OWASP Mutillidae II: Keep Calm and Pwn On

Version: 2.6.62 Security Level: 0 (Hosed) Hints: Enabled (1 - Try easier) Not Logged In

OWASP 2017

OWASP 2013
- A8 - Cross Site Request Forgery (CSRF)
- A10 - Unvalidated Redirects and Forwards
  - Credits
  - Setup/reset the DB (Disabled: Not Admin)

OWASP 2010

OWASP 2007

Want to Help?

Video Tutorials

Announcements

Getting Started

Log

Back Help Me!

Hints and Videos

HTML Injection (HTMLi)
Using Burp-Suite
Using OWASP Zed Attack Proxy (ZAP)
Cross-site Scripting (XSS)
Cross-site Scripting with BeEF Framework

22 log records found Refresh Logs Delete Logs

Hostname IP Browser Agent Page Viewed Date/Time

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: source-viewer.php 2026-05-30 20:22:07

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: register.php 2026-05-30 20:22:06

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: installation.php 2026-05-30 20:22:06

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: framing.php 2026-05-30 20:22:05

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: source-viewer.php 2026-05-30 20:22:05

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: client-side-comments.php 2026-05-30 20:21:34

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured user data 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client IP: 172.21.0.1 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client Hostname: 172.21.0.1 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client User Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client Referrer: 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Client Port: 57691 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) Captured Data: page = capture-data.php PHPSESSID = ltmcii67536midonp8ppfs8eq1 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: capture-data.php 2026-05-30 20:21:31

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: cache-control.php 2026-05-30 20:21:29

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: captured-data.php 2026-05-30 20:21:28

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: xml-validator.php 2026-05-30 20:21:28

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: phpinfo.php 2026-05-30 20:21:08

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: sqlmap-targets.php 2026-05-30 20:21:08

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: phpmyadmin.php 2026-05-30 20:21:08

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: php-errors.php 2026-05-30 20:20:20

172.21.0.1 172.21.0.1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com) User visited: /app/home.php 2026-05-30 20:20:20