Kali Linux

TIWAP : Totally Insecure Web Application Project

TIWAP is a web security testing lab made using Flask for budding security enthusiasts to learn about various web vulnerabilities. Inspired by DVWA, the contributors have tried their best to regenerate various web vulnerabilities

The application is solely made for educational purpose and to learn web hacking in a legal environment.

Setup and Installation

To keep the installation and setup easy, we have configured everything for you. All you need is Docker on your system.

Once you are done with docker installation, run the following commands.

git clone https://github.com/tombstoneghost/TIWAP
cd TIWAP
docker-compose up

Note: It works only on Linux as of now and windows compatibility is work under progress

Once the lab is started, you can log in using the default credentials.
Username: admin
Password: admin

Tech Stack

Front-End: HTML, CSS and JavaScript
Back-End: Python – Flask
Databases: SQLite3 and MongoDB

Vulnerabilities

Currently, we have 20 vulnerabilities in the lab. All listed below:

  • SQL Injection
  • Blind SQL Injection
  • NoSQL Injection
  • Command Injection
  • Business Logic Flaw
  • Sensitive Data Exposure
  • XML External Entities
  • Security Misconfiguration
  • Reflected XSS
  • Stored XSS
  • DOM Based XSS
  • HTML Injection
  • Improper Certificate Validation
  • Hardcoded Credentials
  • Insecure File Upload
  • Brute Force
  • Directory Traversal
  • Cross-Site Request Forgery (CSRF)
  • Server-Side Request Forgery (SSRF)
  • Server-Side Template Injection (SSTI)

Each vulnerability is having 3 difficulty levels, namely Low, Medium and Hard. These levels can be set from the settings page.

R K

Recent Posts

BeVigil CLI – A Comprehensive Guide To OSINT API Integration

bevigil-cli provides a unified command line interface and python library for using BeVigil OSINT API. BeVigil…

8 hours ago

OSINT Inception | Links : Your Gateway To Open-Source Intelligence Resources

Explore the comprehensive world of Open-Source Intelligence (OSINT) with our curated list of active links…

8 hours ago

BBOT : The Next-Gen Recursive Internet Scanner For Ethical Hackers

BBOT (Bighuge BLS OSINT Tool) is a recursive internet scanner inspired by Spiderfoot, but designed to…

8 hours ago

Andriller CE (Community Edition) – A Comprehensive Guide To Mobile Forensics

Andriller - is software utility with a collection of forensic tools for smartphones. It performs…

8 hours ago

OSINT Toolkit – Empowering Security Analysts With Comprehensive Cyber Threat Intelligence

Designed as a full-stack web application, this tool amalgamates a plethora of services to streamline…

8 hours ago

The Arsenal : A Comprehensive Guide To Anti-Forensic Tools And Techniques

Tools and packages that are used for countering forensic activities, including encryption, steganography, and anything…

1 day ago