Learning Web Pentesting With DVWA Part 1: Installation

In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa

It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:

login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.

Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.

Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:

From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.

Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.

We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

Related news

1. Bluetooth Hacking Tools Kali
2. New Hacker Tools
3. Hacking Tools For Pc
4. Hacker Security Tools
5. Hack Tools For Ubuntu
6. Hacking Tools Mac
7. Hacking Tools Pc
8. What Are Hacking Tools
9. Hacker Tools Windows
10. Hacker Tools Github
11. Hacker Tools List
12. Hacker Tools For Ios
13. Pentest Tools Website
14. New Hack Tools
15. Pentest Tools
16. Hacker Tools List
17. How To Hack
18. Hack Tools For Games
19. Beginner Hacker Tools
20. Hacking Tools Online
21. Hack Tools Pc
22. Termux Hacking Tools 2019
23. Hacking Tools Windows 10
24. Hacking Tools For Windows Free Download
25. Growth Hacker Tools
26. Hacker Tools Software
27. Pentest Tools Tcp Port Scanner
28. How To Install Pentest Tools In Ubuntu
29. Hacker Tool Kit
30. Pentest Tools Linux
31. Computer Hacker
32. Growth Hacker Tools
33. Nsa Hacker Tools
34. Install Pentest Tools Ubuntu
35. Computer Hacker
36. Pentest Tools Tcp Port Scanner
37. Hacking Tools 2020
38. Tools Used For Hacking
39. Hacking Tools 2019
40. Android Hack Tools Github
41. Hacker Hardware Tools
42. Hacker Search Tools
43. Pentest Tools Alternative
44. Underground Hacker Sites
45. Hacker Tools Hardware
46. Nsa Hack Tools
47. Pentest Tools Nmap
48. Hack Tools Github
49. Pentest Reporting Tools
50. Pentest Tools Open Source
51. Pentest Tools Nmap
52. Termux Hacking Tools 2019
53. Pentest Tools For Ubuntu
54. Pentest Recon Tools
55. Hacker Tools Free
56. Pentest Tools Website
57. Pentest Tools For Android
58. Hacking Tools For Beginners
59. Hacker Security Tools
60. Tools For Hacker
61. Hacking Tools Hardware
62. Hacking Tools Windows 10
63. Pentest Tools Port Scanner
64. Tools For Hacker
65. Hacker Tools Windows
66. Hacker Tools For Mac
67. Pentest Tools Apk
68. Hacking Tools Kit
69. Hacker Security Tools
70. World No 1 Hacker Software
71. Pentest Tools
72. Easy Hack Tools
73. Hacking Tools 2020
74. Hacking App
75. Hacker Tools Windows
76. Hacking Tools Windows
77. Hacking Tools Kit
78. Hackers Toolbox