Setting up a vulnerable public web app

[arthurema]

I have a educational project in front of me. I am to setup a few different vulnerable web apps, like DVWA, and have them available on a public network. I'm looking for tips and ideas on how to best pull this off. Things to consider, putting database files into RAMDISK, time based, auto refresh of the complete application environment, application session files, etc.

[jack08642qa]

lets see first lets start with a basic security fault I have already seen before

In a public app on facebook someone was using ajax to get it running and they actually had their database name and pass and username as a comment next to an ajax line getting the database info from the php script

another thing is that if this app stores user info just don't sanitize any user input and make sure to allow the script to show mysql errors

[weekend hacker]

I'd say, put it in a vm. Then you can make it read only and restart whenever.

Or when coding stuff yourself sqlite allows you to store things in ram (it will disappear as soon as the connection is closed) and it could build that table from an existing table. (you'll need to filter out some sqlite commands which would allow merging with other files or overwrite certain limits you've put in place and maybe other stuff to keep it secure though). Or you could randomly delete the files and build a new table if it doesn't exist.(still filter some of the input as above).
Getting the usual databases to store things in ram isn't super tricky, but getting them to work when you reset it might be harder. And certain commands could still result in their output being stored in a location of their choosing.

The VM option would be the nicest though since it will be 100% realistic, but having several VMs up on a limited set of IPs or resetting things at an appropriate time might be tricky(trust me, its been on the HTS wishlist for far too long)
But with only 1 instance alive for each different type of vuln it could be done with a simple cron job restarting it every x minutes.

Other folks might have more ideas.
I'd love to hear how this works out, keep us updated ^^