Learning Web Pentesting With DVWA Part 1: Installation

In this tutorial series I'm going to walk you through the damn vulnerable web application (DVWA) which is damn vulnerable. Its main goal according to the creators is "to aid security professionals to test thier skills and tools in a legal environment, help web developers better understand the process of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment."

I am going to install DVWA in docker so the prerequisite for this tutorial will be an installation of docker (Docker is not the only way to install DVWA but if you have docker already installed then it may be the easiest way to install DVWA).

To install DVWA in docker run your docker deamon if it's not running already and open a terminal or powershell and type:

docker rum --rm -it -p 8080:80 vulnerables/web-dvwa

It will take some time to pull the image from docker hub depending on your internet speed and after it is complete it will start the dvwa application. In the command we have mapped the image instance's port 80 to our hosts port 8080 so we should be able to access the web application from our host at http://localhost:8080

Now open your favorite web browser and go to http://localhost:8080
You should be prompted with a login screen like this:

login with these creds:
username: admin
password: password

After login you'll see a database setup page since this is our first run. Click on Create / Reset Database button at the bottom. It will setup database and redirect you to login page. Now login again and you'll see a welcome page.

Now click on DVWA Security link at the bottom of the page navigation and make sure the security level is set to Low. If it is not click on the dropdown, select Low and then click submit.

Now our setup is complete, so lets try a simple SQL attack to get a taste of whats about to come.

Click on SQL Injection in navigation menu.
You'll be presented with a small form which accepts User ID.
Enter a single quote (') in the User ID input field and click Submit.
You'll see an SQL error like this:

From the error message we can determine that the server has a MariaDB database and we can see the point of injection.
Since there are many quotes we are not able to determine the exact location of our injection. Lets add some text after our single quote to see exactly where our injection point is.
Now I am going to enter 'khan in the User ID field and click Submit.

Now we can see exactly where the point of injection is. Determining the point of injection is very important for a successful SQL injection and is sometimes very hard too, though it might not be that much useful here in this exercise.

Now lets try the very basic SQL Injection attack.
In the User ID field enter ' or 1=1-- - and click Submit.

We will explain what is going on here in the next article.


References:-
1. DVWA Official Website: http://www.dvwa.co.uk/

More information

1. Hacker Tools
2. Pentest Box Tools Download
3. Best Hacking Tools 2020
4. Bluetooth Hacking Tools Kali
5. Hacker
6. Hack Tools For Ubuntu
7. Hack Tools For Pc
8. Pentest Recon Tools
9. Pentest Tools Url Fuzzer
10. Pentest Tools List
11. Hack Tools
12. Hacking Tools For Games
13. Pentest Tools Find Subdomains
14. Pentest Tools Url Fuzzer
15. What Is Hacking Tools
16. Hacker Tools
17. Pentest Tools Free
18. Hacker Tools List
19. Pentest Tools For Ubuntu
20. Hacking Apps
21. Underground Hacker Sites
22. Nsa Hacker Tools
23. Pentest Tools Alternative
24. Hacking Tools
25. Hack And Tools
26. Hacking App
27. Game Hacking
28. Hacking Tools For Kali Linux
29. Ethical Hacker Tools
30. Hacker Tools Hardware
31. Wifi Hacker Tools For Windows
32. Hacking App
33. Hacking Tools Download
34. Hacking Tools Mac
35. Hack Tools Mac
36. Hacking Tools Software
37. Hacker Tools 2020
38. Pentest Tools Find Subdomains
39. Easy Hack Tools
40. Hacks And Tools
41. Nsa Hack Tools
42. New Hack Tools
43. Hacking Tools Github
44. Underground Hacker Sites
45. How To Hack
46. Beginner Hacker Tools
47. Hacker Tools Mac
48. Pentest Tools Windows
49. Hack Tools For Windows
50. Pentest Tools Website Vulnerability
51. Hacking Tools And Software
52. Hacker Tools Apk Download
53. Wifi Hacker Tools For Windows
54. Hacker Tools 2019
55. What Is Hacking Tools
56. Termux Hacking Tools 2019
57. Bluetooth Hacking Tools Kali
58. Hack Website Online Tool
59. Pentest Tools Apk
60. Hacking Tools Hardware
61. Hack Tools 2019
62. Hacker Hardware Tools
63. Pentest Tools Framework
64. Hacking Apps
65. Blackhat Hacker Tools
66. Hacking Tools Pc
67. Hacker Tools 2019
68. Pentest Tools Free
69. Pentest Tools Windows
70. Hacker Security Tools
71. Hacker Tools
72. Tools Used For Hacking
73. Hacking Tools Github
74. Best Hacking Tools 2020
75. Pentest Tools Linux
76. Pentest Tools
77. Hacker Tools Apk
78. Hacker Tools Windows
79. Hacker Tools For Windows
80. Hacking Tools Hardware
81. Hacking Tools For Windows
82. Hacker Tools 2019
83. Pentest Tools Windows
84. Game Hacking
85. Hacking Tools For Pc
86. Physical Pentest Tools
87. Pentest Tools Bluekeep
88. Best Hacking Tools 2019
89. Hacker Tools Windows
90. Hacker Hardware Tools
91. Hacker Tools Online
92. Pentest Tools Nmap
93. Pentest Tools List
94. Pentest Tools Online
95. Hacking Tools Free Download
96. Hacker Tools For Pc
97. Hack Tools For Games
98. New Hacker Tools
99. Hacker Tools 2020
100. Hacking Tools And Software
101. Hacking Tools Online
102. Pentest Tools Website
103. Nsa Hacker Tools
104. Hacking Tools Pc
105. Hacking Tools For Games
106. Pentest Tools Open Source
107. Pentest Tools Review
108. Pentest Reporting Tools
109. Hacker Tools Software
110. Hack Tools Online
111. Hacking App
112. Hacker Search Tools