| Application | Port | Primary Lesson |
|---|---|---|
| DVWA (Damn Vulnerable Web Application) | 80/tcp | SQL injection, command injection, adjustable difficulty levels |
| Mutillidae | 80/tcp | Broad OWASP Top 10 coverage in one app |
| TWiki | 80/tcp | Legacy wiki software with historical remote-code-execution issues |
| WebDAV directory | 80/tcp | Insecure file upload / directory exposure |
| Apache Tomcat | 8180/tcp | Default manager-console credentials |
Why It Exists
DVWA and Mutillidae were purpose-built teaching tools, bundled onto Metasploitable 2 so learners have a browser-based target alongside the network-service targets. The bundled TWiki install and open WebDAV directory add a second flavor of web risk — legacy application software and insecure file-handling configuration — rather than another intentionally-vulnerable teaching app.
How It's Identified
Manual testing and a web proxy (such as Burp Suite or OWASP ZAP) reveal unsanitized input reflected directly into database queries or page output:
- SQL injection: a query parameter that changes the page's data output when you append SQL syntax to it, most easily explored inside DVWA's dedicated SQLi module.
- Cross-site scripting (XSS): input that gets reflected back into the page unescaped, executable as script in another user's browser session.
- Insecure file handling: a WebDAV directory that accepts uploads without validating file type, or a legacy app like TWiki with known historical code-execution issues in unpatched versions.
A basic content scan also reveals the separate Tomcat instance on port 8180, worth checking for a default manager-console login the same way you'd check any other default account on this machine.
The Lesson
Input validation and output encoding are foundational at every layer that touches user input, not an afterthought bolted on later. Most of the flaws bundled here map directly onto the OWASP Top 10, the industry's most widely referenced list of common web application risks — which is exactly why these specific apps were chosen as teaching tools in the first place.
How Defenders Mitigate It
Use parameterized queries (never string-concatenated SQL), apply framework-level output escaping for anything rendered back to a browser, validate and restrict file uploads by type and destination, and treat a web application firewall as a secondary control, never a primary one. Management consoles like Tomcat's should never ship with default credentials into any environment beyond a local lab.
Only interact with this service inside your own isolated Metasploitable 2 lab. Testing it against a system you don't own or have written permission to test is illegal in most jurisdictions.
Related: default credentials for the bundled web app logins.
FAQ
Are DVWA and Mutillidae unique to Metasploitable 2?
No, both are independently maintained, widely used training projects that also run on their own outside of Metasploitable 2.
Do I need a separate login for these web apps?
Yes, they typically have their own default web-app credentials distinct from the machine's SSH login. See the default credentials page.
What other web applications are bundled besides DVWA and Mutillidae?
Metasploitable 2 also includes a TWiki installation and an exposed WebDAV directory under Apache, plus a separate Apache Tomcat instance on port 8180 with its own manager console.
What's the difference between SQL injection and cross-site scripting?
SQL injection manipulates a backend database query through unsanitized input, while cross-site scripting (XSS) injects script that runs in another user's browser. Both stem from the same root cause: user input treated as trusted code or query syntax.