Tag Archive for: Hack

Chinese hacking group has found new way to bypass two-factor authentication

/in ,

A group with alleged links to the Chinese government has been accused of hacking networks worldwide, but in a rare twist, it’s said to be bypassing two-factor authentication in the process.

The hack was detailed late last week by security researchers from Fox-IT Holding B.V. APT20, the group behind the campaign, targets web servers as the first point of entry with a particular focus on Jboss.

Once through the door, the group installs web shells then spreads throughout the network. Showing fairly typical behavior, the group seeks out passwords and administrator accounts to obtain more information from their targets utilizing virtual network credentials for more secure access.

Where it gets interesting is that the researchers claim they found evidence that APT20 was gaining access to VPN accounts that were protected by 2FA. Hacking 2FA isn’t new, and the process involved is somewhat complicated, but APT20 is said to have found a new way to bypass the process.

The hackers are believed to have stolen an RSA SecurID software token from a hacked system, then modified the key to work on different systems.

“The software token is generated for a specific system, but of course this system-specific value could easily be retrieved by the actor when having access to the system of the victim,” the security researchers explained. “As it turns out, the actor does not actually need to go through the trouble of obtaining the victim’s system-specific value, because this specific value is only checked when importing the SecurID Token Seed, and has no relation to the seed used to generate actual 2-factor tokens. This means the actor can actually simply patch the check which verifies if the imported soft token was generated for this system, and does not need to bother with stealing the system-specific value at all.”

While specifically applying to software-based tokens, the method is disturbing particularly given that 2FA is regularly held up as a way to prevent hacking such as this.

A full copy of the research into the group can be found here.

Bitcoin ransomware locks 10 years’ worth of government data in Argentina

/in ,

Bitcoin-hungry hackers have attacked a data center in Argentina which houses local government files.

According to Alicia Bañuelos, the country’s Minister of Science and Technology, the attack took place on November 25.

In an interview with Agencia de Noticia de San Luis — a local government digital news outlet — on December 2, Bañuelos said the center had already recovered 90 percent of the encrypted data. Some 7,700 GB — approximately 10 years worth data — was originally compromised as a result of the attack.

“Decrypting the files will take at least 15 days, mostly due to the sheer size of the archive,” Bañuelos added during the interview.

The size of the Bitcoin ransom is unknown, but reports suggest attackers asked for somewhere in between approximately $37,000 and $370,000 (0.5 and 50 BTC) in exchange for decrypting the files.

Just last week, Hard Fork reported on how a major US data center had been hit by Sodinokibi, a prominent strand of ransomware which several months ago earned a hacker $287,000 worth of Bitcoin in just three days.

Governments have proved to be popular targets. A group of cybercriminals calling themselves the “Shadow Kill Hackers” attacked the City of Johannesburg (South Africa) administration website in late October and threatened to upload the stolen data on the internet unless they received a $300,000 (4 BTC) Bitcoin ransom.

Hackers are also targeting private companies, including Spanish multinational security firm Prosegur, which was hit by Ryuk ransomware under two weeks ago.

thenextweb

GravityRAT: the trojan with a unique trick for evading analysis

/in ,

GravityRAT, a malware allegedly designed by Pakistani hackers, has recently been updated further and equipped with anti-malware evasion capabilites, Maharashtra cybercrime officials said.

The RAT was first detected by Indian Computer Emergency Response Team, CERT-In, on various computers in 2017. It is designed to infiltrate computers and steal the data of users, and relay the stolen data to Command and Control centres in other countries. The ‘RAT’ in its name stands for Remote Access Trojan, which is a program capable of being controlled remotely and thus difficult to trace.

Maharashtra cybercrime department officials said that the latest update to the program by its developers is part of GravityRAT’s function as an Advanced Persistent Threat (APT), which, once it infiltrates a system, silently evolves and does long-term damage.

“GravityRAT is unlike most malware, which are designed to inflict short term damage. It lies hidden in the system that it takes over and keeps penetrating deeper. According to latest inputs, GravityRAT has now become self aware and is capable of evading several commonly used malware detection techniques,” an officer of the cybercrime unit said.

One such technique is ‘sandboxing’, to isolate malware from critical programs on infected devices and provide an extra layer of security.

