wackopicko
WackoPicko is a shooting range website specifically designed to test and learn Web application security, developed by Adam Doupé. WackoPicko simulates a real-life Web application scenario that contains a variety of common vulnerability types and is ideal for security researchers, penetration testers, and beginners to use as a practice and testing tool. It is recommended to use a browser to open it
reflected XSS http://localhost/pictures/search.php? query=blah The query parameter is flawed. Storage XSS http://localhost/guestbook.php There is a loophole in the comment field. SessionID vulnerability http://localhost/admin/login.php The value of the session cookie is admin_session, which is a self-increasing value. Storage SQL injection http://localhost/users/register.php -> http://localhost/users/similar.php A stored SQL injection vulnerability exists in the name field in the registered user form, which has not been cleared on similar user pages. Reflective SQL injection http://localhost/users/login.php There is a vulnerability in the username field. directory traversal http://localhost/pictures/upload.php The label field contains a directory traversal vulnerability that allows malicious users to overwrite any file that the Web server has permissions to access. Multi-step storage XSS http://localhost/pictures/view.php? picid=3 The comment field is vulnerable to XSS attacks, but needs to go through a preview form. Forced browsing http://localhost/pictures/highquality.php? picid=3&key=highquality Users can view high-quality versions of the pictures without having to purchase them. command-line injection http://localhost/passcheck.php Password fields are vulnerable to command-line injection attacks. File contains vulnerabilities http://localhost/admin/index.php? page=login Page parameters have a file inclusion vulnerability, but need to include %00 at the end. parameter manipulation http://localhost/users/sample.php? userid=1 The userid parameter can be manipulated to view any user's page, which usually requires login. Reflective XSS hidden behind JavaScript http://localhost/piccheck.php The name parameter is vulnerable. logical flaws http://localhost/cart/review.php Coupons can be applied multiple times to reduce the order price to zero. The coupon code in the initial data is SUPERYOU21. Reflective XSS hidden behind Flash forms http://localhost/submitname.php The value parameter is vulnerable. Weak username/password https://localhost/admin/login.php There is a default username/password combination: admin/admin.
