As the target systems, we will use a few devices.
One of the target devices will be Owasp, Broken Web applications or BWA.
A broken web applications is a virtual machine that hosts a lot of applications prepared for training
purposes.
These apps are intentionally have a lot of vulnerabilities and could also be accessed from a main page.
The virtual machine is prepared by Owasp Open Web Application Security Project, which is one of the
most important communities around in the application security market.
So I'm now on my host machine.
It's a MacBook.
Open a web browser and Google for a broken web applications.
Those are my keywords.
The first website is the official website of the Broken Web Applications project hosted under the owasp.org
domain.
So let's click it.
Now, this is a web page of broken Web applications.
I'll call it BWA from now on.
So there are some explanations about this project here so you can read them if you want.
But over here on the right hand side, we have download the latest release, so click on that.
Now we're directed to the Soundforge website.
So these are the side effects of GDPR.
We'll have to see a lot more approval pages like this one.
Okay, so these are all the releases of the project and the latest version is right here at the top.
So click on it.
And now I have three different options to download the file, the zip file and a dot seven zip file.
Now, an Ova file is a virtual appliance used by virtualization applications such as VMware and Oracle
VirtualBox.
It's a package that contains files used to describe a virtual machine.
Zip and seven Z are the archive files and they contain the exact same VM, so you can download any one
of them where the seven Z file is smaller.
Okay, so I want to download the seven z file which is the most popular one already.
So click on the link and download will start in just a couple of seconds.
There we go.
And the download is finished.
So now I have an Owasp BWA archive file.
So I'll open it with an unarchiver and double click.
And here are the files inside the archive.
So I already have the VMs, so I won't extract it again.
When you extract it, you will have a folder like this.
So go to the folder and here are the files of the virtual machine.
If you run the VM file, double click, the VM starts.
If it's the first run, it asks you whether you moved it or copied it.
Select, copied and continue.
Right.
So while the VM is starting, let's have a look at its settings by clicking this button.
Click here to look at the memory.
1024MB of Ram is recommended.
Click show all to turn back to the settings.
Network settings are here, so my VM is in an unrecognized network mode.
Don't pay any attention to that.
Your VM is probably in Nat mode by default.
I choose share with my Mac so that I can use the VM in Nat mode.
So now the VM has started and we're ready to log in.
It has a root user with a password Owasp BWA by default.
I haven't changed it before, so I'll log into the VM by using this credential.
If config did check if it has got an IP address and there it is.
So yes it has.
Now ping a system on the internet.
Google DNS for example.
8.8.8.8.
And we'll receive the replies.
So it seems everything's fine and we're ready to use Owasp Broken Web Applications VM.