OWASP Mutillidae II is a deliberately vulnerable training website with built-in hints, security levels, and dozens of lessons. This page gives the current five-container Docker setup, creates the local hostname, initializes the database, and keeps the recurring start, log, stop, and reset commands in one place.
What is OWASP Mutillidae II?
Mutillidae II is an OWASP deliberately vulnerable web application for guided and free-form practice. It includes common web weaknesses, built-in hints, adjustable security levels, and a secure mode that helps learners compare vulnerable and defensive behavior.
The current Docker project builds five local containers for the website, database, database administration, LDAP, and LDAP administration. The first browser visit normally shows a database warning; using the rebuild link or the setup command below initializes the lab.
Download, install, run and test OWASP Mutillidae II
Mutillidae II is a deliberately vulnerable web application with built-in hints, multiple security levels, database and LDAP services, and many web and API-style lessons. The commands below download the maintained Docker project and build all five containers.
Ubuntu: complete Bash installation
Open a Bash terminal and paste the full block. It installs every required package, downloads the current project or image, starts the lab, tests the web service, and prints the browser address.
RHEL, Rocky Linux or AlmaLinux: complete Bash installation
Open Bash and paste the full block. These commands use and the Docker RHEL repository.
Windows 10 or 11: complete cmd.exe installation
Open Command Prompt as Administrator. The first block installs Docker Desktop. If Windows requests a restart, restart, reopen , and paste the same block again.
How to use Mutillidae without wandering around
Start with the application menu and choose one vulnerability family. Read the built-in hints before trying random input. Mutillidae is especially useful when you compare the same page across security levels: the vulnerable behavior, partial defenses, and secure behavior are often easier to understand side by side.
Use the database reset whenever a lesson becomes inconsistent. For classroom use, reset between groups so every learner starts from the same state. Keep the LDAP and database administration pages limited to the local machine.
Troubleshooting that actually helps
| Problem | What to check | Fix |
|---|---|---|
| mutillidae.localhost does not resolve | Hosts file entry | Add |
| Database warning remains | Database initialization | Select the rebuild link, wait for success, and refresh the home page. |
| Build fails on one service | Detailed Compose logs | Run |
| Port 80 is already used | Existing web server | Stop the existing service or review the Compose port mappings before starting. |
How Ammune helps with production risks represented by Mutillidae II
Mutillidae exposes many classic weaknesses through forms, URLs, cookies, files, and server-side features. In production, comparable risks often appear in REST endpoints and data-rich API responses.
Build an inventory from observed traffic and show which endpoints, methods, parameters, and response fields are actually in use.
Inspect both sides of an API transaction so analysts can see the input, returned data, status, identity context, and related behavior.
Turn suspicious API activity into risk-ranked, SIEM-ready evidence that can support monitoring, investigation, and carefully controlled enforcement.
| Training weakness | Production API risk | How Ammune can help |
|---|---|---|
| Injection and command execution | Untrusted API input reaches SQL, LDAP, XML, or operating-system functions. | Inspect request structures and parameter values, identify suspicious payload patterns, and preserve endpoint and response context for investigation. |
| Authentication and authorization flaws | A caller reaches another user’s data or a restricted function. | Analyze identities, roles, endpoints, object IDs, and behavior to expose authorization anomalies. |
| Unsafe uploads and content types | An API accepts a file or body type that does not match the expected operation. | Surface unexpected content types, methods, file-related endpoints, schema changes, and abnormal response behavior. |
| Data leakage | Error messages or API responses reveal sensitive implementation or customer data. | Inspect response bodies for PII, PCI, tokens, secrets, stack details, and excessive object properties. |
Related Ammune guidance: API sensitive data exposure API authorization vs authentication API schema drift detection OWASP Juice Shop Docker installation and login guide
Verified project sources
The tutorial above is complete; these links are included for release history, project ownership, and future verification—not because you need to leave this page to finish the installation.
Frequently asked questions
What makes Mutillidae different from a single-challenge lab?
It combines many weaknesses, hints, security levels, database services and web-service examples in one application.
What are Mutillidae security levels?
They let learners compare deliberately weak behavior with progressively stronger protections inside the same feature.
Why does Mutillidae have a database rebuild option?
It restores the training data and schema after exercises change or damage the application state.
Does Mutillidae include API-style content?
Yes. Its REST and SOAP areas help demonstrate how web-service inputs, authorization and responses can fail.
What should a learner compare between insecure and secure modes?
Compare validation, authorization, error handling, output encoding and how much sensitive information appears in responses.
How does Ammune connect to these lessons?
Ammune focuses on real production API traffic, including discovered endpoints, abnormal behavior, response leakage and SIEM-ready evidence.
Apply the lessons from OWASP Mutillidae II to real API traffic
Ammune helps security, DevSecOps, and SOC teams discover APIs, inspect requests and responses, identify abuse and data exposure, and turn runtime evidence into practical investigation or enforcement workflows.