Pages

Subscribe:

Friday, 19 January 2024

Learning Web Pentesting With DVWA Part 1: Installation



In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa




It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:



login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.



Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.




Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:



From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.



Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.



We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/
Related posts
  1. Pentest Tools Kali Linux
  2. Hacker
  3. Pentest Tools Port Scanner
  4. Best Pentesting Tools 2018
  5. Hacker Tools Github
  6. Pentest Recon Tools
  7. Pentest Tools Apk
  8. Hacker Tools Free
  9. Github Hacking Tools
  10. Underground Hacker Sites
  11. Hacking Tools Mac
  12. Hacker Tools Mac
  13. What Is Hacking Tools
  14. Hack Tools Pc
  15. Hacker Tools 2020
  16. Termux Hacking Tools 2019
  17. Hack Website Online Tool
  18. Pentest Tools Kali Linux
  19. Best Hacking Tools 2020
  20. Pentest Tools For Android
  21. Hacking Tools For Mac
  22. Hack Tools For Pc
  23. Hack Tools 2019
  24. Pentest Tools Nmap
  25. Hacker Tools For Ios
  26. Hack Tools For Games
  27. Hacker Tools Github
  28. Pentest Automation Tools
  29. Hack Tools For Games
  30. Nsa Hacker Tools
  31. Hacker Tools For Pc
  32. Hacking Tools Name
  33. Pentest Reporting Tools
  34. Hacker Tools Hardware
  35. Github Hacking Tools
  36. Hacker Tools List
  37. Hack And Tools
  38. Hacker Tool Kit
  39. Pentest Tools Bluekeep
  40. Pentest Tools For Windows
  41. Free Pentest Tools For Windows
  42. Pentest Tools For Ubuntu
  43. Hack Tools For Ubuntu
  44. Hacker Techniques Tools And Incident Handling
  45. Kik Hack Tools
  46. Top Pentest Tools
  47. Nsa Hacker Tools
  48. Hacker Tools Apk
  49. Pentest Tools Linux
  50. Hacker Tools For Mac
  51. Hacker Tools Apk Download
  52. Hacks And Tools
  53. Hacking Tools For Windows 7
  54. Pentest Tools Nmap
  55. Hack App
  56. Free Pentest Tools For Windows
  57. Hacker Tools 2020
  58. Pentest Tools Online
  59. Best Pentesting Tools 2018
  60. Pentest Tools Bluekeep
  61. Hacker Tools Software
  62. Hacking Tools Pc
  63. Pentest Tools Review
  64. Pentest Tools For Ubuntu
  65. Hack Apps
  66. Hacker Security Tools
  67. Android Hack Tools Github
  68. Hacker Tool Kit
  69. Pentest Automation Tools
  70. Computer Hacker
  71. Hack Tools Download
  72. Pentest Tools Url Fuzzer
  73. Tools 4 Hack
  74. Pentest Tools Website
  75. Hacker Tools For Ios
  76. Hacker Search Tools
  77. Top Pentest Tools
  78. Hacking App
  79. New Hack Tools
  80. Nsa Hack Tools
  81. Hacking Tools Download
  82. Hacker Tools For Mac
  83. Hacking Tools Software
  84. Pentest Tools Kali Linux
  85. Hackers Toolbox
  86. Computer Hacker
  87. Underground Hacker Sites
  88. Hack Apps
  89. Pentest Tools For Windows
  90. Hacking Tools Download
  91. Hacking Tools Name
  92. Hacker Tools
  93. Kik Hack Tools
  94. Pentest Tools Website
  95. Hacking Tools Windows
  96. Best Hacking Tools 2019
  97. Hacking Tools Online
  98. Hacking Tools Hardware
  99. Pentest Box Tools Download
  100. Tools For Hacker
  101. Hack Tools For Mac
  102. Pentest Tools Framework
  103. Hacker Techniques Tools And Incident Handling
  104. Hacking Tools For Beginners
  105. Top Pentest Tools
  106. Pentest Tools Download
  107. Hacking Tools Online
  108. Hacking Tools Kit
  109. Hack Tool Apk
  110. Tools For Hacker
  111. Tools 4 Hack
  112. Hackers Toolbox
  113. How To Hack
  114. Hacking App
  115. New Hack Tools
  116. Pentest Recon Tools
  117. Pentest Box Tools Download
  118. Pentest Tools Website
  119. How To Install Pentest Tools In Ubuntu
  120. Ethical Hacker Tools

No comments:

Post a Comment