system that only has a web-based list of the company's contact information.

The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box. Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.

CONFIGURATION

PenTest Lab Disk 1.100: This LiveCD is configured with an IP address of 192.168.1.100 - no additional configuration is necessary.

Pentest Machine:

Your second system will use the BackTrack (v.2) LiveCD as provided by remote-exploit.org. A copy of the LiveCD can be downloaded from remote-exploit.org. This disk is configured to obtain an IP address through DHCP - thus no additional configuration is required. All tools necessary to exploit Disk 1.100 can be found on the BackTrack Disk. No additional installations will be necessary.

Router Configuration:

The PenTest Lab system and the PenTest machine must connect to a router that has been configured with the following values: + DHCP Server: active + Pool Starting Addr.: 192.168.1.2

LAN TCP/IP: + IP Address: 192.168.1.1 + IP Subnet Mask: 255.255.255.0

Damn Vulnerable Linux (DVL) Strychnine (1.2):

Added several tools. Switched to BackTrack 2 Final as core system. DVL Strychnine will contain a Knowledge Base as well!

• 0000072: [Application Development] Add Flawfinder
• 0000071: [Application Development] Add JLint
• 0000025: [Reverse Code Engineering] libdisasm_0.21-pre2 should be added
• 0000068: [Reverse Code Engineering] Add REC 1.6
• 0000051: [Reverse Code Engineering] Add LTRACE
• 0000047: [Reverse Code Engineering] ELF Shell should be added
• 0000007: [Requirements] Firefox Tabs should be cleaned up
• 0000035: [Application Development] KDevelop should be added
• 0000015: [Reverse Code Engineering] Bastard 0.17 should be added
• 0000011: [Requirements] Boot text should be branded for DVL instead for BT
• 0000032: [Application Development] NEdit should be added
• 0000012: [Requirements] A new bootspash has to be designed and included
• 0000048: [Reverse Code Engineering] Add ELF Kickers
• 0000014: [Shellcode / Exploitation] Splint static code analyzer should be added
• 0000045: [Reverse Code Engineering] Add BIEW
• 0000040: [Reverse Code Engineering] LDasm should be added
• 0000063: [Application Development] Add BASIC-256
• 0000028: [Web Exploitation] A vulnerable PHP.ini should be used
• 0000058: [Application Development] PHPmyAdmin should be installed
• 0000065: [Application Development] Add GAS
• 0000064: [Bugs] HLA does not work under Konsole
• 0000059: [Documentation] Define Directory Structure for Documentation
• 0000060: [Tutorials] Define Directory Structure for Tutorials
• 0000004: [Documentation] DVL needs a concept on how to hold documentation
• 0000019: [Reverse Code Engineering] ht-2.0.2 should be added
• 0000020: [Cryptography] stegdetect-0.6 should be added
• 0000022: [Reverse Code Engineering] STAN 0.4.1 Stream Analyzer should be added
• 0000024: [Cryptography] Outguess 0.2 should be added
• 0000038: [Reverse Code Engineering] memgrep should be installed
• 0000039: [Reverse Code Engineering] ALD Assembly Language Debugger should be added
• 0000049: [Reverse Code Engineering] Add REVDump
• 0000061: [Tutorials] Define Directory Structure for exercises
• 0000010: [Shellcode / Exploitation] SudoEdit 1.6.8 should be added (Local Exploit)
• 0000013: [Reverse Code Engineering] LIDA disassembler needs to be installed and linked in menues
• 0000017: [Reverse Code Engineering] GDBINIT colorized by Mammon should be added.
• 0000018: [Application Development] HLA Assembly Language should be added
• 0000023: [Reverse Code Engineering] Sandmark should be added
• 0000031: [Application Development] jEdit should be installed
• 0000041: [Reverse Code Engineering] The Examiner should be added
• 0000050: [Reverse Code Engineering] Add RADARE
• 0000057: [Reverse Code Engineering] Add Sinister
• 0000029: [Application Development] MySQL should be installed
• 0000037: [Application Development] Jed Editor should be added
• 0000030: [Application Development] Wine Windows Emulator needs to be installed
• 0000027: [Requirements] Apache with PHP 4 and 5 included
• 0000054: [Reverse Code Engineering] Add MemFetch
• 0000052: [Reverse Code Engineering] Add STRACE
• 0000056: [Reverse Code Engineering] Add lsof

DVL Strychnine is finally final. The last pre-compilation is running at the moment, then the final compilation of the remaster will follow. Some nasty bugs fixed such as permissions problems of the pre-installed MySQL database containing first vulnerabe web examples. Click on the link below to see the current changelog. This shows you which additions have been added to the “classic” BT 2.0 release to build the base of the new era of Damn Vulnerable Linux. Some more minor unimportant features are left to install, however I believe it is time to go with the release to concentrate finally on the production of the most important: training lessons!

