Monday, May 29, 2023

Learning Web Pentesting With DVWA Part 1: Installation



In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa




It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:



login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.



Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.




Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:



From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.



Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.



We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

Read more


  1. Game Hacking
  2. Pentest Tools Android
  3. Growth Hacker Tools
  4. Hacking Tools 2019
  5. Hack Tools
  6. Hacking Tools And Software
  7. Pentest Tools For Mac
  8. Hacking Tools 2019
  9. Github Hacking Tools
  10. Hacker Tools
  11. Pentest Tools For Ubuntu
  12. Hacking Tools 2020
  13. Pentest Tools Kali Linux
  14. Hacking Tools
  15. Pentest Tools For Windows
  16. World No 1 Hacker Software
  17. Hack Tools For Windows
  18. Pentest Tools For Mac
  19. Hackers Toolbox
  20. Hacker Tools 2019
  21. Hack Tools Download
  22. Hacking Tools
  23. Pentest Tools Find Subdomains
  24. Hacks And Tools
  25. Hacks And Tools
  26. Hacking Tools Mac
  27. Black Hat Hacker Tools
  28. Nsa Hack Tools
  29. Hacking Tools For Pc
  30. Android Hack Tools Github
  31. Hacker Tools Hardware
  32. Hacking Tools
  33. Hacking Tools For Beginners
  34. Hacking Tools For Games
  35. Hacker Tools Free
  36. Hacking Tools For Windows
  37. Pentest Tools Github
  38. Hacking Tools Hardware
  39. Best Hacking Tools 2020
  40. Hacking Tools Usb
  41. Hacking Apps
  42. Bluetooth Hacking Tools Kali
  43. Best Pentesting Tools 2018
  44. Hacker Tools Software
  45. Nsa Hack Tools
  46. Hack Tools
  47. New Hacker Tools
  48. Hacker Tools 2019
  49. Hacker Tools 2019
  50. Pentest Tools Apk
  51. Install Pentest Tools Ubuntu
  52. Pentest Box Tools Download
  53. Pentest Tools Alternative
  54. Pentest Tools Subdomain
  55. Hacking Apps
  56. Pentest Tools For Ubuntu
  57. Usb Pentest Tools
  58. Pentest Tools Framework
  59. Pentest Tools Alternative
  60. Pentest Tools For Ubuntu
  61. Bluetooth Hacking Tools Kali
  62. Hack Rom Tools
  63. Hacker Tools Hardware
  64. Hacker Tools 2020
  65. Hacker Tools 2020
  66. Pentest Tools Subdomain
  67. Hacker Search Tools
  68. Wifi Hacker Tools For Windows
  69. World No 1 Hacker Software
  70. Hacking Tools
  71. Hacking Tools For Windows Free Download
  72. Best Pentesting Tools 2018
  73. Hacking Tools For Mac
  74. Hacking Tools Pc
  75. Nsa Hacker Tools
  76. Hacker Tools Windows
  77. Hacking Tools 2020
  78. Hacker Tools Windows
  79. Pentest Tools Android
  80. Pentest Tools Review
  81. Hack Tools 2019
  82. Hacker Tools List
  83. Black Hat Hacker Tools
  84. Hack Website Online Tool
  85. Pentest Tools Windows
  86. Hacker Search Tools
  87. Hack Tools For Pc
  88. Pentest Tools Alternative
  89. Pentest Tools Alternative
  90. Hacking Tools For Kali Linux
  91. Pentest Reporting Tools
  92. Hack Apps
  93. Beginner Hacker Tools
  94. Pentest Tools Android
  95. Hacking Tools Online
  96. Hackrf Tools
  97. Hacking Tools Download
  98. Pentest Tools Find Subdomains
  99. Hacker Tools
  100. Hacking Tools Download
  101. Top Pentest Tools
  102. Hacker Tools Hardware
  103. Hacker Tool Kit
  104. Android Hack Tools Github
  105. Hacker Hardware Tools
  106. Hacker Tools Apk
  107. Hacker Tools Free
  108. Hack Website Online Tool
  109. Hacking Tools For Mac
  110. Hack Tools
  111. Pentest Tools Tcp Port Scanner
  112. Hacker Tools Free Download
  113. Hacker Tools Windows
  114. Hacking Tools Usb
  115. Hacker Tools Windows
  116. Hacking Tools Windows 10
  117. Easy Hack Tools
  118. Tools For Hacker
  119. Hack Tools For Ubuntu
  120. Pentest Automation Tools
  121. Pentest Reporting Tools
  122. Hacker Tools List
  123. Usb Pentest Tools
  124. Hackers Toolbox
  125. Hacker Techniques Tools And Incident Handling
  126. Underground Hacker Sites
  127. Hack Tools For Games
  128. Pentest Tools Website
  129. Hacking Tools Github
  130. Hacking Tools For Windows Free Download
  131. Hack Tools 2019
  132. Hacking Tools Kit
  133. Hacker Security Tools
  134. New Hack Tools
  135. Hacker Tools For Mac
  136. Pentest Tools Android
  137. Hacker Tools Apk
  138. Hacker Tool Kit
  139. Hacking App
  140. Hack Apps
  141. Pentest Tools Port Scanner
  142. Pentest Tools Kali Linux
  143. Hacker Tools For Pc
  144. Hacker Techniques Tools And Incident Handling
  145. Hacker Tools For Mac
  146. Hackrf Tools
  147. Nsa Hacker Tools
  148. Pentest Tools Kali Linux
  149. Pentest Tools Framework
  150. Pentest Tools Bluekeep
  151. Hackers Toolbox
  152. Pentest Tools
  153. Pentest Tools List
  154. Beginner Hacker Tools
  155. New Hacker Tools
  156. Black Hat Hacker Tools
  157. Termux Hacking Tools 2019

No comments:

Post a Comment