.:: Dark Site ::.

PHP Script For Cracking http Basic Authentication

hi in this post i am again sharing article of one of my very nice friend <a href="http://www.mannulinux.org/">manish</a> this php shell helps in cracking http basic authentication password cracking.now lets come to the real topic what exactly basic auth. 
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ5QZ_gw1g2A0DVqsNJ5A_vynb86cjioz1ijR97HxWPlykpJqzJka-si1XLoA6IeKLpt_1LJrj_jwcm4mY4_PLarmorVhMQW3NY4GJq3Mz6X33FaC7eKqi4BrwVvFj5EYfyAqn5WnZT6I/s1600/http4.png"> 
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ5QZ_gw1g2A0DVqsNJ5A_vynb86cjioz1ijR97HxWPlykpJqzJka-si1XLoA6IeKLpt_1LJrj_jwcm4mY4_PLarmorVhMQW3NY4GJq3Mz6X33FaC7eKqi4BrwVvFj5EYfyAqn5WnZT6I/s800/http4.png" width="620" /> 
</a> 
Http Basic Auth Cracker PHP Script 
</div> 
so in order to perform HTTP transaction(request- response), basic access authentication is a method for an HTTP user agent to provide a user name and password when making a request.after providing correct user id and password when it is asked. 
 
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFjb166gjvGsyUf3mfAe2kJEZ7ePcLdCtwk-639Y8VaYLWIbebYCzeS2VFXS5t2beqrYJ8rDNU5iOEpftyYs6t4QDQHqUp3cdv-PdbMOI_CNdivi7fssIYh5VByrH7h-SpMaC_THwCvRE/s1600/http3.png"> 
<img height="199" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFjb166gjvGsyUf3mfAe2kJEZ7ePcLdCtwk-639Y8VaYLWIbebYCzeS2VFXS5t2beqrYJ8rDNU5iOEpftyYs6t4QDQHqUp3cdv-PdbMOI_CNdivi7fssIYh5VByrH7h-SpMaC_THwCvRE/s600/http3.png" width="320" /> 
</a> 
Basic Auth Prompt 
</div> 
it will allow you to do the http request.so our objective here is how we can break it or get the correct user id and password 
so we can do it with the help of php script and brute force attack. 
you can brute force any panel which is using basic authentication using this script 
 
<a href="http://www.mediafire.com/download/3fa25np8nmflmxd/http.php"> 
download link here</a> 
 
Procedure is very simple 
 
you need to supply link where htaccess is implemented , username list and password list 
 
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxq0Bl-Djt8Ygy1MCn1mfYZKdi2VGciRcHF4TkIg2p3tCEqUaB1irZ52ievSJhLLYeUqz-9En-BsT8yVUl8fczF4EJK01CWaskIIbHJOyC8dIbIpvvXy2K4JtEpIJoyrRNBz9pP493TYo/s1600/http.png"> 
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxq0Bl-Djt8Ygy1MCn1mfYZKdi2VGciRcHF4TkIg2p3tCEqUaB1irZ52ievSJhLLYeUqz-9En-BsT8yVUl8fczF4EJK01CWaskIIbHJOyC8dIbIpvvXy2K4JtEpIJoyrRNBz9pP493TYo/s1600/http.png" width="620" /> 
</a> 
provide possible username and password list 
</div> 
and click "lets hex this shit" button 
if password is weak or in your password list, you will get success message like this 
 
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjccN1YdAdi_A8ZTMd6NcyWpjJVI8Lpv1ngPilXWOusixZooCW6LCkOXzKBdpO5nQojWGVuwq5YguI15xBuzY61dH2bFnL3AwsFgaMphPYJGXpdQX3fMb9ob1J0YM8JZ-RjHcC7-ISg8i4/s1600/http2.png"> 
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjccN1YdAdi_A8ZTMd6NcyWpjJVI8Lpv1ngPilXWOusixZooCW6LCkOXzKBdpO5nQojWGVuwq5YguI15xBuzY61dH2bFnL3AwsFgaMphPYJGXpdQX3fMb9ob1J0YM8JZ-RjHcC7-ISg8i4/s1600/http2.png" width="620" /> 
</a> 
Cracked Successfully :) 
</div> 
enjoy :) 
with love from Team IndiShell 
if you have any problem regarding this script , you can message manish on facebook 
http://facebook.com/manish1046 
 
it work very nice you should definitely give a try :) if u encounter http basic auth somewhere :).

