InsecureD7

Deliberately insecure Drupal 7 installation (as used at the European Drupal Days 2015).

Screenshots

Setup

This installation uses 'Code Driven Development', to find out more take a look at the Nuvole blog.

git clone git@github.com:relaxnow/insecured7.git &&
cd insecured7 &&
vagrant up &&
vagrant ssh

"I would never build a site like this!"

I hope not! This is a simplified example designed for easy teaching. Real life vulnerabilities will most likely not be so glaringly obvious, however in principle they will be the same.

If you have any ideas on better show cases for a specific vulnerability, please open an issue or even better send me a Pull Request.

Vulnerabilities

This installation has been made to be deliberately vulnerable to the following OWASP ASVS requirements:

• V2.16 Strongly encrypted transport
• V2.18 No username enumeration
• V3.3. Session times out after inactivity
• V3.5. Shows logout link
• V4.1. Authorisation of functions and services
• V4.2. Authorisation of URLs
• V4.4. Authorisation of direct object references
• V4.5. Directory browsing
• V4.6. Authorisation of data
• V4.11. Server side access controls
• V4.16. CSRF protection
• V5.5. Server side input validation and encoding
• V5.10. SQL Injection
• V5.12. OS Command Injection
• V5.16. HTML escaping
• V8.1. Information leakage
• V9.1. Sensitive data does not get cached
• V9.3. Sensitive data does not get sent in the URL
• V11.8. Click-Jacking defense
• V16.1. Safe from unsafe redirects
• V16.2. Safe from path traversal
• V17.16. No misconfigurations
• V17.17. Does not use vulnerable libraries