Owasp Mth3l3m3nt Framework

OWASP Mth3l3m3nt Framework is a penetration testing aiding tool and exploitation framework. It fosters a principle of attack the web using the web as well as pentest on the go through its responsive interface.
Alternatives To Owasp Mth3l3m3nt Framework
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
4 days ago92JavaScript
The Browser Exploitation Framework Project
Active Directory Exploitation Cheat Sheet3,633
4 months ago2mit
A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.
8 days ago32bsd-3-clausePython
The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
12 days ago30September 19, 20228apache-2.0Go
📦 Make security testing of K8s, Docker, and Containerd easier.
23 days ago2bsd-3-clausePowerShell
Automation for internal Windows Penetrationtest / AD-Security
a month ago3gpl-3.0Python
Automated NoSQL database enumeration and web application exploitation tool.
3 months ago1Python
Hash collisions and exploitations
2 years ago15apache-2.0C
Interactive CTF Exploration Tool
10 months ago63otherC
a VPN daemon
Heap Exploitation1,192
6 months ago6C
This book on heap exploitation is a guide to understanding the internals of glibc's heap and various attacks possible on the heap structure.
Alternatives To Owasp Mth3l3m3nt Framework
Select To Compare

Alternative Project Comparisons

#OWASP Mth3l3m3nt Framework

A slightly major (forgive pun) upgrade is on going. This is to bring in things like:

  • Easier coding standard
  • Support for PHP 8
  • More robust features
  • Fix bug requests sent in.

This tool is released under GNU Affero General Public License v3.

Modules Packed in so far are:

  • Payload Store
  • Shell Generator (PHP/ASP/JSP/JSPX/CFM)
  • Payload Encoder and Decoder (Base64/Rot13/Hex/Hexwith \x seperator/ Hex with 0x Prefix)
  • LFI Exploitation module (currently prepacked with: Koha Lib Lime LFI/ Wordpress Aspose E-book generator LFI/ Zimbra Collaboration Server LFI)
  • HTTP Bot Herd to control web shells.
  • String Tools
  • Client Side Obfuscator
  • Cookie Theft Database (Enables you to steal session cookies & download page content if a stored XSS is present)

Currently it is set to use a flat file database.

Copy all the files into your webroot except db_dump_optional

Ensure the Folders Below are writeable:

  • tmp
  • framework/data
  • framework/data/site_config.json
  • incoming/
  • scripts/

It should run from the get go All just navigate to it.

the login url is: /cnc

username:mth3l3m3nt password:mth3l3m3nt

By Default I have set it to use the JIG database but this you can change at any point in the backend. The DB Dump in place is for users who use MySQL and need demo data. Unfortunately I have only done for MySQL. It's my DB of choice.

Alternatively watch the installation here:


If you would like to switch from JIG you can do so in the settings. Please note the DB has to be created, it only populates it with the required tables, it doesn't drop or create the DB , other supported Databases are:

  • Mongo DB
  • PostgreSQL
  • SQLite
  • MySQL

Other than SQLite please ensure that you have the PHP extensions for the Databases above so that it can access them through PHP Data Objects.

For MySQL users needing MySQL Sample Data like alot of it especially payloads switch the database to MySQL and import data from the Dump to populate.

Incase of questions or suggestions or bugs and what nots: http://munir.skilledsoft.com

You may also send them or subscribe to the mailing list: https://lists.owasp.org/mailman/listinfo/owasp-mth3l3m3nt-framework-project

It's been tested on :

  • Apache
  • Litespeed
  • Nginx
  • Lighttpd

Incase you test on another server please give your review.

If installing it in a subfolder edit the .htaccess file to reflect the RewriteBase as the subfolder.

Having Problems getting it running on your webserver, check out our webserver configuration guide.

Popular Attack Projects
Popular Exploitation Projects
Popular Security Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.
Penetration Testing
Exploitation Framework