PHP Script For Cracking http Basic Authentication

hi in this post i am again sharing article of one of my very nice friend manish this php shell helps in cracking http basic authentication ...

Tabnabbing Attack with social Engineering toolkit on Backtrack | kali

Hi everyone here is the post that basically explain about very fundamental attack known to be tab nabbing attack.the attack is very simple again you sent an link to the victim he/she click on it and redirected to your desired login page which looks like original and the after putting his/her credentials you get that in no time . 
so lets do this with social engineering toolkit as here more social engineering trick is very necessary . 
So before doing all do check your own BT/Kali System IP address by typing ifconfig command. 
then Open Your Backtrack terminal and Type cd /pentest/exploits/set 
Now Open Social Engineering Toolkit (SET) ./set 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8mOCeh6T49bOGwtiZujht1oA12Rg7bDtIoMh2sHliLfnJO-2NfErxGQPetMnjX0w-kJTbsfdIkiqXtEgNATLykrZxlYkROjNvyRF9dvNAMSmqpYl37FhoWuzWP146-RLb03JvtFsOgJhw/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8mOCeh6T49bOGwtiZujht1oA12Rg7bDtIoMh2sHliLfnJO-2NfErxGQPetMnjX0w-kJTbsfdIkiqXtEgNATLykrZxlYkROjNvyRF9dvNAMSmqpYl37FhoWuzWP146-RLb03JvtFsOgJhw/s720/1.png" /></a></div>after that choose social engineering attack that is option 1 and then choose option 2, “Website Attack Vectors”. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXnvQM1rOT8QcacsgxOq08vMrzbiVjdLmvby4Ebwj_f_hrh24i5oDySrfTWUQsBmOhaMvrJvZ1Bb_zBsl-hmcrFi1RKYzQHPTgg1w2QT5CRTUUqMThZW2RageZa0DiEAlbXOAZ-tYunLS/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXnvQM1rOT8QcacsgxOq08vMrzbiVjdLmvby4Ebwj_f_hrh24i5oDySrfTWUQsBmOhaMvrJvZ1Bb_zBsl-hmcrFi1RKYzQHPTgg1w2QT5CRTUUqMThZW2RageZa0DiEAlbXOAZ-tYunLS/s520/2.png" /></a></div>a list of options will be populated you have to select option 4 “Tabnabbing Attack Method”. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyynYd_9GCyeMDOl0b0hf-IMfWMlMn45py7x8ORMFu510M7kKTjL9yedvj7vEcbnk4urT99hMRHwDYxoT9JJn_iOB0x4NOXQKD3Q4Yj6lHSOm4uW33FVtmUFT2iV5OsN7Pm3prYhJgB1zM/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyynYd_9GCyeMDOl0b0hf-IMfWMlMn45py7x8ORMFu510M7kKTjL9yedvj7vEcbnk4urT99hMRHwDYxoT9JJn_iOB0x4NOXQKD3Q4Yj6lHSOm4uW33FVtmUFT2iV5OsN7Pm3prYhJgB1zM/s520/3.png" /></a></div>next choose option 2 “Site Cloner”. 
