WebGoatPHP by Abbas Naderi, Johanna Curiel, Shivam
Dixit and the OWASP contributors: a port of OWASP WebGoat to PHP and MySQL, an interactive
teaching environment where each lesson is a vulnerability to exploit, with single-user, workshop,
contest and secure coding modes. This repository runs it with Isoloom:
isoloom.yml describes the machines, and the upstream source in
build/web/app/ is served by a PHP 5.6 / Apache image written for it (upstream
ships a Vagrant box, no Dockerfile), with its database imported at first start.
| Machine | Service |
|---|---|
| web | WebGoatPHP (PHP 5.6, Apache) on port 80, published on 8031 |
| db | MariaDB 10.11 on port 3306 |
isoloom generate
isoloom run dockerThen open http://localhost:8031/, log in as guest / guest and start single-user mode. The
same spec runs as Docker on a local VM (docker-vm), on a cloud VM (cloud-docker) or on
Kubernetes. Lab guide: the hints, plan and solution buttons of each lesson, and the
WebGoatPHP README.
WebGoatPHP tracks lesson completion inside the app and has no flags. The lab's main objective is
a flag in /ctf/flag on the web machine (the player's CTF_FLAG_MAIN, written by
ctf/flag.sh at every start; a development value without one), reached through
the Path Based Access Control lesson. The other objectives are short questions, one per lesson,
answered from what solving it shows.
Upstream version and commit: UPSTREAM.md.
Apache-2.0, as WebGoatPHP (LICENSE). This application is deliberately vulnerable: keep it isolated.