“The problem, however, is that malware needs to be detected before it can be sandboxed, and GravityRAT now has the ability to mask its presence. Typically, malware activity is detected by the ‘noise’ it causes inside the Central Processing Unit, but GravityRAT is able to work silently. It can also gauge the temperature of the CPU and ascertain if the device is carrying out high intensity activity, like a malware search, and act to evade detection,” another officer said.

Officials said that GravityRAT infiltrates a system in the form of an innocuous looking email attachment, which can be in any format, including MS Word, MS Excel, MS Powerpoint, Adobe Acrobat or even audio and video files.

“The hackers first identify the interests of their targets and then send emails with suitable attachments. Thus a document with ‘share prices’ in the file is sent to those interested in the stock market. Once it is downloaded, it prompts the user to enter a message in a dialogue box, purportedly to prove that the user is not a bot. While the users take this to be a sign of extra security, the action actually initiates the process for the malware to infiltrate the system, triggering several steps that end with GravityRAT sending data to the Command and Control server regularly,” an officer said.

The other concern is that the Command and Control servers are based in several countries. The data is sent in an encrypted format, making it difficult to detect exactly what is leaked.

Special Inspector General of Police (Cyber) Brijesh Singh of Maharashtra Police said, “We urge people to follow basic cyberhygiene like watching what they download, updating their anti-virus software and conducting cyber security reviews regularly.” CERT-In had issued an alert for it last year, with an advisory asking users to review cybersecurity measures and update anti-malware tools.

Avast reveals how attackers compromised CCleaner last year

/in

Back in September last year, it was reported that popular system-cleaning tool CCleaner had been compromised by attackers for over a month. Some details of the incident were unclear at the time, but Avast, which acquired maker Piriform last July, has now revealed more information about what happened.

The attack saw hackers modify an updated version of CCleaner to include a malware backdoor. We knew there were 2.27 million downloads of the corrupted installation file worldwide, but how the attackers achieved this feat wasn’t specified at the time.

The security firm’s chief technology officer, Ondrej Vlcek, writes that the threat actors accessed Piriform’s network on March 11, 2017, four months before the company was taken over by Avast. The person or persons responsible somehow managed to get hold of stolen credentials to log into a TeamViewer remote desktop account on a developer PC.

“While we don’t know how the attackers got their hands on the credentials, we can only speculate that the threat actors used credentials the Piriform workstation user utilized for another service, which may have been leaked, to access the TeamViewer account,” he said.

The attackers installed the ShadowPad malware on two of the company’s compromised machines, before using its keylogger abilities to gain further access to Piriform’s systems. It wasn’t until August 2 that the first contaminated download of CCleaner appeared.

“Our investigation revealed that ShadowPad had been previously used in South Korea, and in Russia, where attackers intruded [on] a computer, observing a money transfer,” explained Vlcek.

Of the 2.27 million downloads of the affected program, a second stage attack—installing ShadowPad—took place on just 40 PCs, all of which belonged to tech and telecommunications companies. “We don’t have proof that a possible third stage with ShadowPad was distributed via CCleaner to any of the 40 PCs.”

Vlcek said that for Avast, there are two key takeaways from the attack. “First, M&A due diligence has to go beyond just legal and financial matters. Companies need to strongly focus on cybersecurity, and for us this has now become one of the key areas that require attention during an acquisition process.”

“Second, the supply chain hasn’t been a key priority for businesses, but this needs to change. Attackers will always try to find the weakest link, and if a product is downloaded by millions of users it is an attractive target for them. Companies need to increase their attention and investment in keeping the supply chain secure.”

TechSpot

Cisco Switches in Iran, Russia Hacked in Apparent Pro-US Attack

/in , , ,

Hacked Cisco Switch

A significant number of Cisco switches located in Iran and Russia have been hijacked in what appears to be a hacktivist campaign conducted in protest of election-related hacking. However, it’s uncertain if the attacks involve a recently disclosed vulnerability or simply abuse a method that has been known for more than a year.

Cisco devices belonging to organizations in Russia and Iran have been hijacked via their Smart Install feature. The compromised switches had their IOS image rewritten and their configuration changed to display a U.S. flag using ASCII art and the message “Don’t mess with our elections…”

The hackers, calling themselves “JHT,” told Motherboard that they wanted to send a message to government-backed hackers targeting “the United States and other countries.” They claim to have only caused damage to devices in Iran and Russia, while allegedly patching most devices found in countries such as the U.S. and U.K.