it will ask for your system ip which you can give that you got from ifconfig (your backtrack machine ip) 
Then Enter the URL of the site you want to clone. In this case http://www.facebook.com and hit enter. SET will clone up the web site. And press return to continue. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPr-T2k0wOCGp2LOn9_tSipWfdFyGWfk6M7Iam6Zt1Tq7Hi1kixJATeqMG3wz75m77kjVjou5d5kcmykAZk6kGCRB-M95AP7_zUZ4cbtkk2eDgS5Dvdr_dy08FrNYvZSx9LJ5kSsAweP6u/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPr-T2k0wOCGp2LOn9_tSipWfdFyGWfk6M7Iam6Zt1Tq7Hi1kixJATeqMG3wz75m77kjVjou5d5kcmykAZk6kGCRB-M95AP7_zUZ4cbtkk2eDgS5Dvdr_dy08FrNYvZSx9LJ5kSsAweP6u/s520/5.png" /></a></div>Now convert your URL into Google URL using goo.gl and send this link address to your victim via Email or Chat or any other social way you can make it reach to victim. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHX5huRp5OrW-sQ3bCw9pqvykPX2ACAXGrr9YyJoEwn7QcvgZzEM6HVjcgvbODu5hmaCQHJobjcU6t0b48a0YF6N_63GnJ46wZtbddX_prk0qPvjhS_TeLqCyzWcV81MqAA_nC59fm5wND/s1600/7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHX5huRp5OrW-sQ3bCw9pqvykPX2ACAXGrr9YyJoEwn7QcvgZzEM6HVjcgvbODu5hmaCQHJobjcU6t0b48a0YF6N_63GnJ46wZtbddX_prk0qPvjhS_TeLqCyzWcV81MqAA_nC59fm5wND/s520/7.png" /></a></div>When victim open in their browser it should be a message that the page is still loading. so victim start to open another tab. As soon as victim open new tab, our fake website start working. That script will redirect the victim to the phishing page your derived. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnMlmpIRhfnDnHM7CGWvWsmMY3IehCgTqzLAX_U6ki3w6T54pbokySoARQdGXaxbs90Y8VjEY7WdbpES-gGROYCn-tIwtDLjPX1XkJsXLmAH8_224xCdb67VylB3rOg52aAn4TYSgy3XRb/s1600/8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnMlmpIRhfnDnHM7CGWvWsmMY3IehCgTqzLAX_U6ki3w6T54pbokySoARQdGXaxbs90Y8VjEY7WdbpES-gGROYCn-tIwtDLjPX1XkJsXLmAH8_224xCdb67VylB3rOg52aAn4TYSgy3XRb/s520/8.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv47HfRzZX5REPWkHXVb_cpMVSGCu-bCrUUHDCMDWxXHn-m-a5oK4sNS7Q-vPLcNCOip_pKKVHN39WQNevX2peYFfQRHkJapN9oVMnJtSLx2PV5eXG3ASqgOZjDzbU01L9-gOEhIqUpwly/s1600/9.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv47HfRzZX5REPWkHXVb_cpMVSGCu-bCrUUHDCMDWxXHn-m-a5oK4sNS7Q-vPLcNCOip_pKKVHN39WQNevX2peYFfQRHkJapN9oVMnJtSLx2PV5eXG3ASqgOZjDzbU01L9-gOEhIqUpwly/s320/9.png" /></a></div>here yyou goes these are the user id and password of the victim :D. 
be safe keep hacking :).