DVL Strychnine will be available via BitTorrent this weekend (never published before using BitTorrent! let's see if I run into problems!) - Later I place it on the mirrors. File size at the moment 822 MB, sorry for that but let the community decide what to kill!

A short intro video will follow soon, maybe I can make it this weekend.

Damn Vulnerable Linux (DVL) E605 (1.3):

Added many many vulnerabilities. Added much exercise material including sources. Now included the HoneyNet Project and WebGoat.

• 0000070: [Reverse Code Engineering] Add Boomerang Decompiler
• 0000082: [Application Development] Free Pascal Compiler
• 0000136: [Tools] Add Valgrind 3.2.0 + Valkyrie
• 0000135: [Application Development] Add SmallBasic 0.9.7
• 0000134: [Application Development] Add Dr. Scheme
• 0000133: [Application Development] Add SWI Prolog
• 0000131: [Application Development] Add GCC-g77
• 0000127: [Web Exploitation] Add Cyphor
• 0000109: [Shellcode / Exploitation] Add atari800 Local Root Exploit
• 0000120: [Shellcode / Exploitation] Add phpBB 2.0.13 (admin_styles.php) Remote Command Execution Exploit
• 0000125: [Web Exploitation] Add Joomla <= 1.0.9 (Weblinks) Remote Blind SQL Injection Exploit
• 0000126: [Web Exploitation] Add Joomla <=1.0.7 (feed) Denial of Service Exploit
• 0000123: [Web Exploitation] Add PHPNuke 7.8
• 0000124: [Application Development] Add PHP-Nuke 7.4 POST Method Admin Variable Privilege Escalation
• 0000122: [Shellcode / Exploitation] Add linux-ftpd-ssl 0.17 (MKD/CWD) Remote Root Exploit
• 0000110: [Shellcode / Exploitation] Add Aeon 0.2a Local Linux Exploit
• 0000108: [Shellcode / Exploitation] Add SoX Local Buffer Overflow Exploit
• 0000111: [Shellcode / Exploitation] Add sash <= 3.7 Local Buffer Overflow Exploit
• 0000104: [Shellcode / Exploitation] Add splitvt < 1.6.5 Local Exploit
• 0000121: [Web Exploitation] Add e107 <= 0.6172 (resetcore.php) Remote SQL Injection Exploit
• 0000102: [Shellcode / Exploitation] Add ProFTPD <= 1.3.0a (mod_ctrls support) Local Buffer Overflow PoC
• 0000016: [Reverse Code Engineering] Fenris should be added
• 0000067: [Reverse Code Engineering] Add ELFIO
• 0000084: [Application Development] Add FakeAP
• 0000083: [Application Development] Add BestCrypt
• 0000085: [Application Development] Add FindDDOS
• 0000078: [Tools] Add QTParted
• 0000094: [Shellcode / Exploitation] Add Minicom 1.81
• 0000096: [Shellcode / Exploitation] Add Nestea \"Off By One\" attack
• 0000099: [Web Exploitation] Add PhpBB 2.0.12 Session Handling Authentication Bypass
• 0000100: [Web Exploitation] Add WordPress 1.5.1.1 SQL Injection
• 0000101: [Web Exploitation] Add Nabopoll 1.2 Remote File Inclusion, Remote Configuration Disclosure
• 0000093: [Application Development] Add HLA Compiler Construction Kit
• 0000092: [Application Development] Add YASM Assembler
• 0000091: [Application Development] Add FASM
• 0000090: [Application Development] Add SciLab
• 0000081: [Application Development] Add GSL GNU Scientific Library
• 0000080: [Application Development] Add FreeBasic
• 0000079: [Application Development] Add BlueFish Editor
• 0000033: [Application Development] RHIDE should be added
• 0000089: [Application Development] Add C++6 libs
• 0000088: [Application Development] Add LibGC
• 0000087: [Application Development] Add BOOST Library
• 0000076: [Application Development] Remove JRE and add JDK 1.5
• 0000075: [Application Development] Add QEMU
• 0000074: [Application Development] Add Scite Editor
• 0000073: [Peneration Testing] Add OWASP's WebGoat

