# OWASP Mutillidae II for Controlled Web Security Training

> OWASP Mutillidae II is a deliberately vulnerable PHP application for practicing web attacks in a controlled environment. It suits security courses, CTFs, labs, and assessment-tool testing, but its exposed weaknesses require strict isolation.

**webpwnized/mutillidae** — OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

- Repository: https://github.com/webpwnized/mutillidae
- Stars: 1,532 · Forks: 569
- Language: PHP
- License: GPL-3.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/webpwnized-mutillidae

## A deliberately exposed PHP target for security education

OWASP Mutillidae II solves a specific training problem: learners need a web application that contains known weaknesses without requiring them to damage a real system or build every exercise environment from scratch. The README describes it as a free, open-source, deliberately vulnerable web application aimed at web-security enthusiasts, classrooms, CTFs, security labs, and vulnerability-assessment targets. Its stated uses include graduate courses, corporate training, and assessments of security software.

Its central design choice is that the application is genuinely vulnerable. The README says this eliminates the need for users to enter a “magic” statement, meaning learners can interact with an application whose weaknesses are present rather than simulated through a special activation path. The application includes over 40 vulnerabilities and challenges, covering the OWASP Top Ten categories from 2007 through 2017. The directory listing also identifies labs for SQL injection, XSS, and file inclusions, as well as REST and SOAP web-service areas.

This is a training target, not software intended for normal production use. It is suitable when the objective is to study request handling, authentication, input processing, file behavior, and related web-security failures. It is unsuitable when the objective is to deploy a secure service. The same source that helps a learner explore an attack can expose a real network if the application is copied outside a controlled lab.

## How the application is organized around PHP labs and services

The repository places application source under `src`, and the README warns users to adjust paths because the source code has moved into that directory. The root contains project documentation and contribution files, while `src` contains the runnable application and supporting components.

Inside `src`, the `labs` directory contains security-testing challenges such as SQL injection, cross-site scripting, and file inclusion exercises. The `classes` directory is described as containing PHP classes for tasks including logging, token management, and database operations. Reusable templates and configuration files are held under `includes`, while `javascript` contains browser-side libraries, custom scripts, and initializers. This separation indicates a conventional PHP web application rather than a command-line scanner or a standalone exploitation framework.

The application also includes `ajax`, `data`, `documentation`, `images`, `passwords`, and `styles` directories. The `webservices` area contains REST and SOAP endpoints, with separate components for REST files, SOAP services, and SOAP libraries. The presence of REST and SOAP material matters when choosing an exercise path. A learner working on request handling or service behavior can work within the relevant web-service files instead of treating Mutillidae as a collection of isolated scripts.

The README does not document a central application architecture, database schema, deployment topology, or complete request lifecycle. It provides directory-level descriptions, but those descriptions are not enough to infer a particular PHP framework or persistence model. Claims about how a challenge executes its database query or renders its response should be checked in the relevant files under `src`.

## Docker, AMP stacks, and bundled targets are the documented paths

The README does not provide copyable shell commands, Docker commands, package names, or a complete configuration file. It provides installation paths and video guides. The documented standard installation uses DockerHub images, while the alternative Docker path includes a Docker installation guide for Ubuntu and a guide for running Mutillidae with Docker. The README also points to a guide for running Mutillidae on Google Kubernetes Engine.

For a user who already has a LAMP stack, the legacy installation route points to `README-INSTALLATION.md` and a video tutorial. The README states that Mutillidae can be installed on Linux and Windows using LAMP, WAMP, and XAMPP-style stacks. The exact command sequence, PHP version, web-server configuration, and database setup are not included in the README, so they are not reproduced here.

Another route is an existing security distribution or lab image. The README lists Mutillidae as preinstalled on Rapid7 Metasploitable 2, Samurai Web Testing Framework, and OWASP Broken Web Apps. It also says that an existing version can be updated on those platforms. This is useful for courses that already standardize on one of those environments, but the README does not document the update command or compatibility matrix.

Because installation details are linked rather than written as a local procedure, the first step should be to open the installation guide or video guide and confirm the current source path under `src`. A successful setup should expose the Mutillidae application through the chosen web stack and provide access to its Setup interface. The README names the “Setup” button but does not state a default URL or port, so neither can be supplied as a verified value.

## Using the Setup button to reset and switch training conditions

Mutillidae includes controls for managing the state of the training application. The README identifies a one-click system restoration action called the “Setup” button. It also says users can switch between secure and insecure modes. These features are relevant to classroom use because one exercise may require a vulnerable condition while another may require a safer baseline.

The distinction between modes should not be interpreted as a guarantee that the application is safe in secure mode. The project is deliberately vulnerable, and the README does not enumerate every behavior changed by the mode switch. A learner or instructor should treat secure mode as an application setting for a particular exercise, not as network isolation or permission to expose the host to an untrusted network.

The README directs users to the `webpwnized` YouTube channel and a playlist for usage tutorials. It does not provide a complete first-exercise walkthrough, default credentials, exact challenge sequence, or documented reset API. As a result, the supported first use is limited to what the repository states: install the application through one of the documented paths, open the application, locate the Setup button, and use the available reset and mode controls before beginning an exercise.