Tabnabbing Attack with social Engineering toolkit on Backtrack | kali

Hi everyone here is the post that basically explain about very fundamental attack known to be tab nabbing attack.the attack is very simple a...

Hack Remote Windows 7 | XP PC With Metasploit (Browser Auto Pwn Vulnerability)

Hi all this is one of the popular attack know as browser auto pwn Vulnerability which we are going to use in this tutorial. 
This is a simple vulnerability that allow attacker to hack to remote machine just by a single click by the victim. 
-::Using Metasploit::- 
in metasploit there is a module known as browser autopwn.The basic idea behind that module is that it creates a web server in our local machine which will contain different kind of browser exploits.When the user will open the malicious link then the execution of the exploits will start against the browser of the user and if one of the exploits is successful a meterpreter session will open. 
 
follow these steps to carry out the attack. 
open you backtrack/kali terminal make sure metasploit is there (which is present by default :D ). 
type #msfconsole on terminal 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbzcoSzRv2ObzIjC7bZ-hh6rurjLnRlc6NFdRW1aho1zZkQ7vGTCmGYfXhwqWS6NKv5yXiCVg7ZP0jP5-DYL5op64Q7mO-n8_KLLZ2o6QzzlT_W3EzT7Qv-d2tEHIK7dPGMTl9EQptrKnO/s1600/msfconsole.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="msfconsole" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbzcoSzRv2ObzIjC7bZ-hh6rurjLnRlc6NFdRW1aho1zZkQ7vGTCmGYfXhwqWS6NKv5yXiCVg7ZP0jP5-DYL5op64Q7mO-n8_KLLZ2o6QzzlT_W3EzT7Qv-d2tEHIK7dPGMTl9EQptrKnO/s520/msfconsole.png" /></a></div> 
Now follow these steps as show in image 
use the browser_autopwn module 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYdqnkgj6U7hQiB-GmD0PyPYV33iGG1lE9ebC9LOMWwZ8FIDmnh5WqbYhspVXP8B6OfGxo3U8LA44r5qjPrkpOVuHvkDKM5aWA380wbZMc3th45NoA0KI0TYFBI-oXwr0I9J7TwmYsU4DB/s1600/use+auxiliry.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="use browser auto pwn" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYdqnkgj6U7hQiB-GmD0PyPYV33iGG1lE9ebC9LOMWwZ8FIDmnh5WqbYhspVXP8B6OfGxo3U8LA44r5qjPrkpOVuHvkDKM5aWA380wbZMc3th45NoA0KI0TYFBI-oXwr0I9J7TwmYsU4DB/s920/use+auxiliry.png" width="580" /></a></div> 
We have set up the LHOST with our IP address,the port to be 4445 and the URIPATH with / in order to prevent metasploit to set up random URL’s.now you will see below image. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMr-rPzCaHbvyu8wJ_Iv-uA1t25A-pvfJHsv2AvqFStRY5ihEvfKJkWNteXm3WrfJAk2Z6fE2tgCAL_mXGD_wzY7cVHQbj2ZxPNK-hkCpKqoQp_5u1PNtupl1tEvCPLEO33HdV6nolfWKd/s1600/server+started.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="server started with 16 module" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMr-rPzCaHbvyu8wJ_Iv-uA1t25A-pvfJHsv2AvqFStRY5ihEvfKJkWNteXm3WrfJAk2Z6fE2tgCAL_mXGD_wzY7cVHQbj2ZxPNK-hkCpKqoQp_5u1PNtupl1tEvCPLEO33HdV6nolfWKd/s320/server+started.png" /></a></div>Server started with 16 module. 
next we need to send the link to victim (like here http://192.168.205.131:8080/).as soon as the victim open the link its all done. 
we have the meterpreter shell control in out hand you can do various activity you wish with meterpreter shell functionality. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyoIKuudbNSWEo_R72nyn9jfHFUrRDeOPi3O112SaTxra2oV7mSTph3FWoz81p4ZQFB85KbHdtTMO-apCJVrTFaKZVWkjDG_tThozXgs8ld13tSCHwV6hz-J9mvDFHryfwNeyC8Wsemvk1/s1600/hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyoIKuudbNSWEo_R72nyn9jfHFUrRDeOPi3O112SaTxra2oV7mSTph3FWoz81p4ZQFB85KbHdtTMO-apCJVrTFaKZVWkjDG_tThozXgs8ld13tSCHwV6hz-J9mvDFHryfwNeyC8Wsemvk1/s920/hacked.png" /></a></div> 
Enjoy the hack of your victim machine have fun .

Hack Remote Windows 7 | XP PC With Metasploit (Browser Auto Pwn Vulnerability)

Hi all this is one of the popular attack know as browser auto pwn Vulnerability which we are going to use in this tutorial. This is a simpl...

Downloadable Vulnerable Web Application For Practice Hacking Skills

:Part2: 
In part1 of this post i have listed <a href="http://www.darksite.co.in/2014/01/online-sites-for-practice-hacking-skills.html">Online | Live Sites For Practice Web Application Hacking Skills</a> Now here i will give you links for downloading iso/zip file which you can install and enjoy in best possible way. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL4T9YjlnAEoChIWYLi7c1SyMoAeQ4NcNQy5-M2C0zrgZ_Yos3gKmkOfxBQehu5jlThveQsEiRZ1ClJRFUzaGcbHITlcJx8KryPYZpip4ApR4GusaSVBeOjR0ZCVUKoD69rbLbcS1ieMr0/s1600/offline+hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hacking practice vulnerable" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL4T9YjlnAEoChIWYLi7c1SyMoAeQ4NcNQy5-M2C0zrgZ_Yos3gKmkOfxBQehu5jlThveQsEiRZ1ClJRFUzaGcbHITlcJx8KryPYZpip4ApR4GusaSVBeOjR0ZCVUKoD69rbLbcS1ieMr0/s1600/offline+hacking.jpg" /></a></div>with these vulnerable web applications you can test your web hacking knowledge, pen-testing tools, skills, and kung-fu on, with an added bonus... without going to jail :) The vulnerable web applications have been classified in two categories: offline, VMs/ISOs. 
The following list references downloadable vulnerable web applications to play with that can be installed on a standard operating system (Linux, Windows, Mac OS X, etc) using a standard web platform (Apache/PHP, Tomcat/Java, IIS/.NET, etc).i am sure this will sharp your hacking skill,take these as a challenge and i am sure this will be a boost for you. 
<h2>List of offline VM/Isos For Practicing Hacking Skills </h2> 
<li>The BodgeIt Store (Java): <a href="http://code.google.com/p/bodgeit/">http://code.google.com/p/bodgeit/</a> (<a href="http://code.google.com/p/bodgeit/downloads/list">download</a>)</li> 
 
<li>OWASP Bricks (PHP): <a href="http://sechow.com/bricks/index.html">http://sechow.com/bricks/index.html</a> (<a href="http://sechow.com/bricks/download.html">download</a> & <a href="http://sechow.com/bricks/docs/">docs</a>)</li> 
 
<li>The ButterFly Security Project (PHP): <a href="http://sourceforge.net/projects/thebutterflytmp/">http://sourceforge.net/projects/thebutterflytmp/</a> (<a href="http://sourceforge.net/projects/thebutterflytmp/files/">download</a>)</li> 
 
<li>bWAPP - an extremely buggy web application! (PHP): <a href="http://www.itsecgames.com/">http://www.itsecgames.com</a> (<a href="http://sourceforge.net/projects/bwapp/files/">download</a>) (<a href="http://itsecgames.blogspot.be/2013/01/bwapp-installation.html">docs</a>)</li> 
 
<li>Damn Vulnerable Web Application - DVWA (PHP): <a href="http://www.dvwa.co.uk/">http://www.dvwa.co.uk</a> (<a href="http://code.google.com/p/dvwa/downloads/list">download</a>) </li> 
 
<li>Damn Vulnerable Web Services - DVWS (PHP): <a href="http://dvws.secureideas.net/">http://dvws.secureideas.net</a> (<a href="http://dvws.secureideas.net/downloads/files/dvws.tgz">download</a>)</li> 
 
<li>OWASP Hackademic Challenges Project (PHP): <a href="https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project">https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project</a> (<a href="https://code.google.com/p/owasp-hackademic-challenges/">download</a>)</li> 
 
<li>Google Gruyere (Python): <a href="http://google-gruyere.appspot.com/">http://google-gruyere.appspot.com</a> (<a href="http://google-gruyere.appspot.com/gruyere-code.zip">download</a>)</li> 
 
