viernes, junio 02, 2023

Learning Web Pentesting With DVWA Part 1: Installation



In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa




It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:



login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.



Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.




Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:



From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.



Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.



We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

Related news


  1. Pentest Tools Free
  2. Beginner Hacker Tools
  3. Install Pentest Tools Ubuntu
  4. Tools 4 Hack
  5. Hack Tool Apk
  6. Hacking Tools For Pc
  7. Hack Tools For Windows
  8. Pentest Tools Apk
  9. Beginner Hacker Tools
  10. Termux Hacking Tools 2019
  11. Pentest Automation Tools
  12. Tools 4 Hack
  13. Pentest Tools Android
  14. Hacker Tools Linux
  15. Hacker Tools For Windows
  16. Top Pentest Tools
  17. Hack Apps
  18. Hacking Tools 2019
  19. Pentest Recon Tools
  20. Hacking Tools Windows
  21. Pentest Tools Free
  22. Pentest Tools Windows
  23. Hack App
  24. Pentest Tools Online
  25. Hacker Tools 2020
  26. Blackhat Hacker Tools
  27. Hack Tools For Games
  28. Pentest Tools Port Scanner
  29. Pentest Tools Review
  30. Physical Pentest Tools
  31. Computer Hacker
  32. Hacking Tools For Mac
  33. Hack Tool Apk No Root
  34. Pentest Recon Tools
  35. Hacking Tools Mac
  36. Hacker Tools Mac
  37. Hacking Tools Windows
  38. Usb Pentest Tools
  39. Hacker Tools Free Download
  40. Hacking Tools For Windows Free Download
  41. Tools For Hacker
  42. Pentest Tools Download
  43. Pentest Tools Find Subdomains
  44. Pentest Tools Open Source
  45. Hack Tools For Pc
  46. Pentest Tools Find Subdomains
  47. Pentest Tools Bluekeep
  48. Pentest Tools Apk
  49. Hacking Tools 2020
  50. Pentest Tools Alternative
  51. Hacking Tools For Beginners
  52. Github Hacking Tools
  53. Hacker Techniques Tools And Incident Handling
  54. Pentest Tools Online
  55. Best Hacking Tools 2020
  56. Nsa Hack Tools
  57. Hacking Tools Mac
  58. What Are Hacking Tools
  59. Pentest Tools
  60. Termux Hacking Tools 2019
  61. How To Install Pentest Tools In Ubuntu
  62. Hack Tools Download
  63. Hacker Tools For Windows
  64. Hacking Tools For Windows
  65. Game Hacking
  66. Best Pentesting Tools 2018
  67. Hacker Hardware Tools
  68. Github Hacking Tools
  69. Github Hacking Tools
  70. Hackrf Tools
  71. Best Hacking Tools 2020
  72. Bluetooth Hacking Tools Kali
  73. Physical Pentest Tools
  74. Hacker Tools Mac
  75. Hack Tools For Ubuntu
  76. Best Hacking Tools 2020
  77. Hacker Tools
  78. Hack Tools Pc
  79. Hacker Tool Kit
  80. Pentest Tools Android
  81. Github Hacking Tools
  82. Hacking Tools 2020
  83. Hak5 Tools
  84. Hacker Tools Linux
  85. Hacking Tools For Games
  86. Pentest Tools Find Subdomains
  87. Hacker Tools For Windows
  88. Hacking Tools Windows 10

No hay comentarios: