Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dvwa]

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/...

-1
votes
2answers
52 views

HIGH LEVEL CSRF

I have been doing a bit of dvwa(damn vulnerable web application) and I have a question on CSRF. There is an additional parameter, a csrf token, which is submitted in the get request. All the answers ...
0
votes
1answer
145 views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
0
votes
0answers
54 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
1
vote
2answers
287 views

DVWA: “Hacking attempt detected…”

Hello and good evening, i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the ...
1
vote
1answer
191 views

Is it safe to install Xampp to learn Security and Penetration testing using DVWA? [duplicate]

I have heard Xampp is not safe and has a lot of security loopholes. What steps need to be taken to close the loopholes? Is it better if I use a VM instead? I new to Security Testing and want to learn ...
0
votes
0answers
300 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
0
votes
1answer
519 views

How to make Sqlmap obtain administrator rights for database?

How to make sqlmap obtain administrator rights for database? I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command ...
1
vote
1answer
203 views

Deliberately vulnerable Flash applications?

I'm trying to find some deliberately vulnerable Flash applications that I can practice security testing on (in the same vein as applications like the Damn Vulnerable applications). Ive noticed there ...
-4
votes
1answer
654 views

Hydra brute-force not working [closed]

This is the command I am using and when I press Enter : hydra -L username.txt -P passwords.txt localhost http-post-form "dvwa/login.php:username=^USER^&password=^PASS^&Login="Login Failed" > ...
0
votes
0answers
108 views

DVWA setup on XAMPP writable folder and writable file problem

I am using Kali Linux in the VMware Workstation environment. I set up XAMPP successfully but I am running into the problem that is shown below. How do I fix the problem? I have gone directly to the ...
3
votes
0answers
346 views

Hydra does not display the right answer in DVWA

I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax? Query is: ...
1
vote
2answers
566 views

DVWA - Odd command injection behaviour (High)

After completing the OS Command Injection level on High, I was delving a little deeper so I could write it up. It seems that while the solution works on the web app the same command errors on the ...
2
votes
3answers
1k views

How to make a victim submit a post via XSS?

In DVWA I'm trying to understand different methods of attack than the usual alert('XSS'); scenario. I am using reflective XSS to deliver a payload which then makes the user who follows the URL submit ...
0
votes
0answers
247 views

DVWA bruteforce cookie set to impossible

I can't figure out how to set up security to other than impossible on bruteforce lesson in DVWA. It's set on low on every other. I think there's a problem with a cookie.
0
votes
2answers
3k views

DVWA Command Execution High [duplicate]

Has someone done this level? I get that i'm supposed to bypass the trim function, but i don't see how could this be done if every relevant character has been blacklisted except for the redirection (>)....
0
votes
0answers
643 views

OWASP-ZAP and DVWA Login

I need to do a pentest of the DVWA application. To do that, I chose the OWASP-ZAP tool. I followed all the steps of this tutorial. But when I try to run the "spider" the program doesn't find all the ...
1
vote
0answers
320 views

dvwa is prompting me to check config file when trying to create database

I believe I have made the proper changes to the xampp/htdocs/DVWA-1.9/config/config.inc.php file and the xampp/passwords.txt file. The passwords match, security is low, port is changed (not sure if I ...
3
votes
1answer
1k views

Why is this SQL Injection attempt failing on DVWA?

I'm practicing SQL injection on DVWA (non-blind) with the lowest security settings. I want to list the tables in the current database. To do that, I attempt to enter 0'; show tables;-- in the User ID ...
5
votes
1answer
4k views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
2
votes
0answers
54 views

Navigating SQL Injection Safeguards [duplicate]

I'm trying to get around the DVWA high security SQL injection challenge, I've tried a bunch of automated scanning tools with no luck, read a bunch of articles saying it's impossible now i've turned to ...
2
votes
1answer
3k views

Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?

$query = " $sql = select * from users where id = '$id' " Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.
0
votes
1answer
3k views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
17
votes
4answers
14k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
0
votes
2answers
6k views

Issues setting up DVWA for SQLMAP [closed]

I am starting on sqlmap, and have dvwa for practicing web app penetration. I am having the error "Could not connect to the database - please check the config file." Not sure what the problem is but ...
7
votes
2answers
12k views

Why some sites are not shown when embedding them in an iframe?

Exploiting the DVWA's stored XSS option, I'm using the following payload: <iframe src="url">. I'd like to know why do some sites work but others don't when using this payload. For example: <...