/WackoPicko

WackoPicko is a vulnerable web application used to test web application vulnerability scanners.

Primary LanguagePHPMIT LicenseMIT

WackoPicko Vulnerable Website

WackoPicko is a website that contains known vulnerabilities. It was first used for the paper Why Johnny Can't Pentest: An Analysis of Black-box Web Vulnerability Scanners

Docker Image

I recently created a wackopicko docker image, which is just about the easiest way to run wackopicko.

Simply run the following, which will map your local port 8080 to the port 80 in the container. Change the 8080 to another port if you like:

docker run -p 127.0.0.1:8080:80 -it adamdoupe/wackopicko

Once the docker image is downloaded and running, you should be able to access wackopicko on your browser: http://localhost:8080.

Note that Windows users might need some additional steps to do the port forwarding correctly. Google is your friend, use it well.

Virtual Machine

WackoPicko is now included as an application in the OWASP Broken Web Applications Project which is a Virtual Machine with numerous intentionally vulnerable application.

External Links/Help

Install From Source

First, ensure that short_open_tag PHP ini option is enabled:

http://www.php.net/manual/en/ini.core.php#ini.short-open-tag

Import the WackoPicko database into MySQL using a command like the following:
mysql -u -p < current.sql

This will create the MySQL user wackopicko with the password webvuln!@# as well as create the wackopicko table.

The wackopicko table contains all of the data that was present while testing the scanners in Why Johnny Can't Pentest.

The final step is to enable read/write access to the upload directory of WackoPicko for the webserver user. An easy way to do this is:
chmod 777 -R upload

Valid Logins

Regular users

  • scanner1/scanner1
  • scanner2/scanner2
  • bryce/bryce

Administrator users

  • admin/admin
  • adamd/adamd

Known Issues

  • The search bar doesn't appear in Internet Explorer.
  • There are some onions hanging around (particularly in the upload folder) but I kept them there to preserve parity with the version used during the tests.
  • WackoPicko was developed with the assumption that is was running as the root application as the URL and won't work running as a directory.
  • WackoPicko uses PHP's short tags, they must be enabled to run the application.

Vulnerabilities