Scribd
Upload
49 views8 pages

Release Notes

The document summarizes release notes for multiple versions of the bWAPP application. It describes new bugs introduced, bugs fixed, and new features for each version. Over 100 bugs are introduced in versions 2.2 and 2.1, focusing on SQL injection, XSS, and other vulnerabilities. Each subsequent version contains additional bugs and functionality to demonstrate different web vulnerabilities.

Uploaded by

sebastián droguett
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
49 views8 pages

Release Notes

The document summarizes release notes for multiple versions of the bWAPP application. It describes new bugs introduced, bugs fixed, and new features for each version. Over 100 bugs are introduced in versions 2.2 and 2.1, focusing on SQL injection, XSS, and other vulnerabilities. Each subsequent version contains additional bugs and functionality to demonstrate different web vulnerabilities.

Uploaded by

sebastián droguett
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 8

---------------------

bWAPP - Release notes


---------------------

v2.2
****

Release date: 2/11/2014

Number of bugs: > 100

New bugs:

- Insecure iFrame (Login Form)

New bugs exploitable on bee-box v1.6:

- Drupal SQL Injection (Drupageddon)


- POODLE Vulnerability
- SQLiteManager Local File Inclusion

v2.1
****

Release date: 27/09/2014

Number of bugs: > 100

New bugs:

- Base64 Encoding (Secret)


- Broken Authentication - CAPTCHA Bypassing
- Cross-Site Scripting - Stored (User-Agent)
- iFrame Injection
- SQL Injection - Stored (User-Agent)

New bugs exploitable on bee-box v1.5:

- Shellshock Vulnerability (CGI)

v2.0
****

Release date: 12/05/2014

Number of bugs: > 90

New bugs:

- Cross-Site Scripting - Reflected (Login Form)


- SQL Injection (AJAX/JSON/jQuery)
- SQL Injection (POST/Select)
- SQL Injection (Login Form/User)
- SQL Injection (SQLite)
- SQL Injection - Stored (SQLite)
- SQL Injection - Blind - Time-Based
- SQL Injection - Blind (SQLite)

New bugs exploitable on bee-box v1.4:

- BEAST/CRIME/BREACH Attacks
- Buffer Overflow (Local)
- Buffer Overflow (Remote)
- Denial-of-Service (Large Chunk Size)
- Denial-of-Service (SSL-Exhaustion)
- Local Privilege Escalation (sendpage)
- phpMyAdmin BBCode Tag XSS
- SQLiteManager PHP Code Injection
- SQLiteManager XSS
- SSL 2.0 Deprecated Protocol

Modifications:

- Google fonts are stored locally

New features:

- A.I.M. subnet functionality


- bWAPP is licensed under Creative Commons (Creative Commons Attribution-
NonCommercial-NoDerivatives 4.0 International)

v1.9+
*****

Release date: 19/04/2014

Number of bugs: > 70

New bugs exploitable on bee-box v1.3:

- Heartbleed Vulnerability (OpenSSL)


- Insecure SNMP configuration

Modifications:

- Blog entries per user ('Show all' and 'Delete' entry options)
- bWAPP reset functionality only available for users with admin privileges

New features:

- Custom CSS stylesheet for low resolution screens (stylesheet_low_resolution.css)

v1.9
****

Release date: 11/03/2014

Number of bugs: > 70

New bugs:

- Broken Authentication - Weak Passwords


- Command Injection - Blind
- Cross-Site Scripting - Reflected (Custom HTTP Header)
- Cross-Site Scripting - Stored (Change Secret)
- Denial-of-Service (XML Bomb)
- Host Header Attack (Cache Poisoning)
- Host Header Attack (Reset Poisoning)
- Insecure Direct Object References (Reset Secret)
- Old, Backup & Unreferenced Files
- PHP Code Injection
- Server Side Request Forgery (SSRF)
- SQL Injection (Search/POST)
- SQL Injection (Search/CAPTCHA)
- SQL Injection - Stored (Blog)
- SQL Injection - Stored (XML)
- Unvalidated Redirects & Forwards (2)
- XML External Entity Attacks (XXE)

New features:

- Evil 666 Fuzzing page


- Evil Bug Mode, all security levels are bypassed in this mode by using a fixed
cookie
- Insecure Client Access Policy file (Silverlight)
- Manual Intervention Required! page
- We Steal Secrets... pages

Modifications:

- Possibility to exclude 'dangerous' files in the A.I.M. mode


- The database connection settings are moved to the 'admin/settings.php' file

v1.8
****

Release date: 15/12/2013

Number of bugs: > 65

New bugs:

- SQL Injection - Blind (Web Services/SOAP)

New bugs exploitable on bee-box v1.2:

- Insecure FTP
- Insecure WebDAV
- PHP CGI Remote Code Execution
- Server-Side Includes Injection

New features:

