Installing Vulnerable bWAPP, DVWA, Joomla, Mutillidae2, SQLi-Labs, XAMPP, WordPress on TurnKey LAMP

Download and install TurnKey LAMP ova from
set VBox Settings/Display/Screen/Video Memory to 6MB
set NIC1 to Bridge in VBox
Image.png
Set NIC2 to Host only
Image.png
click Advanced Menu
Image.png
select Networking, click Select
Image.png
Set eth0 to dhcp and eth1 to static

Image.png

XAMPP
# cd /root
# apt list –installed
find apache and mysql packages name there
# service mysql stop
# apt-get purge mysql-server mysql-client mysql-common
# apache2ctl stop
# apt-get purge apache2 apache2-utils apache2.2-bin
# apt-get autoremove

# apt-get autoclean

-download xampp
# chmod 755 xampp-linux-x64-5.6.30-0-installer.run
# ./xampp-linux-x64-5.6.30-0-installer.run
————————————————————————–
Welcome to the XAMPP Setup Wizard.
————————————————————————–
Select the components you want to install; clear the components you do not want
to install. Click Next when you are ready to continue.
   XAMPP Core Files : Y (Cannot be edited)
   XAMPP Developer Files [Y/n] :
   Is the selection above correct? [Y/n]:
Installation Directory
   XAMPP will be installed to /opt/lampp
   Press [Enter] to continue:
Setup is now ready to begin installing XAMPP on your computer.

   Do you want to continue? [Y/n]:

# cd /opt/lampp
# sed -i s/’local’/’all granted’/ etc/extra/httpd-xampp.conf
# lampp start
NOTE:
-to restart apache only
# /opt/lampp/bin/apachectl restart

-apache docs location on /opt/lampp/htdocs

bWAPP (Buggy Web Application)
# cd /root
# mkdir -p /opt/lampp/htdocs/bwapp
# mv download?source=files bwapp/bWAPP_latest.zip /opt/lampp/htdocs/bwapp/bwapp.zip
# cd /opt/lampp/htdocs/bwapp
# unzip bwapp.zip
# rm bwapp.zip
# vi bWAPP/admin/settings.php
set this part

$db_password = “”;

# cd bWAPP
# chmod 777 documents images passwords
-open your browser and go to http://10.0.1.44/bwapp/bWAPP/install.php
click on here
L: bee
P: bug

Image.png

DVWA
-download dvwa
# cd /root
# mv DVWA /opt/lampp/htdocs/dvwa
# cd /opt/lampp/htdocs/dvwa
# chmod 766 hackable/uploads
# chown root:root hackable/uploads
# chmod 766 external/phpids/0.6/lib/IDS/tmp/phpids_log.txt
Sign-in with your gmail account
click Continue
click Get reCAPTCHA
on Label and Domains type your domain i.e: domain.com
click Register
You will get Site and Secret key
# cd /opt/lampp/htdocs/dvwa/config
# cp -p config.inc.php config.inc.php.bak
# vi config.inc.php
-set your mysql root password
$_DVWA[ ‘db_password’ ] = ‘Passw0rd’;
-insert Site > public key and Secret > private key into this part
$_DVWA[ ‘recaptcha_public_key’ ]  = ‘6LdaMRYUAAAAAGH_Wjgn15xUmdcXTMP9YpBJ7y3n1’;

$_DVWA[ ‘recaptcha_private_key’ ] = ‘6LdaMRYUAAAAALsTFuYgrGbeozX2efE3EOz11T5x1’;

Set “allow_url_include = On”
# sed -i s/’allow_url_include=Off’/’allow_url_include=On’/ /opt/lampp/etc/php.ini
# /opt/lampp/bin/apachectl restart
go to http://10.0.1.44/dvwa/
click Create/Reset Database
go to http://10.0.1.44/dvwa/login.php
L: admin

