WackoPicko – Vulnerable Website For Learning & Security Tool Evaluation

Use Netsparker


There are various vulnerable web applications out there to hone your skills or test the latest web vulnerability scanner you downloaded, one such package would be Damn Vulnerable Web App – Learn & Practise Web Hacking.

There are others such as:

Another I learned of recently is WackoPicko, it’s basically a website that contains known vulnerabilities and was first used for the paper Why Johnny Can’t Pentest: An Analysis of Black-box Web Vulnerability Scanners [PDF].

To Install From Source

Download the source package as below, then import the WackoPicko database into MySQL using a command like the following:

This will create the MySQL user WackoPicko with the password webvuln!@# as well as create the WackoPicko table. The final step is to enable read/write access to the upload directory of WackoPicko for the webserver user. An easy way to do this is:


Known Issues

  • The search bar doesn’t appear in Internet Explorer.
  • There are some onions hanging around (particularly in the upload folder) but I kept them there to preserve parity with the version used during the tests.
  • WackoPicko was developed with the assumption that is was running as the root application as the URL and won’t work running as a directory.

You can download WackoPicko here:

Source: WackoPicko.zip
Pre-Built Image: WackoPicko.iso

Or read more here.

Posted in: Exploits/Vulnerabilities, Secure Coding, Web Hacking

, , , , ,


Latest Posts:


Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.
How To Recover When Your Website Got Hacked How To Recover When Your Website Got Hacked
The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don't know what to do, or even where to start.
HTTrack - Website Downloader Copier & Site Ripper Download HTTrack – Website Downloader Copier & Site Ripper Download
HTTrack is a free and easy-to-use offline browser utility which acts as a website downloader and a site ripper for copying websites and downloading them for offline viewing.
sshLooter - Script To Steal SSH Passwords sshLooter – Script To Steal SSH Passwords
sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in.
Intercepter-NG - Android App For Hacking Intercepter-NG – Android App For Hacking
Intercepter-NG is a multi functional network toolkit including an Android app for hacking, the main purpose is to recover interesting data from the network stream and perform different kinds of MiTM attacks.


Comments are closed.