Contact Us
Contact Us
DVWA

Mastering DVWA : Complete Guide to the Damn Vulnerable Web App for Ethical Hacking

scurizen6 Comments on Mastering DVWA : Complete Guide to the Damn Vulnerable Web App for Ethical Hacking

Explore DVWA, its features, and how it aids in web security testing for all users. Learn about its applications and benefits today.
 

DVWA

Overview of DVWA

DVWA is a comprehensive PHP/MySQL web application that offers a valuable platform for security professionals, developers, and students to enhance their web application security skills. By intentionally incorporating vulnerabilities, DVWA enables users to gain hands-on experience and understanding of common web vulnerabilities. Its extensive features and user-friendly interface make it a trusted tool for effective web security testing and training.

DVWA Attacks:

  • list :
    • Command Injection
    • Brute-force
    • CSRF
    • File Inclusion
    • File Upload
    • Insecure CAPTCHA
    • SQL Injection / SQL Injection (Blind)
    • Weak Session IDs
    • XSS (DOM)
    • XSS (Reflected)
    • XSS (Stored)
    • CSP Bypass

Key Features of DVWA

  1. Vulnerability Types: DVWA is designed to include a wide range of vulnerabilities commonly found in web applications. Here are some of the main ones:
    • SQL Injection: This vulnerability occurs when an attacker is able to manipulate a SQL query by injecting arbitrary SQL code. DVWA provides various examples, allowing users to practice exploiting SQL injection flaws and understand how to prevent them.
    • Cross-Site Scripting (XSS): XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users. DVWA offers different scenarios for both reflected and stored XSS, enabling users to learn how these attacks work and how to mitigate them.
    • Command Injection: This vulnerability allows an attacker to execute arbitrary commands on the host operating system through a vulnerable application. DVWA includes examples that demonstrate how command injection can be exploited and emphasizes the importance of input validation.
    • File Inclusion: DVWA features local and remote file inclusion vulnerabilities. These allow attackers to include files on a web server, potentially leading to the execution of malicious code. Users can learn how these inclusions can be exploited and secured against.
    • Cross-Site Request Forgery (CSRF): CSRF vulnerabilities allow attackers to trick users into executing unwanted actions on a web application where they are authenticated. DVWA provides examples of how CSRF can be exploited and how to implement protections against it.
    • Insecure File Upload: This vulnerability occurs when an application does not properly validate file uploads, allowing attackers to upload malicious files. DVWA demonstrates how to exploit insecure file uploads and how to implement file validation.
  2. Security Levels: DVWA features four different security levels, which allows users to experience vulnerabilities at varying levels of difficulty and security measures:
    • Low: This setting offers the least amount of security. All vulnerabilities are easily exploitable, making it ideal for beginners to get started with exploitation techniques.
    • Medium: At this level, some security measures are in place, such as basic input validation and sanitization. This setting challenges users to find vulnerabilities while dealing with some protection mechanisms.
    • High: In this mode, more advanced security measures are implemented, making vulnerabilities harder to exploit. Users must employ more sophisticated techniques to succeed.
    • Impossible: This level aims to provide a challenging environment where vulnerabilities cannot be exploited. It’s useful for testing advanced skills and understanding defense mechanisms.
  3. Learning Tool: DVWA is not just a collection of vulnerabilities; it’s a comprehensive learning platform. Users can gain hands-on experience in identifying, exploiting, and understanding various web application vulnerabilities. It serves as a practical resource for:
    • Security Training: Ideal for students and professionals seeking to enhance their skills in web application security.
    • Penetration Testing Practice: Allows pentesters to practice their skills in a safe environment before applying them to real-world applications.
    • Development Awareness: Developers can use DVWA to understand security flaws and learn how to write more secure code.
  4. Detailed Documentation: DVWA comes with extensive documentation that guides users through the setup process, usage, and explanations of various vulnerabilities. This documentation is helpful for both newcomers and experienced users looking to deepen their understanding of web security.
  5. Community Support: DVWA has an active community of users and contributors. Users can share their experiences, report issues, and suggest improvements. This community aspect fosters continuous learning and development in the field of web application security.
  6. Customizability: Advanced users can modify DVWA to include additional vulnerabilities or customize existing ones. This flexibility allows for tailored learning experiences and the ability to explore new attack vectors.

Setting Up DVWA on Metasploitable 2

Prerequisites

Before you start, ensure you have:

  • Metasploitable 2: Installed on a virtual machine (VM) or physical hardware. It’s typically a Linux-based distribution that is purposely vulnerable.
  • Network Configuration: Ensure that your Metasploitable 2 VM is networked properly so you can access it from your host machine.

Installation Steps

  1. Install the dependencies (only Debian-based):
    • $ sudo apt install apache2 mysql-server php php-mysqli php-gd libapache2-mod-php
  2. Clone the DVWA repo:
    • $ git clone https://github.com/ethicalhack3r/DVWA
  3. Or download the source:
    • $ cd /var/www/html
    • $ wget https://github.com/ethicalhack3r/DVWA/archive/v1.9.zip && unzip v1.9.zip
    • $ mv DVWA-1.9 /var/www/html/dvwa
  4. If everything goes well, create the database with name DVWA. The next step is to configure config.inc.php file located at /config/config.inc.php. Modify the database credentials within the config.inc.php file. Default variables:
  5. There is one more, you’ll need to provide reCAPTCHA keys in the config.inc.php file (Click on the “documentation” button below for more details). Don’t forget to restart server and MySQL.
  6. Now browse to the DVWA directory to complete the setup (http://IP_address/DVWA) and click Create / Reset

If the DB is created successfully, you’ll be redirected to the login screen
(http://IP_address/DVWA/login.php). To login use the default credentials:

  • Default username = admin
  • Default password = password

That’s it! Now you can play around and test your skills.

Why Use DVWA?

  • Hands-On Experience: DVWA provides an environment to learn how these attacks work and how to defend against them in real-world scenarios.
  • Educational Purpose: Security students and professionals use DVWA for training on ethical hacking, vulnerability analysis, and penetration testing.
  • Testing Tools: It’s also a platform for testing automated vulnerability scanners or web application firewalls to evaluate their effectiveness.

Conclusion

You should now have DVWA set up and running on Metasploitable 2. This environment allows you to practice exploiting various vulnerabilities in a safe setting. Make sure to explore different security levels within DVWA to enhance your learning experience.

MORE

Related Posts