Pre-vulnerable environments and challenges for training the public to hack.
Zempirians provide pre-vulnerable environments gathered from various sources. All provided challenges can either be downloaded for your own lab or you may use the Zempirian public network to play them with no download/install required.
Find various vulnerabilities in an old but live production of AWStats to see all the various vectors that can be opened ... ...
Find various vulnerabilities in an old but live production of AWStats to see all the various vectors that can be opened up with a monitoring engine like this.
The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing. The Bod... ...
The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing. The Bodge It Store include the following significant vulnerabilities: Cross Site Scripting, SQL injection, Hidden (but unprotected) content, Cross Site Request Forgery, Debug code, Insecure Object References, Application logic vulnerabilities.
CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Re... ...
CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks. Use this game to test vulnerable and invulnerable setups.
ACCESS
ssh openhacker@dvl.training.zempirians.com -p 20022
PASSWORD: openhacker
You must use ... ...
ACCESS
ssh openhacker@dvl.training.zempirians.com -p 20022
PASSWORD: openhacker
You must use an SSH capable client to access this game since it is cli.
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid f... ...
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
User: admin
Pass: password
Please reset the Database under Setup when you are done. Resetting it will bring everything back to defaults.
The ESAPI Swingset INTERACTIVE is a web application which demonstrates common security vulnerabilities and asks users to... ...
The ESAPI Swingset INTERACTIVE is a web application which demonstrates common security vulnerabilities and asks users to secure the application against these vulnerabilities using the ESAPI library. The application is intended for Java Developers. The goal of the application is to teach developers about the functionality of the ESAPI library and give users a practical understanding of how it can be used to protect web applications against common security vulnerabilities.
Gallery is a web based software product that lets you manage your photos on your own website. You must have your own... ...
Gallery is a web based software product that lets you manage your photos on your own website. You must have your own website with PHP and database support in order to install and use it. With Gallery you can easily create and maintain albums of photos via an intuitive interface. Photo management includes automatic thumbnail creation, image resizing, rotation, ordering, captioning, searching and more. Albums and photos can have view, edit, delete and other permissions per individual authenticated user for an additional level of privacy. It's great for communities - give accounts to your friends and family and let them upload and manage their own photos on your website!
GetBoo is a Web 2.0 bookmarking system, both social (with tags) and private (with folders). Import and export your bookm... ...
GetBoo is a Web 2.0 bookmarking system, both social (with tags) and private (with folders). Import and export your bookmarks from multiple browsers. Admin management section with SPAM protection, translations, bookmarklets, Firefox extension, RSS feeds, and more!
Web based environment set to be vulnerable to: XSS, CSRF, IFrame Injection, RFI, LFI, Code Injection, Flash Injection an... ...
Web based environment set to be vulnerable to: XSS, CSRF, IFrame Injection, RFI, LFI, Code Injection, Flash Injection and more...
This codelab is built around Gruyere - a small, cheesy web application that allows its users to publish snippets of text... ...
This codelab is built around Gruyere - a small, cheesy web application that allows its users to publish snippets of text and store assorted files. "Unfortunately," Gruyere has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The goal of this codelab is to guide you through discovering some of these bugs and learning ways to fix them both in Gruyere and in general. The codelab is organized by types of vulnerabilities. In each section, you'll find a brief description of a vulnerability and a task to find an instance of that vulnerability in Gruyere. Your job is to play the role of a malicious hacker and find and exploit the security bugs. In this codelab, you'll use both black-box hacking and white-box hacking. In black box hacking, you try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior. You do not have access to the source code, although understanding how to view source and being able to view http headers (as you can in Chrome or LiveHTTPHeaders for Firefox) is valuable. Using a web proxy like Burp or WebScarab may be helpful in creating or modifying requests. In white-box hacking, you have access to the source code and can use automated or manual analysis to identify bugs. You can treat Gruyere as if it's open source: you can read through the source code to try to find bugs. Gruyere is written in Python, so some familiarity with Python can be helpful. However, the security vulnerabilities covered are not Python-specific and you can do most of the lab without even looking at the code. You can run a local instance of Gruyere to assist in your hacking: for example, you can create an administrator account on your local instance to learn how administrative features work and then apply that knowledge to the instance you want to hack. Security researchers use both hacking techniques, often in combination, in real life.
GTD-PHP is one of many possible tools for use with the productivity solution(s) described by David Allen in his book Get... ...
GTD-PHP is one of many possible tools for use with the productivity solution(s) described by David Allen in his book Getting Things Done. Please read his book; this summary does not do justice to his system, logic or years of experience. The basic idea behind his book is that you are at your most productive when you have a clear mind. His solution to "clearing your head" is to have a comprehensive, trusted, externalized organizational system to track everything in your life. Once you do so, your mind can let go of all the little things it previously spent a great deal of time tracking and repeatedly reminding. Only then can you truly focus on the task at hand, which should dramatically increase productivity. However, if your external tracking system is not complete and up to date, your mind will take back the task of worrying and nag you about things you could be or should be doing. That will continually distract you and cause stress.
Hackxor is a webapp hacking game where players must locate and exploit vulnerabilities to progress through the story. Th... ...
Hackxor is a webapp hacking game where players must locate and exploit vulnerabilities to progress through the story. Think WebGoat but with a plot and a focus on realism&difficulty. Contains XSS, CSRF, SQLi, ReDoS, DOR, command injection, etc Features: Client attack simulation using HtmlUnit; no alert('xss') here. Smooth difficulty gradient from moderately easy to fiendishly tricky. Realistic vulnerabilities modelled from Google, Mozilla, etc (No rot13!) Open ended play; progress by any means possible.
