OWASP Mutillidae II: Keep Calm and Pwn On
-
OWASP 2017
- A1 - Injection (SQL)
-
A1 - Injection (Other)
- Application Log Injection
- Buffer Overflow
- Cascading Style Injection
- CBC-bit Flipping
- Command Injection
- Frame Source Injection
-
HTML Injection (HTMLi)
- Add to your blog
- Browser Info
- DNS Lookup
- Echo Message
- Echo Message (CORS)
- Echo Message (CSP)
- Test Connectivity to Server
- Pen Test Tool Lookup
- Text File Viewer
- User Info (SQL)
- User Info (XPath)
- Set Background Color
- HTML5 Web Storage
- Capture Data Page
- View Captured Data
- Document Viewer
- Arbitrary File Inclusion
- Poll Question
- Register User
- Login
- Those "Back" Buttons
- Styling with Mutilidae
- Password Generator
- HTMLi via HTTP Headers
- HTMLi Via DOM Injection
- HTMLi Via Cookie Injection
- HTTP Parameter Pollution
- JavaScript Injection
- JavaScript Object Notation (JSON) Injection
- LDAP Injection
- Parameter Addition
- XML External Entity Injection
- XML Entity Expansion
- XML Injection
- XPath Injection
- A2 - Broken Authentication and Session Management
- A3 - Sensitive Data Exposure
- A4 - XML External Entities
- A5 - Broken Access Control
- A6 - Security Misconfiguration
-
A7 - Cross Site Scripting (XSS)
-
Reflected (First Order)
- DNS Lookup
- Echo Message
- Echo Message (CORS)
- Echo Message (CSP)
- Test Connectivity to Server
- Pen Test Tool Lookup
- Text File Viewer
- User Info (SQL)
- Set Background Color
- HTML5 Web Storage
- Capture Data Page
- Document Viewer
- Arbitrary File Inclusion
- XML Validator
- User Info (XPath)
- Poll Question
- Register User
- Browser Info
- Those "Back" Buttons
- Styling with Mutilidae
- Password Generator
- Client-side Control Challenge
- Persistent (Second Order)
- DOM-Based
- Cross Site Request Forgery (CSRF)
- Via "Input" (GET/POST)
- Via HTTP Headers
- Via HTTP Attribute
- Via Misconfiguration
- Against HTML5 Web Storage
- Against JSON
- Via Cookie Injection
- Via XML Injection
- Via XPath Injection
- Via Path Relative Style Sheet Injection
-
BeeF Framework Targets
- Add to your blog
- View someone's blog
- Show Log
- DNS Lookup
- Echo Message
- Echo Message (CORS)
- Echo Message (CSP)
- Test Connectivity to Server
- Pen Test Tool Lookup
- Text File Viewer
- User Info (SQL)
- Set Background Color
- HTML5 Web Storage
- Capture Data Page
- Document Viewer
- Arbitrary File Inclusion
- XML Validator
- User Info (XPath)
- Poll Question
- Register User
- Password Generator
-
Reflected (First Order)
- A8 - Insecure Deserialization
- A9 - Using Components with Known Vulnerabilities
- A10 - Insufficient Logging and Monitoring
- OWASP 2010
- Web Services
- Others
-
Labs
- How the Web Works
- SQL Injection
- Command Injection
- Lightweight Directory Access Protocol (LDAP) Injection
- Insecure Direct Object Referece (IDOR)
- Open Redirect
- Cross-site Scripting (XSS)
- Cross-site Request Forgery (CSRF)
- HTML5 Web Storage
- Session Management
- Cookie Management
- Password Management
- Input Validation
- Error Handling
- Logging
- Server Configuration
- Content Security Policy (CSP)
- JSON Web Token (JWT) Security
- Cross-origin Resource Sharing (CORS)
- Software Composition Analysis (SCA)
- Documentation
- Resources
Want to Help?
Browser Information
Back
Help Me!
Hints and Videos
| Info obtained by PHP | ||
| Client IP | 216.73.216.219 | |
|---|---|---|
| Client Hostname | 216.73.216.219 | |
| Operating System | ||
| User Agent String | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) | |
| Referrer | http://ptbi.com.my/mutillidae/index.php?do=toggle-security&page=browser-info.php | |
| Remote Client Port | 61733 | |
| WhoIs info for client IP | # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/resources/registry/whois/tou/ # # If you see inaccuracies in the results, please report at # https://www.arin.net/resources/registry/whois/inaccuracy_reporting/ # # Copyright 1997-2025, American Registry for Internet Numbers, Ltd. # # # Query terms are ambiguous. The query is assumed to be: # "n 216.73.216.219" # # Use "?" to get help. # Amazon.com, Inc. AMAZO-4 (NET-216-73-208-0-1) 216.73.208.0 - 216.73.219.255 Anthropic, PBC AWS-ANTHROPIC (NET-216-73-216-0-1) 216.73.216.0 - 216.73.219.255 # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/resources/registry/whois/tou/ # # If you see inaccuracies in the results, please report at # https://www.arin.net/resources/registry/whois/inaccuracy_reporting/ # # Copyright 1997-2025, American Registry for Internet Numbers, Ltd. # | |
| Cookie showhints | 1 | |
| Cookie PHPSESSID | 7uj6kngppsfj6otjm1193sukni | |
| Info obtained by JavaScript | ||
| Browser Name | ||
|---|---|---|
| Browser Codename | ||
| Browser Version | ||
| Cookie Enabled? | ||
| Platform | ||
| User Agent | ||
| CPU Class | ||
| System Language | ||
| Resolution | ||
| Color Depth | ||
| Referrer | ||
| Plug-Ins | ||
PHP Version: 7.4.33