Iran’s Communication and Information Technology Ministry stated that the attack had impacted roughly 3,500 switches in the country, but said a vast majority were quickly restored.

Kaspersky Lab reported that the attack appeared to mostly target the “Russian-speaking segment of the Internet.”

While there are some reports that the attack involves a recently patched remote code execution vulnerability in Cisco’s IOS operating system (CVE-2018-0171), that might not necessarily be the case.

The Cisco Smart Install Client is a legacy utility that allows no-touch installation of new Cisco switches. Roughly one year ago, the company warned customers about misuse of the Smart Install protocol following a spike in Internet scans attempting to detect unprotected devices that had this feature enabled.

Attacks, including ones launched by nation-state threat actors such as the Russia-linked Dragonfly, abused the fact that many organizations had failed to securely configure their switches, rather than an actual vulnerability.

Cisco issued a new warning last week as the disclosure of CVE-2018-0171 increases the risk of attacks, but the networking giant said it had not actually seen any attempts to exploit this vulnerability in the wild. Cisco’s advisory for this flaw still says there is no evidence of malicious exploitation.

There are hundreds of thousands of Cisco switches that can be hijacked by abusing the Smart Install protocol, and Cisco Talos experts believe attackers are unlikely to bother using CVE-2018-0171.

The Network Security Research Lab at Chinese security firm Qihoo 360 says the data from its honeypot shows that the attacks have “nothing to do with CVE-2018-0171” and instead rely on a publicly available Smart Install exploitation tool released several months ago.

While none of the major players in the infosec industry have confirmed that the attacks on Iran and Russia rely on CVE-2018-0171, technical details and proof-of-concept (PoC) code have been made available by researchers, making it easier for hackers to exploit.

Hamed Khoramyar, founder of Sweden-based ICT firm Aivivid, said the attacks exploited CVE-2018-0171. Kudelski Security also reported seeing attacks involving both CVE-2018-0171 and another recently disclosed IOS vulnerability tracked as CVE-2018-0156. However, Kudelski’s blog post also lists Khoramyar as one of its sources.

Security Week

Iran hit by global cyber attack that left U.S. flag on screens

/in

DUBAI (Reuters) – Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a U.S. flag on screens along with a warning “Don’t mess with our elections”, the Iranian IT ministry said on Saturday.

“The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country,” the Communication and Information Technology Ministry said in a statement carried by Iran’s official news agency IRNA.

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco (CSCO.O) which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

Cisco did not immediately respond to requests for comment.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco’s Talos Security Intelligence and Research Group, said: “Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol…

“As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths.”

Iran’s IT Minister Mohammad Javad Azari-Jahromi posted a picture of a computer screen on Twitter with the image of the U.S. flag and the hackers’ message. He said it was not yet clear who had carried out the attack.

Azari-Jahromi said the attack mainly affected Europe, India and the United States, state television reported.

“Some 55,000 devices were affected in the United States and 14,000 in China, and Iran’s share of affected devices was 2 percent,” Azari-Jahromi was quoted as saying.

In a tweet, Azari-Jahromi said the state computer emergency response body MAHER had shown “weaknesses in providing information to (affected) companies” after the attack which was detected late on Friday in Iran.

Hadi Sajadi, deputy head of the state-run Information Technology Organisation of Iran, said the attack was neutralised within hours and no data was lost.

Reuters

Malware discovered in CCleaner put millions of users at risk

/in

System-cleaning tool CCleaner is one of the most popular programs of its type in the world. According to Avast, which recently acquired maker Piriform, it boasts over 2 billion worldwide downloads and receives 5 million more each week. But it’s just been reported that up to 2.27 million users were put at risk from a backdoor found in a recent version of the program.

Security firm Cisco Talos warned that version 5.33 of CCleaner, which was downloadable from August 15 to September 11, had been modified to include the Floxif malware. The unaffected version 5.34 was released on September 12, but those who downloaded the tool during the weeks that version 5.33 was available may have unwittingly installed the backdoor.

