Learning Web Pentesting With DVWA Part 1: Installation

In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa

It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:

login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.

Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.

Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:

From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.

Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.

We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

Read more

1. Usb Pentest Tools
2. Hack Tools For Pc
3. Hacking Tools 2020
4. Hackers Toolbox
5. Hack Tools 2019
6. Pentest Tools Tcp Port Scanner
7. Hacker Tools Github
8. Hacking Tools Windows 10
9. Hack Tools For Ubuntu
10. Hacker Tools 2020
11. Hack Tools
12. Hacker Tools Free
13. Pentest Tools Free
14. Hack Apps
15. Hacking Tools Software
16. What Are Hacking Tools
17. Pentest Tools Tcp Port Scanner
18. Hacking Tools For Games
19. Pentest Tools Framework
20. Usb Pentest Tools
21. Underground Hacker Sites
22. Pentest Automation Tools
23. Hacker Tools Software
24. Pentest Reporting Tools
25. Hacking Tools Name
26. Hacker Tools 2019
27. Blackhat Hacker Tools
28. Hacking App
29. Hacking Tools For Pc
30. Hack Tools For Games
31. Hack Tools Mac
32. Hack Tool Apk No Root
33. Install Pentest Tools Ubuntu
34. Hack Tools For Games
35. Pentest Tools Linux
36. Hacking Tools Name
37. Hack Tools Mac
38. Hacking Tools For Games
39. Hacking Tools For Windows
40. Hacking Tools 2019
41. Pentest Tools Android
42. Hacker Tools Free
43. Hacking Tools 2020
44. Pentest Tools Review
45. Hacker Tool Kit
46. Hacker Search Tools
47. Hacking Tools For Windows
48. Pentest Tools Subdomain
49. Hacker Tools
50. Pentest Tools Port Scanner
51. Hacks And Tools
52. Pentest Tools Github
53. Hack Tools For Mac
54. Pentest Tools For Ubuntu
55. Github Hacking Tools
56. Hack Tools For Games
57. Pentest Tools Subdomain
58. Hackers Toolbox
59. Hacking Tools
60. Hacking Apps
61. Physical Pentest Tools
62. Pentest Tools For Windows
63. Github Hacking Tools
64. Pentest Tools Framework
65. Hacking Tools For Mac
66. Hacker Tools Online
67. Pentest Tools For Mac
68. Beginner Hacker Tools
69. Hacker Tools Online
70. Tools Used For Hacking
71. Hacking Tools Mac
72. Hackers Toolbox
73. Pentest Tools Framework
74. Hacking Tools Usb
75. Pentest Tools Url Fuzzer
76. Hacking Tools For Mac
77. Pentest Tools Port Scanner
78. Hacker Tools Github
79. Ethical Hacker Tools
80. Hacking Apps
81. Hackrf Tools
82. Pentest Tools List
83. Hacking App
84. Tools Used For Hacking
85. How To Hack
86. Hacker Tools Online
87. Easy Hack Tools
88. Hack Tool Apk
89. Pentest Tools For Mac
90. Hacker Tools Mac
91. Hacking App
92. Hacking Tools Download
93. Pentest Tools Apk
94. Hack Tools Download
95. Pentest Tools For Ubuntu
96. Physical Pentest Tools
97. How To Hack
98. Pentest Tools Review
99. Game Hacking
100. Hacking Tools
101. Pentest Tools Framework
102. Hak5 Tools
103. Pentest Tools Open Source
104. Nsa Hack Tools
105. Best Hacking Tools 2019