For classroom planning, instructors should record which mode each lab requires and how the application will be reset between learners. The README does not specify a container reset command or a multi-user isolation procedure. Those details must be obtained from the project’s installation documentation rather than inferred.

## The security trade-off is intentional exposure, not an accidental defect

The principal limitation is also the project’s reason for existing. Mutillidae II contains real vulnerabilities by design, so deploying it on a reachable host can affect that host and nearby systems. The README does not provide a sandbox guarantee, network policy, authentication policy, or production hardening checklist. It describes the application as an environment for controlled practice, but it does not spell out every containment requirement.

This makes the project a poor fit for a production deployment, a public trial environment, or any system containing sensitive information. It can also be the wrong tool for a learner who needs to analyze a specific external application or reproduce one vendor-specific stack. Mutillidae offers a known-vulnerable target with many categories of exercises. It does not claim to model an arbitrary organization’s application, and the README does not document integrations with external services or real user data.

The secure and insecure mode switch may help isolate selected lessons, but it cannot replace infrastructure controls. The application should be placed in an environment where access is limited to authorized learners and where accidental network reachability is understood before the first exercise begins. The README’s references to Docker, Ubuntu, Google Kubernetes Engine, LAMP, WAMP, and XAMPP indicate several possible deployment routes, but it does not state which route is safest for a particular host.

A second limitation is documentation depth. The directory structure identifies useful areas, including `webservices`, `passwords`, and `data`, but the README does not document credentials, API routes, request formats, database initialization, or the exact behavior of each challenge. A new user should not infer that every listed directory is immediately usable without following the linked installation guide.

## Comparing Mutillidae with a conventional secure PHP application

A conventional PHP application is designed to protect its users and data while providing a normal service. Its authentication, input handling, file access, database access, and service endpoints are expected to resist abuse. Mutillidae II takes the opposite approach: the README explicitly says the application is actually vulnerable and provides over 40 challenges for learning and practicing web-security techniques.

The practical difference is the purpose of a discovered weakness. In a secure application, an unexpected injection or file-inclusion issue indicates a defect that requires remediation. In Mutillidae, such behavior can be the exercise target. Its value comes from having a stable, recognizable target with hints and categories of vulnerabilities, not from providing software that can safely be exposed to attackers.

Mutillidae is also different from a penetration-testing framework. The repository describes a PHP web application with labs and web services, while a penetration-testing framework normally provides tools for scanning or testing targets. Mutillidae can serve as the target for vulnerability-assessment software, according to the README, but the repository does not say that Mutillidae performs scanning, exploitation, or target discovery itself.

For training environments that already include Mutillidae, such as the distributions named in the README, the difference may be packaging convenience rather than capabilities. For a new setup, the decision is whether a deliberately vulnerable teaching target is acceptable and whether the required PHP web stack or container environment is available.

## Maintenance, licensing, and upgrade boundaries

The repository is not archived, and the last push was on 2026-09-24. The repository has no GitHub releases listed. The README points to `CHANGELOG.md` for project changes, and the repository includes a `version` file. Those are the documented places to inspect for version-specific changes.

The project uses the GPL-3.0 license. That is a repository and distribution fact, not legal advice about a particular deployment. Anyone redistributing or modifying the application should review the license text and associated obligations independently. The README does not document a separate support policy for hosted instances or a formal upgrade path for every bundled distribution.

The README says that the existing version can be updated on SamuraiWTF and OWASP BWA, but it does not state how to perform that update. It also lists Rapid7 Metasploitable 2 as a distribution where Mutillidae is preinstalled. Since no GitHub releases are listed, operators should compare the repository version and `CHANGELOG.md` rather than relying on a release tag. The last push date should not be treated as a guarantee of compatibility with a particular PHP, database, or container configuration.

## Conclusion

Adopt Mutillidae II for a contained teaching lab when a real application with known weaknesses is acceptable and the PHP application must be exposed only to authorized users. Do not use it as production software, a public demo, or a host for sensitive data. Verify first that the instance is isolated from internal networks and that secure mode is configured for exercises that depend on it.

## FAQ

### What is OWASP Mutillidae II used for?

It is a deliberately vulnerable PHP web application for practicing web-security techniques in labs, classrooms, CTFs, and vulnerability-assessment environments. The README describes over 40 vulnerabilities and challenges covering OWASP Top Ten categories from 2007 to 2017.

### How do I install OWASP Mutillidae II?

The README links to DockerHub installation, Docker on Ubuntu, Google Kubernetes Engine, and a legacy LAMP installation guide. It does not include copyable commands, so use the linked installation guide and follow its current `src` directory path.

### Can OWASP Mutillidae II be used in production?

No. The application is deliberately vulnerable and is intended as a training target. The README does not describe it as production software or provide a production deployment and hardening guarantee.

### What does the Setup button do in OWASP Mutillidae II?

The README says the Setup button provides one-click restoration to default settings. It also says users can switch between secure and insecure modes, although the README does not enumerate the behavior of every mode.

## Sources

- [Issues](https://github.com/webpwnized/mutillidae/issues)
- [License: GPL-3.0](https://github.com/webpwnized/mutillidae/blob/main/LICENSE)
- [README](https://github.com/webpwnized/mutillidae/blob/main/README.md)
- [webpwnized/mutillidae on GitHub](https://github.com/webpwnized/mutillidae)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/webpwnized-mutillidae