The exact versions that were infected were the 32-bit version of CCleaner and CCleaner Cloud 1.07.3191. The 64-bit version of CCleaner was not affected.

Floxif can gather information about an infected system and send the data back to a hacker’s server. It can also allow other forms of malware, such as ransomware and keyloggers, to make their way onto a victim’s computer.

It’s unclear exactly how the person or persons responsible breached Avast’s systems, but Talos speculates it could have been “an insider with access to either the development or build environments within the organization.”

Paul Yung, Piriform’s Vice President of Products, has tried to play down the attack. In a blog post today, he wrote: “The threat has now been resolved in the sense that the rogue server is down, other potential servers are out of the control of the attacker.”

“Users of CCleaner Cloud version 1.07.3191 have received an automatic update. In other words, to the best of our knowledge, we were able to disarm the threat before it was able to do any harm.”

The company said it was working with US law enforcement agencies to discover who was behind the incident. “We apologize and are taking extra measures to ensure this does not happen again,” it added.

TechSpot

711 Million Email Addresses Exposed: How to Protect Yourself

/in ,

Typically, your spam folder catches a lot of the malware-infected crud sent by the mischievous never-do-wells from the darker corners of the internet. Unfortunately, a newly discovered attack has targeted more than 711 million email accounts.

Fortunately, only some — not all — of the targets’ passwords have been taken.

The Onliner spambot, first discovered by a Paris-based security researcher who goes by the Benkow pseudonym, was confirmed by well-regarded security expert Troy Hunt in an August 30 blog post. Hunt — a Microsoft Regional Director who runs the breach-tracking website Have I Been Pwned — referred to a data dump from Onliner as “a mind-boggling amount of data,” in which he even found his own email address.

How does Onliner do it?

According to a ZDNet report, the hooligans behind the spambot compiled a massive database of 80 million email credentials from a number of other breaches, such as the LinkedIn hack. These logins were then used to spam 630 million email addresses, whose spam filters they jumped right over.

What can you do?

First, check Have I Been Pwned to see if your email account information is in the hack, Onliner may not have much of your information beyond your address. Onliner worked by sending two rounds of emails, as only a fraction of the 711 million targets could actually be infected by its malware.

If Have I Been Pwned says your email address appeared in the Onliner dump, there are three steps you need to take immediately. The first is changing the password to your email account. Second, make sure you’re not using that password in any other online accounts — especially those for banking. Lastly, enable two-factor authentication, so your email address and password alone aren’t enough for your account to be cracked.

The spambot campaign whittled its target list down by placing a difficult-to-see, pixel-sized image in its initial emails, which contained code to send a user’s IP address and system information back to HQ. If the pixel detected its recipient was a Windows PC (Androids, iOS devices and Macs are protected), it would tell the server to send more-targeted emails — which looked like invoices — to the addresses it identified as vulnerable.

Now’s a good time to look into a password manager, which can help you create strong, hard-to-guess passwords. And of course, do your best to avoid opening suspicious-looking emails, especially those that look like invoices for services you don’t pay for.

The secondary wave of emails is smaller for the sake of obscurity, since larger attacks are more likely to draw the attention of law enforcement and security experts. The infectious emails contain a JavaScript file that does all the dirty work, pwning your machine.

tom's guide

Password manager OneLogin hacked, exposing sensitive customer data

/in

Password manager and single sign-on provider OneLogin has been hacked.

In a brief blog post, the company’s chief security officer Alvaro Hoyos said that it was aware of “unauthorized access to OneLogin data in our US data region,” and that it had reached out to customers.

Hoyos said that the company had blocked the unauthorized access after the breach and is working with law enforcement.

The blog post initially lacked detailed information about the incident, although the post had omitted that hackers had stolen sensitive customer data — a point that the company had instead only mentioned in an email sent to customers, seen by ZDNet.

“OneLogin believes that all customers served by our US data center are affected and customer data was potentially compromised,” the email read.

Later in the day, the company said in an update: “Our review has shown that a threat actor obtained access to a set of [Amazon Web Services, or AWS] keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US.”

The company confirmed that the attack appears to have started at 2am (PT), but staff were alerted of unusual database activity some seven hours later, who “within minutes, shut down the affected instance as well as the AWS keys that were used to create it”.

