Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be light weight, easy to use and full of vulnerabilities to exploit. Used to learn or teach the art of web application security. Vulnerabilities SQL Injection XSS (Cross Site Scripting) LFI (Local File Inclusion) RFI (Remote […]
web-application-security
Twitter Hack Spreads P*rn Trojan
[ad] I had a spam tweet appear in my stream a while back and like Guy Kawasaki I also had absolutely no idea where it came from. Perhaps some kinda XSS flaw in Twitter when I visited a site that spawned the message (in a hidden iframe perhaps). It wouldn’t be the first time Twitter […]
Acunetix Web Vulnerability Scanner (WVS) 6.5 Released
[ad] You may remember a while back we did a Review of Acunetix Web Vulnerability Scanner 6 – the very full featured web vulnerability scanning software. Well the latest version has been released recently with some updates, bug fixes and improvements on the web application security front. I’m hoping to try out the AcuSensor on […]
Massive Malware Outbreak Infects 30,000 Websites
[ad] This looks like a fairly complex infection mechanism combining exploiting websites, injecting JavaScript code then attempted exploitation of host machines and failing that prompting a download for some fake malware. The way they have it all setup is pretty clever too hiding behind common technologies so their infections don’t look out of place. An […]
Samurai Web Testing Framework 0.6 Released – Web Application Security LiveCD
[ad] You may remember we wrote about Samurai being released back in November 2008, it’s been quite a while since the last update. The authors have updated and fixed a number of issues with the environment as well as improved performance of the java based tools. They have also included a virtual machine of the […]