0
votes

I am looking for sample test cases for all 10 vulnerabilities to exploit those scenarios. I would highly appreciate if any one share or share the link for test cases for a web application with all 10 vulnerabilities or any OWASP vulnerability?

locked by schroeder Aug 10 '18 at 12:17

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

Read more about locked posts here.

  • 2
    While I do not know whether such a test case exist I doubt that it will be very valuable. SQL Injection samples are available in the web. Having a sample showing one specific type may create the impression that fixing this will make your app save from sql injection, which is not necessarily true. Therefore such test cases would not be complete and imply that making these test cases pass result in a secure application. – Samuel Aug 20 '14 at 10:53
  • you're looking for test cases to run against your own site? There are numerous testing suites that run a battery of tests for most of the OWASP top 10. – schroeder Aug 20 '14 at 22:50
4
votes

There are loads. Mutillidae, Damn Vulnerable Web App, WebGoat, BWaPP etc. Also, check out vulnhub, hack.me and others like them.

  • I want to test manually..so asking for test cases. Please help me out here – Aruna Aug 20 '14 at 12:23
  • 4
    @Aruna maybe you should first look up what WebGoat is, actually put in some effort and then come back with a request for help if you have a SPECIFIC problem. – Lucas Kauffman Aug 20 '14 at 12:35
1
vote

We have an OWASP project which tracks vulnerable web apps: https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project

The OWASP Top 10 is actually all about risks rather than vulnerabilities. So its not really possible to have simple examples for all of them. For example, how many ways are there to 'misconfigure security' (A5)? As many ways as there are different web apps I'd guess ;)

1
vote

You can take a look at the Software Assurance Reference Dataset http://samate.nist.gov/SARD/index.php - These are effectively vulnerable code snippets for multiple programming languages and include the OWASP top 10 vulnerabilities.

However, if you want to try live examples you can try a number of opensource or commercial wargame apps:

HackMe

Owasp WebGoat

Codebashing

Damn Vulnerable Web Application

Not the answer you're looking for? Browse other questions tagged or ask your own question.