P: password

JOOMLA
# cd /root
# mv joomla_3-6-5-stable-full_package-zip\?format\=zip joomla-3.6.5.zip
# unzip joomla-3.6.5.zip -d joomla
# mv joomla /opt/lampp/htdocs
# cd /opt/lampp
# sed -i s/’display_errors=On’/’display_errors=Off’/ etc/php.ini
# sed -i s/’output_buffering=4096’/’output_buffering=Off’/ etc/php.ini
# cd /opt/lampp/htdocs/joomla/
# cp installation/model/configuration.php .
# chmod 777 configuration.php
# /opt/lampp/bin/apachectl restart
go to http://10.0.1.44/joomla/installation/index.php
Configuration
Select Langunage: English (United States)
Site Name: joomla
Description:
Site Offline: Yes
Administrator Email: admin@gmail.com
Administrator Username: root
Administrator Password:
Confirm Administrator Password:
click Next
Database
Database Type: MySQLi
Host Name: localhost
Username: root
Password:
Database Name: joomla
Table Prefix: j00mla_
Old Database Process: Backup
click Next
FTP
click Next
Overview
Install Sample Data: Learn Joomla English (GB) Sample Data
Email Configuration: No
click Install
click Remove installation folder
if you got error
# cd /opt/lampp/htdocs/joomla
# rm -rf installation
# chmod 644 configuration.php
go to http://10.0.1.44/joomla/
L: root

P:

NOWASP Mutillidae 2
# cd /root
# apt-get install software-properties-common python-software-properties php5-curl -y
# mv download\?source\=files mutillidae.zip
# unzip mutillidae.zip
# mv mutillidae /opt/lampp/htdocs/
# cd /opt/lampp/htdocs/mutillidae
# vi classes/MySQLHandler.php
set your MySQL password here
        static public $mMySQLDatabasePassword = “”;
-only allow access from your network
# vi .htaccess
Allow from 10.0.1.0/24
# /opt/lampp/bin/apachectl restart
go to http://10.0.1.44/mutillidae
click setup/reset the DB
Image.png
click OK

Image.png

SQLi-Labs
# cd /root
# unzip master.zip
# mv sqli-labs-master /opt/lampp/htdocs/sqli
# cd /opt/lampp/htdocs/sqli
# vi sql-connections/db-creds.inc
set mysql password i.e.
$dbpass =”;
open browser and go to http://10.0.1.44/sqli
click Setup/reset Database for labs

Image.png

WORDPRESS
NOTE:
UBUNTU
-because TurnKey LAMPP doesn’t have required gcc for compiling pcre lib, we need to do this in other Ubuntu server.
After compiling then copy the lib into 10.0.1.44 TurnKey LAMPP
download pcre
# cd /root
# tar xf pcre-8.40.tar
# cd /pcre-8.40
# ./configure –prefix=/tmp –enable-utf8 –enable-unicode-properties ; make ; make install
# cd /tmp
# tar cf lib.tar lib

# scp lib.tar root@10.0.1.44/tmp

TURNKEY LAMPP
-copy lib into /opt/lampp/lib
# cd /opt/lampp/lib
# cp /tmp/lib/* .

-create empty wordpress db
go to http://10.0.1.44/phpmyadmin
click New on top left
Create database: wordpress

click Create

# mv WordPress /opt/lampp/htdocs/
# cd /opt/lampp/htdocs
# mv WordPress wordpress
# cd /opt/lampp/htdocs/wordpress
go to http://10.0.1.44/wordpress

click Let’s go!

Database Name: wordpress
Username: root
Password: Passw0rd
Database Host: localhost
Table Prefix: wp_
click Submit
You will get warning “Sorry, but I can’t write the wp-config.php file”.
Paste the content shown into wp-config.php
# vi wp-config.php

click  “Run the install”

Information needed
Site Title: wordpress
Username: root
Password: Passw0rd
Your Email:
Search Engine Visibility:
click Install WordPress
NOTE:

-you can go to http://10.0.1.44/wordpress/wp-admin/ for admin purposes

Create xampp startup script
# cat /etc/init.d/lampp
#! /bin/sh
### BEGIN INIT INFO
# Provides:             xampp
# Required-Start:       $remote_fs $syslog
# Required-Stop:        $remote_fs $syslog
# Default-Start:        2 3 4 5
# Default-Stop:         0 1 6
# Short-Description: Execute the xampp command.
# Description:
### END INIT INFO
PATH=/sbin:/usr/sbin:/bin:/usr/bin
case “$1” in
  start)
        /opt/lampp/lampp start
        ;;
  restart|reload|force-reload)
        /opt/lampp/lampp restart
        ;;
  stop)
        /opt/lampp/lampp stop
        ;;
  status)
        /opt/lampp/lampp status
        ;;
  *)
        echo “Usage: $0 start|stop|restart|status”
        ;;
esac

# chmod 755 /etc/init.d/lampp
# insserv -d /etc/init.d/lampp
# systemctl enable lampp
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s