DVL Strychnine + E605 is final! I just remastered the ISO and we land at 1050 MB size which fits perfectly on a 2 GB USB stick (and gives us more free space to add additional stuff). I will upload the ISO today and inform the mirrors. Finally after all this installation part I can play myself with it :)

Damn Vulnerable Linux (DVL) Strychnine+E605 (1.4):

Added more tools. Now Reverse Code Engineering tools is 99%, added Truecrypt, Eclipse IDE for Java and C++, added Mono for .NET vulnerability. Rearranged the menu, minor bug fixes ( :grin: ). We close tool addition with this and focus on bug fix and training material only from now on.

• [Application Development] Add Motor IDE
• [Application Development] Update HLA to 1.98 and StdLib to 2.3
• [Application Development] Add LogWatch
• [DVL Core] Add XEN
• [Reverse Code Engineering] Add Insight GDB Debugger
• [Tutorials] Add CPU Sim - An Interactive Java-based CPU Simulator
• [Reverse Code Engineering] Add JAD Java Decompiler
• [Tools] Add VLC Media Player
• [Documentation] Add TeTex
• [Documentation] Add JabRef
• [Application Development] Add Kile
• [Documentation] Add kDissert Mindmapper
• [Peneration Testing] Add JBroFuzz
• [Application Development] Add WebScarab
• [Peneration Testing] Add CAL9000
• [Reverse Code Engineering] Add KDBG
• [Application Development] Add xchm
• [DVL Core] Add gtk libs
• [Tools] Add xvidcap
• [Tools] Add AcroRead
• [Tools] Add Scite

DVL 1.4 final is ready to go and is uploaded at the moment. We hit the 1.6 GB size, including all necessary to train software development, IT security and Reverse Code Engineering. During the next time the mirrors will be informed. After this we post the links. As well we do a short intro video to show all features and on how to use DVL.

Moth is a downloadable VMWare image based on Ubuntu. It was set up to test the functionality of w3af and it includes various web application vulnerabilities. Most howto's use Moth as an example for a web page under test.

A flexible web app showing vulnerabilities such as cross site scripting, sql injections, and session management issues. Helpful to IT auditors honing web security skills and setting up 'capture the flag'.

A flexible web app showing vulnerabilities such as cross site scripting, sql injections, and session management issues. Helpful to IT auditors honing web security skills and setting up 'capture the flag'.

Kioptrix VM Image Challenges:

This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.

It's been a while since the last Kioptrix VM challenge. Life keeps getting the way of these things you know.

After the seeing the number of downloads for the last two, and the numerous videos showing ways to beat these challenges. I felt that 1.2 (or just level 3) needed to come out. Thank you to all that downloaded and played the first two. And thank you to the ones that took the time to produce video solutions of them. Greatly appreciated.

As with the other two, this challenge is geared towards the beginner. It is however different. Added a few more steps and a new skill set is required. Still being the realm of the beginner I must add. The same as the others, there’s more then one way to “pwn” this one. There’s easy and not so easy. Remember… the sense of “easy” or “difficult” is always relative to ones own skill level. I never said these things were exceptionally hard or difficult, but we all need to start somewhere. And let me tell you, making these vulnerable VMs is not as easy as it looks…

Important thing with this challenge. Once you find the IP (DHCP Client) edit your hosts file and point it to kioptrix3.com

Under Windows, you would edit C:\Windows\System32\drivers\etc\hosts to look something like this:

# localhost name resolution is handled within DNS itself.
#   127.0.0.1 localhost
#   ::1 localhost127.0.0.1 static3.cdn.ubi.com
192.168.1.102 kioptrix3.com

Under Linux that would be /etc/hosts

There’s a web application involved, so to have everything nice and properly displayed you really need to this.

Hope you enjoy Kioptrix VM Level 1.2 challenge.

452 Megs

MD5 Hash : d324ffadd8e3efc1f96447eec51901f2

Have fun

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.

Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.