18 Creating OWASP BWA VM

Mathew J. Heath Van Horn, PhD

The Open Web Application Security Project (OWASP) is a nonprofit that leads a community of tens of thousands of volunteers to make software more secure.   The volunteers produce a number of tools to help people learn to create secure software. We are going to use one of their older tools to create a vulnerable web server. OWASP Broken Web Application (BWA) provides a website target for practicing website attacks.

Phase 0 – Professional Alignment

Understanding how web applications are attacked is essential to building secure enterprise systems. In this chapter, you will deploy the OWASP Broken Web Applications (BWA) virtual machine, creating a controlled environment for learning web application security, vulnerability assessment, and penetration testing techniques. This intentionally vulnerable platform will support many of the cybersecurity exercises throughout the remainder of this book.

DCWF Work Roles

The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:

  • 541 – Cyber Defense Analyst
  • 451 – System Security Analyst
  • 511 – Network Operations Specialist

NICE Work Roles

This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:

  • Cyber Defense Analyst
  • Vulnerability Assessment Analyst
  • Cyber Defense Infrastructure Support Specialist

Professional Skills

By completing this chapter, you will begin developing the ability to:

  • Deploy intentionally vulnerable web application environments for security testing.
  • Configure virtual machines to support web application security laboratories.
  • Integrate vulnerable web servers into enterprise network topologies.
  • Validate the operation of web-based services prior to security assessments.
  • Prepare controlled environments for ethical hacking and defensive security exercises.
  • Maintain isolated cybersecurity laboratories that support repeatable testing.

What You’ll Be Able to Do

After completing this chapter, you should be able to:

  • Install the OWASP Broken Web Applications (BWA) virtual machine in Oracle VirtualBox.
  • Configure the virtual appliance for use within your GNS3 environment.
  • Verify that the vulnerable web server is operating correctly and accessible from other virtual machines.
  • Integrate the OWASP BWA appliance into your enterprise networking laboratory.
  • Prepare a controlled web application environment for future vulnerability assessment and penetration testing exercises.
  • Maintain an isolated laboratory that supports safe and repeatable web application security testing.

 

Learning Objectives

  • Successfully download, install, and run the OWASP BWA appliance in a GNS3 environment.

Prerequisites

Deliverables

  • None – this is a preparatory lab that supports other labs in this book

Resources

Contributors and Testers

Testers:

  • TBD

Phase I – Installing OWASP on VirtualBox 

The original VM was designed for use in VMware, but it works just fine in VirtualBox. The last image was developed in 2015, but it is still very popular and relevant today. You will need 7-Zip to extract the files.

  1. Download the image (version 1.2) from SourceForge or VulnHub
  2. Unzip the downloaded file using 7-Zip
    Figure 1 extract the files using 7-Zip
    Figure 1 extract the files using 7-Zip
  3. Start VirtualBox
  4. Click on “New” and complete the pop-up window information
    1. VM Name: OWASP BWA
    2. OS: Linux
    3. Distribution: Other
      Figure 2 creating the VM
      Figure 2 creating the VM
  5.  Click the arrow next to “Specify virtual hard disk” and complete the following information
    1. Click on “Use an Existing Virtual Hard Disk File”
    2. Click on the folder icon
      Figure 3 using an existing virtual hard disk file
      Figure 3 using an existing virtual hard disk file
      1. Click “Add”
        Figure 4 adding an existing virtual hard disk file
        Figure 4 adding an existing virtual hard disk file
      2. Navigate to where you extracted the VM files and select the file that DOES NOT have a number associated with it
        Figure 5 navigate to the downloaded files
        Figure 5 navigate to the downloaded files
      3. Press “Open”
      4. Press “Choose”
    3. Click on “Finish”
  6. Start the VM
    Figure 6 start the VM
    Figure 6 start the VM
  7. After it boots, it tells you the administrator credentials (root:owaspbwa) and IP address
    Figure 7 after booting username, password, and IP address is displayed
    Figure 7 after booting username, password, and IP address is displayed
  8. You can now shut down the VM and add it to the GNS3 environment
  9. You now have a vulnerable website that you can add to your environment whenever you need one

Career Connection

Web application security testing is a routine responsibility for cybersecurity professionals who assess organizational risk and improve software security. Penetration testers, application security engineers, cyber defense analysts, and security consultants regularly use intentionally vulnerable environments such as OWASP BWA to practice identifying and exploiting common web application vulnerabilities before validating effective defensive controls. The experience gained in this chapter provides the foundation for understanding real-world web application attacks while reinforcing the importance of conducting security testing within authorized, isolated laboratory environments.

End of Lab

License

Icon for the Creative Commons Attribution-NonCommercial 4.0 International License

Mastering Enterprise Networks 3e Copyright © 2024 by Mathew J. Heath Van Horn is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License, except where otherwise noted.

Share This Book