snoopysecurity/dvws

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. NOTE: This project is out of date, please use https://github.com/snoopysecurity/dvws-node

dvws's Issues

assumes its running in dvws directory

I just installed dvws into the root of its own site but all the menu options assume it is in the dvws directory so end up at 404 pages.

$id not defined

This might be deliberate but $id is not defined in dvws/vulnerabilities/wsdlenum/functions.php if a username is passed that isn't in the $details array.

This is what gets returned:

<br />
<b>Notice</b>:  Undefined variable: id in <b>/var/sites/dvws/secure/htdocs/dvws/vulnerabilities/wsdlenum/functions.php</b> on line <b>36</b><br />
<?xml version="1.0" encoding="ISO-8859-1"?><SOAP-ENV:Envelope SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:check_user_idResponse xmlns:ns1="http://schemas.xmlsoap.org/soap/envelope/"><return xsi:nil="true" xsi:type="xsd:string"/></ns1:check_user_idResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>  

Integration of OpenAPI specification or document for vulnerable endpoints.

Thanks for this very useful tool. I will like to recommend integration of a feature.
Since there is already a WADL component, how about defining a document that contains the vulnerable endpoints in DVWS ? A possible standard could be using the Open API (formerly Swagger). The OpenAPI is getting popular and its inclusion could be a very useful functionality for REST security testing. Cheers !

The code is written with older version of PHP. Below is the edit api.php

api.zip

Dvws

REST API SQL Injection is broken

REST API SQL Injection is broken.
When "/dvws/vulnerabilities/sqli/api.php/users/2" is called it returns "Fatal error: Uncaught Error: Call to undefined function mysql_connect()"

XXE Vulnerability

Hi,

As mentioned by you, there are not many practical environments available for hacking web services, I am glad you created dvws.

I am trying to exploit XXE, and tried different payloads. Its not working. below is request and payloads which i tried.

POST /dvws/vulnerabilities/xxe/ HTTP/1.1
Host: 192.168.2.2
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.2/dvws/vulnerabilities/xxe/
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

]>

name=&xxe;

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

and i tried to include just entity, even this does not works.

]>

name=&xxe;

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I tried xml tag too, no luck.

]>

name=&xxe;