“The threat actor was able to access database tables that contain information about users, apps, and various types of keys,” the company said.

The company added that although it encrypts “certain sensitive data at rest,” it could not rule out the possibility that the hacker “also obtained the ability to decrypt data”.

But a spokesperson did not say what kind of data is and isn’t encrypted. We have asked for clarity, and will update when we hear back.

Some had questioned earlier in the day how the hackers had access to customer data that could ultimately be decrypted.

“Am I the only 1 to find it disturbing OneLogin had a decryption method for customer data accessible enough to be grabbed via breach?” said one user on Twitter.

The company has advised customers to change their passwords, generate new API keys for their services, and create new OAuth tokens — used for logging into accounts — as well as to create new security certificates. The company said that information stored in its Secure Notes feature, used by IT administrators to store sensitive network passwords, can be decrypted.

The company also hasn’t said how many customers were affected.

According to its website, dozens of major multinationals, including ARM, Dun & Bradstreet, The Carlyle Group, Conde Nast, and Dropbox (which a spokesperson disputed in an email), are customers.

OneLogin allows corporate users to access multiple web applications, sites, and services with just one password. It’s thought that the company has millions of users serving more than 2,000 companies in dozens of countries, according to CrunchBase.

The single sign-on provider integrates hundreds of different third-party apps and services, such as Amazon Web Services, Microsoft’s Office 365, LinkedIn, Slack, Twitter, and Google services.

It’s the second such breach in as many years. Last August, the company warned users that its Secure Notes service had been accessed by an “unauthorized user,” but it denied that any customer data had been compromised.

ZDNet

15 Vulnerable Sites To (Legally) Practice Your Hacking Skills

/in ,

As technology grows, so does the risk of getting hacked. So, it should come as no surprise that InfoSec skills are becoming more important and more in demand. No matter if you’re a beginner or an expert, nor if you’re a security manager, developer, auditor, or pentester – you can now get started by using these 15 sites to practice your hacking skills – legally. They say the best defense is a good offense – and it’s no different in the InfoSec world. Here’s our updated list of 15 sites to practice your hacking skills so you can be the best defender you can – whether you’re a developer, security manager, auditor or pen-tester. And remember – practice makes perfect! Are there any other sites you’d like to add to this list? Let us know below!

1 bWAPP

bWAPP, which stands for Buggy Web Application, is “a free and open source deliberately insecure web application” created by Malik Messelem, @MME_IT. Vulnerabilities to keep an eye out for include over 100 common issues derived from the OWASP Top 10.bWAPP is built in PHP and uses MySQL. Download the project here. For more advanced users, bWAPP also offers what Malik calls a bee-box, a custom Linux VM that comes pre-installed with bWAPP.

2 Damn Vulnerable iOS App (DVIA)

Recently re-released as a free download by InfoSec Engineer @prateekg147, DVIA was built as an especially insecure mobile app for iOS 7 and above. For mobile app developers the platform is especially helpful, because while there are numerous sites to practice hacking web applications, mobile apps that can be legally hacked are much harder to come by!Get going with DVIA by watching this YouTube video and reading the ‘Getting Started‘ guide.

3 Game of Hacks

Alright, this one isn’t exactly a vulnerable web app – but it’s another engaging way of learning to spot application security vulnerabilities, so we thought we’d throw it in. Call it shameless self-promotion, but we’ve received amazing feedback from security pros and developers alike, so we’re happy to share it with you, too! The game is designed to test your AppSec skills and each question offers a chunk of code which may or may not have a security vulnerability – it’s up to you to figure it out before the clock runs out. A leaderboard makes Game of Hacks just that much more enticing.

4 Google Gruyere

This ‘cheesy’ vulnerable site is full of holes and aimed for those just starting to learn application security. The goal of the labs are threefold:

  • Learn how hackers find security vulnerabilities
  • Learn how hackers exploit web applications
  • Learn how hackers find security vulnerabilities
  • Learn how to stop hackers from finding and exploiting vulnerabilities

“‘Unfortunately,’ Gruyere has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution,” the website states. “The goal of this code lab is to guide you through discovering some of these bugs and learning ways to fix them both in Gruyere and in general.”