<li>Hacme Bank (.NET): <a href="http://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx">http://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-bank.aspx">download</a>)</li> 
 
<li>Hacme Books (Java): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmebooks.aspx">download</a>)</li> 
 
<li>Hacme Casino (Ruby on Rails): <a href="http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx">http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-casino.aspx">download</a>)</li> 
 
<li>Hacme Shipping (ColdFusion): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmeshipping.aspx">download</a>)</li> 
 
<li>Hacme Travel (C++): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmetravel.aspx">download</a>)</li> 
 
<li>OWASP Insecure Web App Project (Java): <a href="https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project">https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project</a> (<a href="http://sourceforge.net/projects/insecurewebapp/files/">download</a> - orphaned)</li> 
 
<li>Mutillidae (PHP): <a href="http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10">http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10</a> (<a href="http://www.irongeek.com/mutillidae/">download</a>)</li> 
 
<li>OWASP .NET Goat (C#): <a href="https://owasp.codeplex.com/">https://owasp.codeplex.com</a> (<a href="https://owasp.codeplex.com/SourceControl/list/changesets#">download</a>)</li> 
 
<li>Peruggia (PHP): <a href="http://peruggia.sourceforge.net/">http://peruggia.sourceforge.net</a> (<a href="http://sourceforge.net/projects/peruggia/files/">download</a>)</li> 
 
<li>Puzzlemall (Java): <a href="https://code.google.com/p/puzzlemall/">https://code.google.com/p/puzzlemall/</a> (<a href="https://code.google.com/p/puzzlemall/downloads/list">download</a>) (<a href="https://code.google.com/p/puzzlemall/downloads/list">docs</a>)</li> 
 
<li>Stanford Securibench (Java) & <a href="http://suif.stanford.edu/~livshits/work/securibench-micro/">Micro</a>: <a href="http://suif.stanford.edu/~livshits/securibench/">http://suif.stanford.edu/~livshits/securibench/</a> (<a href="http://suif.stanford.edu/~livshits/securibench/download.html">download</a>)</li> 
 
<li>SQLI-labs (PHP): <a href="https://github.com/Audi-1/sqli-labs">https://github.com/Audi-1/sqli-labs</a> (<a href="https://github.com/Audi-1/sqli-labs/archive/master.zip">download</a>) (<a href="http://dummy2dummies.blogspot.com/">blog</a>)</li> 
 
<li>SQLol (PHP): <a href="https://github.com/SpiderLabs/SQLol">https://github.com/SpiderLabs/SQLol</a> (<a href="https://github.com/SpiderLabs/SQLol/archive/master.zip">download</a>)</li> 
 
<li>OWASP Vicnum Project (Perl & PHP): <a href="https://www.owasp.org/index.php/Category:OWASP_Vicnum_Project">https://www.owasp.org/index.php/Category:OWASP_Vicnum_Project</a> (<a href="http://sourceforge.net/projects/vicnum/files/">download</a>)</li> 
 
<li>VulnApp (.NET): <a href="http://www.nth-dimension.org.uk/blog.php?id=88">http://www.nth-dimension.org.uk/blog.php?id=88</a> (<a href="http://projects.nth-dimension.org.uk/dir?d=VulnApp">CVS download</a> & <a href="http://projects.nth-dimension.org.uk/rptview?rn=6">vulns</a>)</li> 
 
<li>WackoPicko (PHP): <a href="https://github.com/adamdoupe/WackoPicko">https://github.com/adamdoupe/WackoPicko</a> (<a href="https://github.com/adamdoupe/WackoPicko/zipball/master">download</a>) (<a href="http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf">whitepaper</a>)</li> 
 
<li>OWASP WebGoat (Java): <a href="https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project">https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project</a> (<a href="http://code.google.com/p/webgoat/downloads/list">download</a>) (<a href="https://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents">guide</a>)</li> 
 
