Learning Web Pentesting With DVWA Part 1: Installation

In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa

It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:

login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.

Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.

Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:

From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.

Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.

We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

Read more

1. Hacker Tools Free
2. Pentest Tools Online
3. Hacking Tools For Kali Linux
4. Hak5 Tools
5. Hacking Tools For Mac
6. Pentest Automation Tools
7. Pentest Tools For Android
8. Hack Tools For Mac
9. Hacking Tools Usb
10. Hack Tools Pc
11. Hacking Tools Kit
12. Physical Pentest Tools
13. Pentest Tools Bluekeep
14. Install Pentest Tools Ubuntu
15. Hacking Tools Kit
16. Hacking Tools Windows
17. Hacking Tools And Software
18. Hacker Tools Free Download
19. Hacker Tools Apk
20. How To Install Pentest Tools In Ubuntu
21. Hackrf Tools
22. Hack Tools For Mac
23. Hacker Tools Linux
24. Termux Hacking Tools 2019
25. Tools Used For Hacking
26. Pentest Tools Subdomain
27. Ethical Hacker Tools
28. New Hacker Tools
29. Hacking App
30. New Hack Tools
31. Hack App
32. Pentest Reporting Tools
33. Hacking Tools
34. New Hack Tools
35. Hacker Tools For Ios
36. Hacker
37. Nsa Hack Tools Download
38. Beginner Hacker Tools
39. Android Hack Tools Github
40. Hak5 Tools
41. Hacking Tools For Windows Free Download
42. Hacks And Tools
43. Pentest Tools Url Fuzzer
44. Pentest Tools Linux
45. Top Pentest Tools
46. Pentest Automation Tools
47. Pentest Tools Url Fuzzer
48. Install Pentest Tools Ubuntu
49. New Hack Tools
50. Ethical Hacker Tools
51. Hack Tools Mac
52. What Are Hacking Tools
53. Pentest Tools Website Vulnerability
54. Hacking Tools Free Download
55. Hacking Tools For Windows 7
56. Pentest Automation Tools
57. Hacking Tools Pc
58. Hacking Tools And Software
59. Hack Tools Download
60. Pentest Tools For Android
61. Hacker Tools Free Download
62. Best Hacking Tools 2020
63. Pentest Tools For Mac
64. Hacker Tools Hardware
65. Computer Hacker
66. Hacking Tools For Games
67. How To Install Pentest Tools In Ubuntu
68. Hacking Apps
69. Hacking Tools 2020
70. Hack Rom Tools
71. Hacker Tools Linux
72. Hacker Tools 2020
73. Hacking Tools Windows
74. Hacking Tools Kit
75. Hacker Tool Kit
76. Top Pentest Tools
77. Pentest Tools Android
78. Hacking Tools For Games
79. Hacker Tool Kit
80. Pentest Tools Download
81. Kik Hack Tools
82. Hack Tools Download
83. Pentest Tools Kali Linux