Learning Web Pentesting With DVWA Part 1: Installation

In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa

It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:

login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.

Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.

Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:

From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.

Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.

We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

Related posts

1. Hacker Tool Kit
2. Pentest Recon Tools
3. How To Make Hacking Tools
4. Top Pentest Tools
5. Hack Tools For Mac
6. Pentest Tools For Windows
7. Pentest Tools Port Scanner
8. Hackers Toolbox
9. Hacker Tools Free
10. Hack Tools Online
11. Hacking Tools Download
12. Hacking Tools Windows
13. Hacker Tools List
14. Pentest Tools Subdomain
15. Hacker Tools Apk
16. Hack Tools For Windows
17. Hackrf Tools
18. Github Hacking Tools
19. Hacking Tools For Kali Linux
20. Best Hacking Tools 2020
21. Install Pentest Tools Ubuntu
22. Hacker Tools 2019
23. Hack Rom Tools
24. Pentest Tools Linux
25. Nsa Hacker Tools
26. Game Hacking
27. Hacking Tools 2019
28. Hack Tools For Pc
29. Pentest Box Tools Download
30. Hacking Apps
31. Hacking Tools For Kali Linux
32. Free Pentest Tools For Windows
33. Free Pentest Tools For Windows
34. Install Pentest Tools Ubuntu
35. Github Hacking Tools
36. Pentest Tools Nmap
37. Hacker Tools For Windows
38. Hacker Tools List
39. Hackrf Tools
40. Hacking Tools Software
41. Hack Tools For Pc
42. Hacking Tools For Pc
43. Bluetooth Hacking Tools Kali
44. Pentest Recon Tools
45. Pentest Tools
46. Hack Tools For Mac
47. Pentest Reporting Tools
48. Hacker Tools For Ios
49. Termux Hacking Tools 2019
50. Pentest Tools Kali Linux
51. Pentest Tools Nmap
52. Hackers Toolbox
53. Nsa Hack Tools
54. Pentest Tools Bluekeep
55. Hackers Toolbox
56. Hacking Tools 2019
57. Tools 4 Hack
58. Nsa Hack Tools
59. Hacking Tools Pc
60. Hacker Tools List
61. Hacker Tools For Windows
62. Hacking Tools Kit
63. Pentest Tools Open Source
64. Hack Tools For Games
65. Pentest Reporting Tools
66. Pentest Tools Windows
67. Nsa Hack Tools
68. Top Pentest Tools
69. New Hack Tools
70. Hacking Tools For Beginners
71. Hacking Tools Free Download
72. Hacking Tools Usb
73. Hacker Tools Free
74. Best Hacking Tools 2020
75. Hacking Tools Usb
76. Hacker Tools For Pc
77. Tools 4 Hack
78. Pentest Tools Framework
79. Ethical Hacker Tools
80. Hacker Tools Apk Download
81. Nsa Hacker Tools
82. Top Pentest Tools
83. Hacker Tools Software
84. Hacker Tools Software
85. How To Install Pentest Tools In Ubuntu
86. Hack Tools For Mac
87. Hacking Tools For Beginners
88. New Hack Tools
89. Pentest Tools Website
90. Pentest Tools Find Subdomains
91. Hacking Tools Pc
92. Hacking Tools For Beginners
93. Hacking Tools For Games
94. Hacking Tools Mac
95. Hacker
96. Easy Hack Tools
97. Pentest Tools For Windows
98. Hacking Tools Pc
99. Hacking Tools Kit
100. Hacker Tools Free
101. Hacker Tools Github
102. Hacker Tools For Mac