‫One of the target devices will be Oos Broken Web applications, or W8.
‫A broken Web applications is a virtual machine that hosts a lot of applications prepared for training
‫purposes.
‫These apps are intentionally have a lot of vulnerabilities and could also be accessed from a main page.
‫The virtual machine is prepared by a WASP Open Web application security project, which is one of the
‫most important communities around in the application security market.
‫So I am now on my host machine, it's a MacBook.
‫Over the Web browser and Google for O.W. Aspey broken web applications, those are my keywords.
‫The first Web site is the official website of the Broken Web Applications Project hosted under the old
‫WASP dot org domain.
‫So let's click it.
‫Now, this is a Web page of broken web applications.
‫I'll call it B way from now on.
‫So there are some explanations about this project here.
‫So you can read them if you want.
‫But over here on the right hand side, we have download the latest release.
‫So click on that.
‫Now we're directed to the Sound Forge website.
‫So these are the side effects of GDP.
‫We'll have to see a lot more approval pages like this one.
‫OK, so these are all the releases of the project, and the latest version is right here at the top.
‫So click on it and now I have three different options to download Gotabaya file a zip file and a DOT
‫seven zip file.
‫Now, ENOVIA file is a virtual appliance used by virtualization applications such as VMware and Oracle
‫Virtual Box.
‫It's a package that contains files used to describe a virtual machine.
‫ZIP and 7C are the archive files and they contain the exact same VM so you can download any one of them
‫where the seven file is smaller.
‫OK, so I want to download the seven zip file, which is the most popular one already.
‫So click on the link and download will start in just a couple of seconds.
‫There we go.
‫And the downloads finished.
‫So now I have an otherwise BWB archive file, so I'll open it with an on Arqiva and double click and
‫here are the files inside the archive.
‫So I already have the VM, so I won't extract it again.
‫When you extract it, you will have a folder like this.
‫So go to the folder and here are the files of the virtual machine.
‫If you run the VMAX file, double click the PVM starts, if it's the first run, it asks you whether
‫you moved it or copied it.
‫Select copy and continue.
‫Right, so while IBM is starting, let's have a look at its settings by clicking this button.
‫Click here to look at the memory, 1024 megabytes of RAM as recommended.
‫Click Shole to turn back to the settings.
‫Network settings are here to my VM is in an unrecognized network mode.
‫Don't pay any attention that your VM is probably in that mode by default.
‫I choose to share with my Mac so that I can use the VM in that mode.
‫So now the PVM has started and we're ready to log in.
‫It has a route user with the password Owais B way by default.
‫I have to change it before.
‫So I log into the VMS by using this credential.
‫If config that check, if it has got an IP address and there it is, so yes, it has.
‫Now, putting a system on the Internet, Google DNS, for example, 88 directory, and will receive
‫the replies.
‫So it seems everything's fine and we're ready to use Hawas Broken Web Applications VM.
‫In this phase, you should be able to reach the Iowa Speedway application inside your Calli machine
‫to go to Calli, open Firefox browser and type the IP address of the OOS machine with the HTTP prefix.
‫If you don't want to memorize the IP address of the application to enter each time or if you want your
‫test more realistic, you can give a domain name to your application, go to Google etc hosts file.
‫And Ed are aligned for the application machine IP address of the application space.
‫A domain name to reach the application.
‫Save the hosts file and close.
‫Now you can reach the application with the domain name you gave in hosts file.