Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
Now, I will try to exploin how to exploit for each vulnerabilities.
1. BruteForce
1. BruteForce
Tools :
- IceWeasel Browser
- BurpSuite
Step :
- Setting proxy on browser to grab cookies on BurpSuite.
- Send captured data to Intruder. (right click on captured data >> Send to Intruder)
- Go to Intruder and select Positions, change the sniper to Cluster bomb.
- Set Payload 1 to username which is we want to attack.
- Set Payload 2 to our password lists.
- Select Intruder on the top menu and choose Start Attack.
Brute force will success depend on how good is our wordlists. I say this is DONE!!
Lets go to the next task.
2. Command Execution.
I put google.com to the input and get this result.
input : google.com
from the result above we can see that the result from ping will be printed on the page. lets try to add another command berhind the google.com.
input : google.com; ls
it gave me nothing. lets try something else.
input : google.com | ls
Bypassed.. Next task....
3. Cross Site Request Forgery
First, I'll try to change the password into admin1.
Its not a POST request. Its a GET request which is mean we can use iframe and send to the admin to visit our iframe with defined password to change the password.
Case closed. Next...
4. Local File Inclusion
Lets change the path into /etc/passwd
passwd printed into web page. Next...
5. SQL Injection
I put ' and i got this error :
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1
Now i'll try to grab the dbname, version and userdb.
Got this error :
Unknown column '3' in 'order clause'
Thats mean it has no more than 3 column.
Lets start grabbing database info.
Yes we got the database info.
Now we try to extracting the data using SQLMAP using our login cookies.
Command : sqlmap -u 'http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit' --cookie='security=medium; PHPSESSID=at4ddi40169u5p1migj2nm6193' --dbs
Command : sqlmap -u 'http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit' --cookie='security=medium; PHPSESSID=at4ddi40169u5p1migj2nm6193' -D dvwa --tables
Command : sqlmap -u 'http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit' --cookie='security=medium; PHPSESSID=at4ddi40169u5p1migj2nm6193' -D dvwa -T users --columns
Command : sqlmap -u 'http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit' --cookie='security=medium; PHPSESSID=at4ddi40169u5p1migj2nm6193' -D dvwa -T users -C username,password --dump
Task completed. Next...
6. SQL Injection (Blind)
SQLi Blind has same technique, but the page wont give us any error reporting. So, lets start to attack it rather than to test it.
Nothing.. Lets try to add the number.
Yes, we got the vulnerability sign. We can use the manual technique or SQLmap. Task completed.
7. Bypass Upload Filter.
Lets try to upload the php shell.
Its failed. I want to change the mime type while its in upload process using Tamper Data (Mozilla Addons).
And its uploaded.
Check the file..
Tast completed.. Next..
8. XSS Reflected
Lets try to put a text into the input form.
input : is2c
yes, its printed.. now lets try Javascript.
input : <script>alert('XSS IS2C')</script>
from the result above, we can see that the word <script> and </script> is removed. lets try to bypass it by using caps button. XD
input : <SCRIPT>alert('XSS IS2C')</SCRIPT>
Done.. Next..
9. XSS Stored
This vulnerability make the page storing our input text into the page. Lets begin using CAPS..
input : <IFRAME=SRC='http://google.com'>
Not worked.. lets try the others..
input : <SCRIPT>alert('XSS STORED IS2C')</SCRIPT>
Not worked.. agaaaiiinnn.. but we try the name input.
input : <SCRIPT>alert("XSS STORED IS2C")</SCRIPT> when i enter it, it wont allow me to put more than 10 character. Now i'll try to bypass it using Tamper Data, again....
PS : For high level, you can attack using the same way, but you have to change the cookie when tampering the data. change the high into medium or low. :)
--= Mission Completed =--