<li>OWASP ZAP WAVE - Web Application Vulnerability Examples (Java): <a href="http://code.google.com/p/zaproxy/downloads/list">http://code.google.com/p/zaproxy/downloads/list</a></li> 
 
<li>Wavsep - Web Application Vulnerability Scanner Evaluation Project (Java): <a href="https://code.google.com/p/wavsep/">https://code.google.com/p/wavsep/</a> (<a href="https://code.google.com/p/wavsep/downloads/list">download</a>) (<a href="https://code.google.com/p/wavsep/downloads/list">docs</a>)</li> 
 
<li>WIVET - Web Input Vector Extractor Teaser: <a href="https://code.google.com/p/wivet/">https://code.google.com/p/wivet/</a> (<a href="http://www.webguvenligi.org/projeler/wivet">download</a>) (<a href="https://code.google.com/p/wivet/downloads/list?can=1&q=">tests</a>)</li> 
 
<h2>Virtual Machines (VMs) or ISO images</h2> 
The following list references pre-installed and ready to use virtual machines (VMs) or ISO images that contain one or multiple vulnerable web applications to play with. 
<li>BadStore (ISO): <a href="http://www.badstore.net/">http://www.badstore.net</a> (<a href="http://www.badstore.net/register.htm">download</a> - registration required)</li> 
 
<li>Bee-Box (bWAPP VMware): <a href="http://sourceforge.net/projects/bwapp/files/bee-box/">http://sourceforge.net/projects/bwapp/files/bee-box/</a></li> 
 
<li>OWASP BWA - Broken Web Applications Project (VMware - <a href="http://code.google.com/p/owaspbwa/wiki/ProjectSummary">list</a>): <a href="https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project">https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project</a> (<a href="http://code.google.com/p/owaspbwa/wiki/Downloads">download</a>)</li> 
 
<li>Drunk Admin Web Hacking Challenge (VMware): <a href="https://bechtsoudis.com/work-stuff/challenges/drunk-admin-web-hacking-challenge/">https://bechtsoudis.com/work-stuff/challenges/drunk-admin-web-hacking-challenge/</a> (<a href="http://bechtsoudis.com/data/challenges/drunk_admin_hacking_challenge.zip">download</a>) </li> 
 
<li>Exploit.co.il Vuln Web App (VMware): <a href="http://exploit.co.il/projects/vuln-web-app/">http://exploit.co.il/projects/vuln-web-app/</a> (<a href="http://sourceforge.net/projects/exploitcoilvuln/files/">download</a>)</li> 
 
<li>GameOver (VMware): <a href="http://sourceforge.net/projects/null-gameover/">http://sourceforge.net/projects/null-gameover/</a> (<a href="http://sourceforge.net/projects/null-gameover/files/">download</a>)</li> 
 
<li>Hackxor (VMware): <a href="http://hackxor.sourceforge.net/cgi-bin/index.pl">http://hackxor.sourceforge.net/cgi-bin/index.pl</a> (<a href="http://sourceforge.net/projects/hackxor/files/">download</a>) (<a href="http://hackxor.sourceforge.net/cgi-bin/hints.pl">hints&tips</a>)</li> 
 
<li>Hacme Bank Prebuilt VM (VMware): <a href="http://ninja-sec.com/index.php/hacme-bank-prebuilt-vmware-image-ninja-sec-com/">http://ninja-sec.com/index.php/hacme-bank-prebuilt-vmware-image-ninja-sec-com/</a> (<a href="http://dc121.4shared.com/download/wwPhUxMQ/hackme_bank_vm_Ninja-Sec.zip">download</a>)</li> 
 
<li>Kioptrix4 (VMware & Hyper-V): <a href="http://www.kioptrix.com/blog/?p=604">http://www.kioptrix.com/blog/?p=604</a> (<a href="http://www.kioptrix.com/dlvm/Kioptrix4_vmware.rar">download</a>) </li> 
 
