Vulnerable virtual machine.
All right, so practicing your skills always helps you and your career and your personal life, but
here we're just going to stick with your professional life, right?
So there are many ways for you to gain the knowledge of Web application penetration testing.
You can read blogs and you watch courses and you participate.
You watch videos and so on and so forth.
But nothing will ever beat actual hands on experience in order to improve your skills.
Hands on experience allows you to understand the procedures and methods of securing Web apps, so you're
going to get your hands dirty to get more out of this course.
And it's a good thing because you know what?
Muscle memory.
So I'm going to say now to accomplish everything that we've been talking about, you must have a vulnerable
Web application so that we can try to build that lab, right.
Of course, you can develop a Web app by yourself, but it's not necessarily reasonable when you're
new to Web vulnerabilities.
So you must first exploit and learn what the vulnerabilities of Web applications might be and what they
look like.
So as Web penetration testers, it's vital to be aware of real world applications, which are very diverse.
And many, many ways they are built with various technologies and each of them can be served up differently.
So to be prepared for testing, we should practice and improve our skills stands to reason, right?
Now, thanks to our security community, we can find many intentionally vulnerable Web applications
on which to practice.
So that means that we can download these applications source code and then use him in our environment.
Also, there are some pre-built virtual machines that contain these applications already.
And by using these virtual machines and applications that way, you ensure that you have a safe environment
in which to work.
Box, no, I didn't say beat box, although that would be fun.
But I just want to let you know that you can develop your attacking skills, identify and exploit vulnerabilities
in Web applications with this.
This is an old WASP project called Vulnerable App Directory Project.
And it holds in categorises pretty much almost everything for us.
Most of the vulnerable applications can be found in this project.
Now, here are many options when you need vulnerable applications in virtual machines.
Now, thanks to the community for this purpose, many buggy apps are developed.
So that means it's intentional.
Mm hmm.
You can find and review a list of all known vulnerable Web applications here.
And if you're not necessarily comfortable using an already built configuration, of course, you can
create your own vulnerable system from the very beginning.
Some developers, that's what they do without even knowing it.
I'm just kidding.
All right.
So I need to be honest with you.
When I was first planning out this course, I was planning to create a vulnerable machine from the very
beginning by myself.
And have you do it as well.
As I've said, I really do believe that this has many benefits in order to learn application deployment
process at the very least.
But as I already told you, what I decided was it's too time consuming and it certainly isn't for beginners.
So for that reason and others, we're not going to do it that way in this cause.
We're going to use a prepared virtual machine called PAYBOX.
OK, so B box contains the buggy application, B, WAP.
Buggy web application, in case you're wondering, therefore, we are going to play with the B WAP in
this court.
So it's based on P and it runs on the minus Google database server at the back end.
It has three levels of security, low, medium and high.
And each level demands different skills.
So it covers all risks from the WASP Top 10 project with all major known Web vulnerabilities such as
excess six RF school injection file injection, upload flaws and many more.
So at any time, you can easily reset the database if you figure that you want to start over again.
And it comes with a simple, straightforward interface, alas.
Don't let that deceive you.
Because it's only for learning purposes now, another great feature, you can also view the vulnerability
in the source code.
So it means that you don't really need to try something blindly, like a script kiddie.
You can observe and measure what you're doing by looking at the source code.
OK, anyway, let's just install this box into the lab.
So open up your favorite browser and this time Type B Web.
And follow the first link from the results of the search, and here we are, the official Web site of
the owner of the application.
And then we can go to the download page.
Click the link below to download PAYBOX.
And you will be redirected to SourceForge dot net.
So click here to download and save the file.
Download or take a few minutes.
And this time, I am absolutely sure that I'm not going to record the entire download process.
OK, so after the download finishes, go to your download folder.
And what do you know?
Here is a downloaded file in seven zip format again.
Let me just close the browser so you can have a clean view.
OK, so right, click on the file, extract the files.
I'm going to extract it to a new folder under the previous folder that I created for virtual machines
at the beginning of the course.
And I'll wait a few seconds until the extraction finishes.
All right, so the extraction is done.
Let's go to the folder.
And here are the files.
And double click on the file with this VM X extension.
And now the virtual machine will start in full screen automatically.
And again, we're going to come up against this warning and just click on I moved it and continue.
OK, so now in a few seconds, the box will start.
And here is the desktop environment of our virtual machine.
And I'm going to offer congratulations yet again, you have imported a vulnerable machine into your
lab environment.
Good job.
All right, so now we have imported the preinstalled b WAP virtual machine.
It's also possible to download the application code itself and use it, but we're not going to do it
that way.
So one thing to keep in mind, these kinds of applications are they're damn vulnerable.
Don't upload them to an Internet facing server.
They will be compromised.
So believe me, I did it once for experimental purposes and it did not take any time at all for it to
be hacked.
Now, in case you think I'm giving you permission to do that again, just make sure that you set it
up in a secure environment.