Web应用安全

Question

嗨，有人知道其他类似Webgoat的程序来演示Web应用程序安全漏洞吗？

Answer 1

There are plenty of them. Some hosted, some for local installation. Some targeted more to teaching about web security, others for testing. Fortunately some folks already made some lists:

http://slogic.net/training/vulnerable-web-applications-to-learn-web-application-testing-skills

http://securitythoughts.wordpress.com/2010/03/22/vulnerable-web-applications-for-learning

http://www.owasp.org/index.php/Phoenix/Tools#Testing_grounds

I personally would start with Google Gruyere (http://google-gruyere.appspot.com/).

Answer 2

这里有一个非常好的列表： http : //ha.ckers.org/blog/20090406/hacking-without-all-the-jailtime/

Answer 3

还可以看一下Codebashing-它们是一个基于SaaS的电子学习平台，可提供交互式应用程序安全战争游戏。

Answer 4

Take a look at:

• OWASP Testing Project

• Acunetix Web Security Scanner

Acunetix WVS automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.

Answer 5

http://www.dvwa.co.uk/ http://www.itsecgames.com/ https://www.owasp.org/index.php/OWASP_Bricks#tab=Main https://sourceforge.net/projects/mutillidae/
我也喜欢真正有趣的dawa和murillidae。

Answer 6

The big ones I would think of would be Fortify and HP WebInspect.

Fortify will scan the source code and find potential vulnerabilities HP WebInspect will scan/brute force a website in production and find/report actual vulnerabilities.

Both require a fairly expensive license.