Installasi Vulnerable Web Application untuk latihan Hacking

Setelah melakukan instalasi Server Linux CentOS atau Ubuntu maka sekarang kita akan melakukan instalasi Mutillidae, bWAPP dan DVWA.

Login sebagai root

Selanjutnya silahkan download mutillidae link ini
Setelah itu di extract:

# unzip mutillidae-x.x.xx.zip -d /var/www/html
# chown -R apache:apache /var/www/html/mutillidae 
# chmod 777 /var/www/html/mutillidae/test

Create Mariadb database untuk mutillidae: gunakan browser ke http://IPserver/phpmysql login dengan user root Mariadb.

Click Users Tab, lalu click Add User:

User name diisi: mutillidae
Host diisi dengan localhost
Click tombol Generate untuk generate password, harap dicatat password ini untuk diinut di config file mutillidae nanti
Lakukan check mark pada bagian Create database with the same name and grant all privileges lalu tekan tombol Go.

Lakukan edit file config dari mutillidae:

# nano /var/www/html/mutillidae/includes/database-config.php

<?php
define('DB_HOST', 'localhost');
define('DB_USERNAME', 'mutillidae');
define('DB_PASSWORD', 'password yang dibuat');
define('DB_NAME', 'mutillidae');
?>

Lalu di browser http://IPServer/mutillidae:

Click tombol Opt Out:

Lalu click Reset DB:

Click tombol OK
Sekarang mutillidae siap digunakan http://IPaddress/mutillidae: login dengan admin/adminpass

Selanjutnya kita akan install Damn Vulnerable Web Application (DVWA). Pertama-tama kita download dulu dari sini. Setelah itu extract:

# unzip DVWA-master.zip -d /var/www/html/
# cd /var/www/html
# mv DVWA-master/ dvwa/
# chown -R apache:apache dvwa
# nano /etc/php.ini

[.....]
;;;;;;;;;;;;;;;;;;
; Fopen wrappers ;
;;;;;;;;;;;;;;;;;;
; Whether to allow the treatment of URLs (like http:// or ftp://) as files.
; http://php.net/allow-url-fopen
allow_url_fopen = On
; Whether to allow include/require to open URLs (like http:// or ftp://) as fil$
; http://php.net/allow-url-include
allow_url_include = On
; Define the anonymous ftp password (your email address). PHP's default setting
; for this is empty.
[.....]
[...]
;error_reporting = E_ALL & ~E_DEPRECATED
error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PAppp.tldTH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
cgi.fix_pathinfo=1
[...]
date.timezone = 'Asia/Jakarta'
[...]

Create user dan database di Mariadb . Browse http://IPServer/phpmyadmin

Click Users Tab, lalu click Add User:

User name diisi: dvwa
Host diisi dengan localhost
Click tombol Generate untuk generate password, harap dicatat password ini untuk diinut di config file dvwa nanti
Lakukan check mark pada bagian Create database with the same name and grant all privileges lalu tekan tombol Go.

Lakukan edit file config dari dvwa:

# cp /var/www/html/dvwa/config/config/config.inc.php.dist /var/www/html/dvwa/config/config/config.inc.php
# nano /var/www/html/dvwa/config/config/config.inc.php

[.....]
# Database variables
#   WARNING: The database specified under db_database WILL BE ENTIRELY DELETED during setup.
#   Please use a database dedicated to DVWA.
#
# If you are using MariaDB then you cannot use root, you must use create a dedicated DVWA user.
#   See README.md for more information on this.
$_DVWA = array();
$_DVWA[ 'db_server' ]   = 'localhost';
$_DVWA[ 'db_database' ] = 'dvwa';
$_DVWA[ 'db_user' ]     = 'dvwa';
$_DVWA[ 'db_password' ] = 'password yang dibikin';
[.....]

Sekarang kita siap untuk configure dvwa:
Gunakan browser http://IPServer/dvwa/setup.php:

Click tombol Create/Reset Database:
Sekarang dvwa siap digunakan http://IPserver/dvwa: Login dengan admin/password

Kemudian kita akan melakukan instalasi bWAPP:
Pertama-tama lakukan download dari sini, kemudian diextract:

# unzip bWAPP_latest.zip -d /var/www/html/
# mv /var/www/html/bWAPP_latest/ /var/www/html/bwapp
# chown -R apache:apache /var/www/html/bwapp

Create user dan database di Mariadb . Browse http://IPServer/phpmyadmin

Click Users Tab, lalu click Add User:

User name diisi: bWAPP
Host diisi dengan localhost
Click tombol Generate untuk generate password, harap dicatat password ini untuk diinut di config file bWAPP nanti
Lakukan check mark pada bagian Create database with the same name and grant all privileges lalu tekan tombol Go.

Lakukan edit file config dari bWAPP:

# nano /var/www/html/bWAPP/admin/settings.php

[.....]
// Database connection settings
$db_server = "localhost";
$db_username = "bWAPP";
$db_password = "password yang dibuat";
$db_name = "bWAPP";
[.....]

Lalu gunakan browser: http://IPserver/bWAPP/install.php

 click here:

Maka bWAPP siap digunakan dengan http://IPserver/bWAPP login dengan bee/bug