OWASP Mutillidae II: Keep Calm and Pwn On

Version: 2.6.62 Security Level: 0 (Hosed) Hints: Enabled (1 - Try easier) Not Logged In

OWASP 2017

OWASP 2013
- A8 - Cross Site Request Forgery (CSRF)
- A10 - Unvalidated Redirects and Forwards
  - Credits
  - Setup/reset the DB (Disabled: Not Admin)

OWASP 2010

OWASP 2007

Want to Help?

Video Tutorials

Announcements

Getting Started

Log

Back Help Me!

Hints and Videos

HTML Injection (HTMLi)
Using Burp-Suite
Using OWASP Zed Attack Proxy (ZAP)
Cross-site Scripting (XSS)
Cross-site Scripting with BeEF Framework

24 log records found Refresh Logs Delete Logs

Hostname IP Browser Agent Page Viewed Date/Time

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: register.php 2026-07-30 15:08:17

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: framing.php 2026-07-30 15:08:16

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: documentation/usage-instructions.php 2026-07-30 15:08:16

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: user-poll.php 2026-07-30 15:08:15

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured user data 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: capture-data.php 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Data: page = capture-data.php showhints = 1 PHPSESSID = qr46gv906kjjhnhoooaqehckp4 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client Port: 53760 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client Referrer: 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client User Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client Hostname: 172.18.0.36 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client IP: 172.18.0.36 2026-07-30 15:07:43

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: installation.php 2026-07-30 15:07:42

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: source-viewer.php 2026-07-30 15:07:42

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: source-viewer.php 2026-07-30 15:07:42

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: client-side-comments.php 2026-07-30 15:07:18

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: captured-data.php 2026-07-30 15:07:04

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: phpinfo.php 2026-07-30 15:06:53

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: xml-validator.php 2026-07-30 15:06:53

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: phpmyadmin.php 2026-07-30 15:06:34

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: sqlmap-targets.php 2026-07-30 15:06:34

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: cache-control.php 2026-07-30 15:06:33

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: php-errors.php 2026-07-30 15:06:21

172.18.0.36 172.18.0.36 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: /app/home.php 2026-07-30 15:06:21