JotPot

KO | EN

gitlite — search

#javascript #python #hacktoberfest #android #machine-learning #rust #deep-learning #linux #nodejs #java #kubernetes #awesome-list #pytorch #ios

(★ 14)

It is a vulnerable web site application as DVWA or bWAPP

JotPot Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# JotPot Vulnerable Web Application

JotPot is a badly coded web application. It was coded in PHP/MySQL. JotPot's main goal is to help security enthusiasts to learn web application security.

![JotPot MainPage](https://user-images.githubusercontent.com/27926328/66612749-93ad3000-ebcb-11e9-9995-98206b38ad16.png)

JotPot consist of OWASP Top 10 and more.

+ Injection 
 |----HTML Injection (GET) 
 |----HTML Injection (POST) 
 |----iframe Injection 
 |----OS Command Injection Blind 
 |----OS Command Injection 
 |----PHP Code Injection 
 |----SQL Injection (GET) 
 |----SQL Injection (POST 
 |----SQL Injection - Search From ID (GET) 
 |----SQL Injection - Login Form 
 |----SQL Injection - Stored - User Agent 
 |----SQL Injection - Blind - Boolean Based 
 |----Server Site Template Injection (SSTI) 
 |----PHP Object Injection
+ Broken Authentication 
 |----Broken Authentication Captcha Bypass 
 |----Broken Authentication Insecure Login 
 |----Broken Authentication Password Attack
- Sensitive Data Exposure 
+ XML External Entities(XXE) 
 |----XXE - XML External Entities 
 |----XXE Out of Band
+ Broken Access Control 
 |----Remote & Local File Inclusion (RFI/LFI) 
 |----File Upload
- Misconfiguration
+ Cross Site Scripting (XSS) 
 |----XSS - Cross Site Scripting - Reflected - JSON 
 |----XSS - Cross Site Scripting - Reflected - Login Form 
 |----XSS - Cross Site Scripting - Stored - Blog 
 |----XSS - Cross Site Scripting - Stored - User Agent
- Insecure Deserialization
- Componenets with Known Vulnerabilities
- Insufficient Logging & Monitoring
+ Cross Site Reference Forgery(CSRF) 
 |----CSRF - Cross Site Reference Forgery - Change Password 
 |----CSRF - Cross Site Reference Forgery - Money Transfer
+ Insecure Direct Object Reference (IDOR) 
 |----Insecure Direct Object Reference (IDOR)

## Installation for Linux

```commandline

$ systemctl start apache2 or nginx
$ systemctl start mysql

Use the mysqladmin command to create a new database:
$ mysqladmin -u username -p create jotformDB

Lastly, with the new database created, use mysql to import the dump file we created into the new database.
$ mysql -u username -p jotformDB < /path/to/JotPot/database/jotpotDB.sql

$ mysql -u username -p
mysql> CREATE USER 'jotpot'@'localhost' identified with mysql_native_password by 'JotForm1-';
mysql> GRANT ALL PRIVILEGES ON *.* TO 'jotpot'@'localhost';
mysql> FLUSH PRIVILEGES;
mysql> exit;

$ systemctl restart mysql
```

## Configuration PHP

```php
file_uploads = on 
allow_url_fopen = on 
allow_url_include = on 
```

## Credentials

The information will use to login JotPot.
```cli
username = jotform
password = okan
```

# GOOD LUCK HAVE FUN

JotPot

JotPot Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

JotPot

JotPot Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README