- NSA backdoor file


- Unprotected Admin Portal > a shortcut to the 'settings' file
- WSDL file (Web Services/SOAP)

Bug fixes:

- Issue with 'Restrict Folder Access'


- Issue with 'Session ID in URL'
Modifications:

- A.I.M. feature > list of IP addresses


- Unrestricted File Upload > unsafe black-list in security level medium
- table 'movies' > extra column: tickets_stock

v1.7
****

Release date: 31/10/2013

Number of bugs: > 60

New bugs:

- HTTP Verb Tampering


- Server Side Request Forgery (SSRF)
- Session ID in URL
- XSS - Reflected (AJAX/JSON)
- XSS - Reflected (AJAX/XML)

New features:

- A.I.M., a no-authentication mode for testing web scanners and crawlers


- Settings file, used for general application settings
- OWASP & ZAP logo

New bugs exploitable on bee-box:

- Local Privilege Escalation (udev)

Modifications:

- Rearrangement to OWASP Top 10 2013


- Added some new movies :)
- Introduction text

v1.6
****

Release date: 5/10/2013

Number of bugs: > 60

New features:

- Cross-Origin Resource Sharing (AJAX)


- Information Disclosure - Favicon

New features exploitable on bee-box:

- Arbitrary File Access (Samba)


- Cross-Site Tracing (XST)
- Denial-of-Service (Slow HTTP DoS)

Modifications:
- Addition of an insecure jQuery script

v1.5
****

Release date: 09/09/2013

Number of bugs: > 55

New features:

- ClickJacking (Movie Tickets)


- Cross-Domain Policy File
- Cross-Site Scripting - Reflected (HREF)
- Cross-Site Scripting - Reflected (PHP_SELF)
- HTML5 Web Storage (Secret)
- HTTP Parameter Pollution
- Insecure Direct Object References (Price)

Bug fixes:

- Input validations and error handling


- XSS issues :)

Modifications:

- SQL Injection (Login) > welcome message has changed


- New vulnerable XSS validation check (medium level)
- test.php file > extra urldecode function

v1.4
****

Release date: 15/07/2013

Number of bugs: > 50

New features:

- LDAP Injection
- Client-Side Validation (Password)
- PHP Eval Function
- Remote and Local File Inclusion
- Unsecure files: phpinfo.php, config.inc, test.php
- Integration with bee-box (Ubuntu OS)

Bug fixes:

- Input validations and error handling

Modifications:

- Bugs are rearranged according to the OWASP Top 10 project (A1>A10)


- Creation of users without e-mail activation
- New hero table with passwords in clear text
- SQL Injection (Login) > applied to the new hero table
v1.3
****

Release date: 20/01/2013

Number of bugs: 47

New features:

- SQL Injection (Select)


- Broken Authentication - Forgotten Function
- Broken Authentication - Password Attacks
- Authorization Testing - Restrict Folder Access

Bug fixes:

- HTML5 issues

Modifications

- Better compatibility with IE9


- Stylesheet modifications

v1.2
****

Release date: 17/01/2013

New features:

- Cross-Site Scripting - Stored (Cookies)


- Cross-Site Request Forgery (Secret)
- Insufficient Transport Layer Protection
- Security Misconfiguration - MiTM (HTTP)
- Security Misconfiguration - MiTM (SMTP)
- Security Misconfiguration - Robots
- Information Disclosure - Robots
- Insecure Directory Object References (Secret)
- Session Management - Cookies (Secure)
- Session Management - Strong Sessions

Bug fixes:

- CSRF: code optimization and error handling


- Cookie 'security_level' is vulnerable for injection

Modifications

- Name change: Session Management - Cookie Security >> Session Management - Cookies
(HTTPOnly)
- Name change: Cross-Site Scripting - Stored >> Cross-Site Scripting - Stored
(Blog)

v1.1
****
New features:

- HTML Injection - Reflected (Current URL)


- Cross-Site Scripting - Reflected (Back Button)
- XML and XPath Injection (Login)
- XML and XPath Injection (Search)

Bug fixes:

- Directory traversal: wrong directory in GET parameter (images/ is changed to


documents/)

v1.01
*****

New features:

- none

Bug fixes:

- bug fixes for the Apache platform


- PHP session errors
- connection setting issues ('localhost:3306' not valid)
- time period for the 'security_level' cookie has changed to 1 year

v1.0
*****

- extra SQL user: bee/bug


- e-mail modifications
- recipient/sender addresses change

v0.15
*****

- Layout
- Code optimization
- New 'Info' page

v0.14
*****

- Layout
- Code optimization

v0.13
*****

- Code optimization
- Modifications:
- XSS & HTML Injection Stored
- No 'HTML entities check' in the SQL insert statement
- 'HTML entities check' in the HTML output
- New:
- Authorization Testing - Restrict Device Access

Upcoming bugs
/////////////

- JSON
- AJAX
- Web Services

You might also like