Bodgeit

The BodgeIt Store is a vulnerable Web application that is aimed primarily at newcomers to penetration testing. Some of the features and characteristics of the BodgeIt Store include: - Easy to install: You only need Java and a servlet engine, such as Tomcat. - Self-contained: No additional dependencies are required in addition to the above requirements. - Easy to change dynamically: All functions are implemented in JSP, so no IDE is needed. - Cross-platform support. - Open source. - There is no need to install and configure the database separately: it uses an "in-memory" database that is automatically (re-) initialized at startup. You can use penetration testing tools to discover vulnerabilities more easily. If you don't have a tool you like, I recommend using Zed Attack Proxy (I am the person in charge of this project). The BodgeIt Store contains the following major vulnerabilities: - Cross-site scripting attack (XSS) - SQL injection - Hide (but not protect) content - Cross-site Request Forge (CSRF) - debugging code - unsafe object references - Application logic vulnerability