Wednesday, August 26, 2020

Learning Web Pentesting With DVWA Part 1: Installation



In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa




It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:



login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.



Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.




Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:



From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.



Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.



We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

More information


  1. Pentest Automation Tools
  2. Hacker Techniques Tools And Incident Handling
  3. Pentest Automation Tools
  4. Hacking Tools Software
  5. What Is Hacking Tools
  6. Pentest Tools Url Fuzzer
  7. Pentest Tools Review
  8. Pentest Tools
  9. Best Pentesting Tools 2018
  10. Hacking Tools For Pc
  11. Pentest Tools Tcp Port Scanner
  12. Install Pentest Tools Ubuntu
  13. Free Pentest Tools For Windows
  14. Hacker Tools Apk Download
  15. Pentest Tools Download
  16. Hacking Tools Usb
  17. Hacker Tools Free
  18. World No 1 Hacker Software
  19. Hacker Security Tools
  20. Growth Hacker Tools
  21. Pentest Box Tools Download
  22. Hacker Tools List
  23. Best Hacking Tools 2020
  24. Pentest Tools Find Subdomains
  25. Hack And Tools
  26. Pentest Tools Review
  27. Best Hacking Tools 2019
  28. Pentest Tools Url Fuzzer
  29. Hack Tools Github
  30. Hacker Tools Free
  31. Hack Tools For Windows
  32. Hacker Techniques Tools And Incident Handling
  33. How To Hack
  34. How To Install Pentest Tools In Ubuntu
  35. Hacker Tools For Pc
  36. Hack Tools Download
  37. Pentest Tools For Ubuntu
  38. Easy Hack Tools
  39. Pentest Tools Nmap
  40. Pentest Tools Review
  41. Hacker Techniques Tools And Incident Handling
  42. Hack And Tools
  43. Hack App
  44. Hack Tools Github
  45. Pentest Tools Website
  46. Hacking Tools And Software
  47. Hacking Tools For Windows
  48. Hacking Tools Name
  49. Pentest Tools List
  50. Pentest Tools Alternative
  51. Nsa Hacker Tools
  52. Hack Tool Apk
  53. Hacker Hardware Tools
  54. Hacker Tools For Mac
  55. What Is Hacking Tools
  56. Hak5 Tools
  57. Tools Used For Hacking
  58. Hacking Tools Mac
  59. Hack Tools Online
  60. Hack Tools
  61. Hack Tool Apk No Root
  62. Hacking Tools Free Download
  63. Hack Tool Apk No Root
  64. Tools 4 Hack
  65. Hacking Tools Hardware
  66. Best Hacking Tools 2020
  67. What Are Hacking Tools
  68. Physical Pentest Tools
  69. Hacks And Tools
  70. Pentest Tools Website Vulnerability
  71. Best Hacking Tools 2020
  72. Pentest Tools Url Fuzzer
  73. Hacker
  74. Tools For Hacker
  75. Pentest Reporting Tools
  76. Pentest Tools Android
  77. Hacking Tools For Windows
  78. Pentest Tools Kali Linux
  79. Hack Tool Apk
  80. Hack Rom Tools
  81. Hacking Tools For Windows Free Download
  82. Hacking Tools Free Download
  83. Ethical Hacker Tools

No comments:

Post a Comment