Written in Python, Gruyere offers opportunities for both black box and white box testing so “hackers” have the chance to play on both sides of the fence.

Get started here: http://google-gruyere.appspot.com/

5 HackThis!!

HackThis!! was designed to teach how hacks, dumps, and defacement are done, and how you can secure your website against hackers. HackThis!! offers over 50 levels with various difficulty levels, in addition to a lively and active online community making this a great source of hacking and security news and articles.
Get started with HackThis!! here.

6 Hack This Site

HackThisSite! is a legal and safe place for anyone to test their hacking skills. The hub offers hacking news, articles, forums, and tutorials and aims to teach users to learn and practice hacking through skills developed by completing challenges.Start your training on HackThisSite here

7 Hellbound Hackers

Hellbound Hackers, the hands-on approach to computer security, offers a wide array of challenges with the aim to teach how to identify exploits and suggest the code to patch it. And Hellbound Hackers really is the ultimate site for hacking tutorials, covering a large range of topics from encryption and application cracking, to social engineering and rooting. With a community of nearly 100k registered members, it’s also one of the biggest hacking communities out there.
Read more and get started here.

8 McAfee HacMe Sites

Foundstone, a practice within McAfee’s Professional Services, launched a series of sites in 2006 aimed for pen testers and security professionals looking to increase their InfoSec chops. Each simulated app offers a “real-world” experience, built with “real-world” vulnerabilities. From mobile bank apps to apps designed to take reservations, these projects cover a wide array of security issues to help any security-minded professional stay ahead of the hackers.
The group of sites include:

9 Mutillidae

Yet another OWASP project on our list, Mutillidae is another deliberately vulnerable web application built for Linux and Windows. This project is actually a set of PHP scripts containing all the OWASP Top Ten vulnerabilities and more and is armed with hints to help users get started.
Get started with Mutillidae here, and be sure to check out the projects dedicated YouTube channel and Twitter account, run by Mutillidae’s second-generation developer, Jeremy Druin.

10 OverTheWire

OverTheWire is great for developers and security professionals of all experience levels to learn and practice security concepts. This pracrice comes in form of fun-filled wargames – beginners should start with “Bandit”,. where the basics are taught, and will progress to higher levels and to advanced games all with more complex bugs and exploits to patch as you go. Jump in the game here

11 Peruggia

Peruggia is a safe environment for security professionals and developers to learn and test common attacks on web applications. Peruggia is set as an image gallery in which you can download projects to help you learn how to locate and limit potential issues and threats. Download Peruggia here.

12 Root Me

Root Me is a great way to challenge and improve your hacking skills and web security knowledge through over 200 hacking challenges and 50 virtual environments. Check out Root Me here.

13 Try2Hack

Created by ra.phid.ae and considered one of the oldest challenge sites still around, Try2Hack offers multiple security challenges.
The game features diverse levels which are sorted by difficulty, all created to practice hacking for your entertainment. There is an IRC channel for beginners where you can join the community and ask for help, in addition to a full walkthrough based on GitHub.Try2Hack is available here.

14 Vicnum

An OWASP project, Vicnum is a series of basic and obviously web apps based on games “commonly used to kill time.” Because of their simple frameworks, the applications can be tailored for different needs, making Vicnum a great choice for security managers looking to help teach developers AppSec in a fun way.

The goal of Vicnum is “to strengthen the security of web applications by educating different groups (students, management, users, developers, auditors) as to what might go wrong in a web app, the site says. “And of course it’s OK to have a little fun.”

Check out the site, developed by Mordecai Kraushar here to find the games and available CTFs for download.

15 WebGoat

One of the most popular OWASP projects is WebGoat. This insecure app provides a realistic teaching and learning environment with lessons designed to teach users about complex application security issues. WebGoat is aimed for developers looking to learn more about web app security. The name WebGoat is a scapegoat reference: “Even the best programmers make security errors. What they need is a scapegoat, right? Just blame it on the ‘Goat!’”
Installs are available for Windows, OSX Tiger and Linux and has separate downloads for J2EE and .NET environments. There is an “easy-run” version as well as a “source distribution” version that allows users to modify the source code.

Check out the OWASP project page here or the GitHub page to get started with WebGoat.

For help with the lessons, take a look at this series of videos available for download.