As a target systems, we will use a few devices, one of the target devices will be oos broken web applications
or a.
A broken Web applications is a virtual machine that hosts a lot of applications prepared for training
purposes, these apps are intentionally have a lot of vulnerabilities and could also be accessed from
a main page.
The virtual machine is prepared by a WASP Open Web application security project, which is one of the
most important communities around in the application security market.
So I am now on my host machine, it's a MacBook.
Over Web browser and Google for O.W. Aspey Broken Web applications.
Those are my keywords.
The first Web site is the official website of the Broken Web Applications Project hosted under the old
WASP dot org domain.
So let's click it.
Now, this is a Web page of broken web applications.
I'll call it B way from now on.
So there are some explanations about this project here.
So you can read them if you want.
But over here on the right hand side, we have download the latest release.
So click on that.
Now we're directed to the Sound Forge Web site.
So these are the side effects of GDP.
We'll have to see a lot more approval pages like this one.
OK, so these are all the releases of the project, and the latest version is right here at the top.
So click on it and now I have three different options to download Gotabaya file the zip file and a DOT
seven zip file.
Now an obeah file is a virtual appliance used by virtualization applications such as VMware and Oracle
Virtual Box.
It's a package that contains files used to describe a virtual machine.
ZIP and 7C are the archive files and they contain the exact same VM so you can download any one of them
where the seven Z file is smaller.
OK, so I want to download the seven zip file, which is the most popular one already.
So click on the link and download will start in just a couple of seconds.
There we go.
And the downloads finished.
So now I have an otherwise BBWAA archive file, so I'll open it with an on Arqiva and double click and
here are the files inside the archive.
So I already have the VM, so I won't extract it again.
When you extract it, you will have a folder like this.
So go to the folder and here are the files of the virtual machine.
If you run the VMAX file, double click the PVM starts, if it's the first run, it asks you whether
you moved it or copied it.
Select copy and continue.
Right, so while IBM is starting, let's have a look at its settings by clicking this button.
Click here to look at the memory, 1024 megabytes of RAM as recommended.
Click Schwall to turn back to the settings.
Network settings are here to my VM is in an unrecognized network mode.
Don't pay any attention that your VM is probably in that mode by default.
I choose share with my Mac so that I can use the VM in that mode.
So now the PVM has started and we're ready to log in.
It has a route user with the password, Owais BBWAA by default, I have change it before.
So I log into the VMS by using this credential.
If config that check, if it has got an IP address and there it is, so yes, it has.
Now, putting a system on the Internet, Google DNS, for example, 88 directory, and will receive
the replies.
So it seems everything's fine and we're ready to use housebroken Web applications, VM.