<li>LAMPSecurity (VMware): <a href="http://sourceforge.net/projects/lampsecurity/">http://sourceforge.net/projects/lampsecurity/</a> (<a href="http://sourceforge.net/projects/lampsecurity/files/">download</a>) (<a href="http://sourceforge.net/projects/lampsecurity/files/Documentation/">doc</a>)</li> 
 
<li>Metasploitable (VMware): <a href="http://blog.metasploit.com/2010/05/introducing-metasploitable.html">http://blog.metasploit.com/2010/05/introducing-metasploitable.html</a> (<a href="http://updates.metasploit.com/data/Metasploitable.zip.torrent">download</a> - torrent) (<a href="http://www.metasploit.com/learn-more/how-do-i-use-it/test-lab.jsp">doc</a>)</li> 
 
<li>Metasploitable 2 (VMware):  
<a href="https://community.rapid7.com/docs/DOC-1875">https://community.rapid7.com/docs/DOC-1875</a> (<a href="https://sourceforge.net/projects/metasploitable/files/Metasploitable2/">download</a>)</li> 
 
<li>Moth (VMware): <a href="http://www.bonsai-sec.com/en/research/moth.php">http://www.bonsai-sec.com/en/research/moth.php</a> (<a href="http://sourceforge.net/projects/w3af/files/moth/moth/">download</a>)</li> 
 
<li>PentesterLab - The Exercises (ISO & PDF): <a href="https://www.pentesterlab.com/exercises/">https://www.pentesterlab.com/exercises/</a> </li> 
 
<li>PHDays I-Bank (VMware):  
<a href="http://phdays.blogspot.com.es/2012/05/once-again-about-remote-banking.html">http://phdays.blogspot.com.es/2012/05/once-again-about-remote-banking.html</a> (<a href="http://downloads.phdays.com/phdays_ibank_vm.zip">download</a>)</li> 
 
<li>Samurai WTF (ISO - list): <a href="http://www.samurai-wtf.org/">http://www.samurai-wtf.org</a> (<a href="http://sourceforge.net/projects/samurai/files/">download</a>)</li> 
 
<li>Sauron (Quemu) [Spanish]: <a href="http://sg6-labs.blogspot.com/2007/12/secgame-1-sauron.html">http://sg6-labs.blogspot.com/2007/12/secgame-1-sauron.html</a> (<a href="http://sg6-labs.blogspot.com/search/label/SecGame">solutions</a>)</li> 
 
<li>UltimateLAMP (VMware - <a href="http://www.metasploit.com/learn-more/how-do-i-use-it/test-lab.jsp">list</a>): <a href="http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/">http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/</a> (<a href="http://ronaldbradford.com/tmp/UltimateLAMP-0.2.zip">download</a>)</li> 
 
<li>Virtual Hacking Lab (ZIP): <a href="http://sourceforge.net/projects/virtualhacking/">http://sourceforge.net/projects/virtualhacking/</a> (<a href="http://sourceforge.net/projects/virtualhacking/files/">download</a>)</li> 
 
<li>Web Security Dojo (VMware, VirtualBox - <a href="http://www.mavensecurity.com/web_security_dojo/">list</a>): <a href="http://www.mavensecurity.com/web_security_dojo/">http://www.mavensecurity.com/web_security_dojo/</a> (<a href="http://sourceforge.net/projects/websecuritydojo/files/">download</a>)</li> 
 
You can have a lots of fun time with these so why to waste time download and gets started now .Happy hacking :)

Downloadable Vulnerable Web Application For Practice Hacking Skills

: Part2 : In part1 of this post i have listed Online | Live Sites For Practice Web Application Hacking Skills Now here i will give you lin...

PHP Script For Cracking http Basic Authentication

Tabnabbing Attack with social Engineering toolkit on Backtrack | kali

Hack Remote Windows 7 | XP PC With Metasploit (Browser Auto Pwn Vulnerability)

Downloadable Vulnerable Web Application For Practice Hacking Skills

Popular Posts

Blog Archive