Exploit various vectors in an old vulnerable Joomla engine released to the public.... ...
Exploit various vectors in an old vulnerable Joomla engine released to the public.
... ...
Metasploitable is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, t... ...
Metasploitable is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques.
ACCESS
ssh openhacker@ms2.training.zempirians.com -p 30022
PASSWORD: openhacker
You will need a capable ssh client to play this game as it requires cli.
Mutillidae is a free, open source web application provided to allow security enthusiest to pen-test and hack a web appli... ...
Mutillidae is a free, open source web application provided to allow security enthusiest to pen-test and hack a web application. Mutillidae can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to install or administrate their own webserver. It is already installed on Samurai WTF. Simply replace existing version with latest on Samurai. Mutillidae contains dozens of vulnerabilities and hints to help the user exploit them; providing an easy-to-use web hacking environment deliberately designed to be used as a hack-lab for security enthusiast, classroom labs, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, in corporate web sec training courses, and as an "assess the assessor" target for vulnerability software.
The OrangeHRM Open Source system has an array of modules, all in one application that fulfills your main HR requirements... ...
The OrangeHRM Open Source system has an array of modules, all in one application that fulfills your main HR requirements. You can download the OrangeHRM application from our website and start using it with absolutely no cost or limitations. This version is prevulnerable from an older release.
Peruggia is designed as a safe, legal environment to learn about and try common attacks on web applications. Peruggia lo... ...
Peruggia is designed as a safe, legal environment to learn about and try common attacks on web applications. Peruggia looks similar to an image gallery, but contains several controlled vulnerabilities to practice on.
This is a vulnerable wiki system... If you have any more information, please submit it by using the 'Report' feature.... ...
This is a vulnerable wiki system... If you have any more information, please submit it by using the 'Report' feature.
A flexible web app showing vulnerabilities such as cross site scripting, sql injections, and session management issues. ... ...
A flexible web app showing vulnerabilities such as cross site scripting, sql injections, and session management issues. Helpful to IT auditors honing web security skills and setting up 'capture the flag'.
WackoPicko is a website that contains known vulnerabilities. It was first used for the paper Why Johnny Can't Pentest: A... ...
WackoPicko is a website that contains known vulnerabilities. It was first used for the paper Why Johnny Can't Pentest: An Analysis of Black-box Web Vulnerability Scanners. http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf
The Web Application Vulnerability Scanner Evaluation Project. A vulnerable web application designed to help assessin... ...
The Web Application Vulnerability Scanner Evaluation Project. A vulnerable web application designed to help assessing the features, quality and accuracy of web application vulnerability scanners. This evaluation platform contains a collection of unique vulnerable web pages that can be used to test the various properties of web application scanners.
WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar ... ...
WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. This version is of a vulnerable previous release.
WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lesson... ...
WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat in either J2EE (this page) or WebGoat.Net in ASP.NET. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application is a realistic teaching environment, providing users with hints and code to further explain the lesson. Access username: guest password: guest
WebGoat.NET is a purposefully broken ASP.NET web application. It contains many common vulnerabilities, and is intended f... ...
WebGoat.NET is a purposefully broken ASP.NET web application. It contains many common vulnerabilities, and is intended for use in classroom environments.
WIVET is a benchmarking project that aims to statistically analyze web link extractors. In general, web application vuln... ...
WIVET is a benchmarking project that aims to statistically analyze web link extractors. In general, web application vulnerability scanners fall into this category. These VAs, given a URL(s), try to extract as many input vectors as possibly they can to increase the coverage of the attack surface. WIVET provides a good sum of input vectors to any extractor and presents the results. In order an input extractor to run meaningfully, it has to provide some kind of session handling, which nearly all of the decent crawlers do.
WordPress is web software you can use to create a beautiful website or blog. We like to say that WordPress is both free ... ...
WordPress is web software you can use to create a beautiful website or blog. We like to say that WordPress is both free and priceless at the same time. This is a previous release of a vulnerable wordpress.
Yazd is an open-source (Apache License) discussion forum software that you can download customize and use. Yazd is a Jav... ...
Yazd is an open-source (Apache License) discussion forum software that you can download customize and use. Yazd is a Java based forum software that can easily be configured through an admin interface. This discussion forum software is highly flexible and uses JDBC to connect to a backend database. This is a previous release of a vulnerable engine.
The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in we... ...
The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.
Thank you for choosing Zempirians Training as your playground, if you enjoy using the public environments then please consider donating :)
Any size donation is appreciated. All donations goes towards Zempirians Academy and are done through PayPal.
Bitcoin 372wEzWXAGdgvLykKBZYuV6R97ff5FfdzU
Litecoin MQmaRekww8migNxjbBNXhrze91ijgJjDxe
USD Coin 0x7326B487eCaDF66C27Cd2d26306F4154725b1e20
irc.zempirians.com +6697
Welcome to Internet Relay Chat. The default help channel is #lobby for beginners. Please read the MOTD once connected using your favorite IRC client.
Currently we are associated with Open Hacker Labs on discord servers.
Learn HowToHack by Labs, CTF and Wargames
https://reddit.com/r/howtohack
https://reddit.com/r/openhacker
From Neophyte to an Elite Veteran you will enjoy the broad discussions of the sub community.
https://zempire.org/start/here
Zempire Portal to access Zempirian resources.
The journey starts here.
Play
Download
Documentation
Discussion
