http://www.dvwa.co.uk/

read the the goddamn name… it’s written “DAMN” vuln… off course it’s really vuln… if you know something about nmap, buffer overflow, bla..bla… then why you don’t write your godDAMN own…

It seem you are kiddie that act like an expert… haha… sorry

Now that I read back on it I sounded mean. I acctually wish I had something like this when I started out. Good Job. I will give a new version a try.

Buffer overflows, now just for web services, rpc services, smtp, and yes apache still has the occasional buffer overflow in the server itself.

It is still surprising how many sql injections there still are. new releases of php stop them be default without using the escaping function.

If anything, it opens peoples eyes alittle more to what vulnerabilities really are.

“Lol, those are all very old exploits,
brute force, since computers came out
command execution, who doesn’t know to use ; then command
file inclusion, does anyone really use this? Page=/etc/passwd comeon now”

Please keep in mind that dvwa is for teaching/learning.

“sql injection- old hat, only caused by programmers who don’t know what they are doing. They have a whole escaping system just for sanitizing inputs.”

SQL Injection is still a very real problem on the internet today, with most if not all of the big names being one time or another vulnerable. i.e. microsoft.com, nasa.com, ebay.com, etc…

It could be compared to buffer overflows. Buffer overflows have been around for many many years however they still exist and are still a major problem for big companies. i.e. MS, GNU Linux, Mozilla, etc…

“lets see stuff mroe like buffer overflows, snmp traps, hping, nmap. Not more or less script kiddy stuff.”

Implementing buffer overflows into the web application would be difficult as Apache and most other web servers already restrict the buffers on all inputs by default.

“it striped out the php code i placed between i think and would work just fine, if you need it email me at staxjp\ \[ @ \] gmail.com”

Could you clarify this?

Thanks to everyone for their interest. If you would like to try the next version before it has been released: https://dvwa.svn.sourceforge.net/svnroot/dvwa

Ryan

sql injection- old hat, only caused by programmers who don’t know what they are doing. They have a whole escaping system just for sanitizing inputs.

upload- yeah upload your own shell to run remote commands, i think

would work just fine

xss – inject code into the page, what is your name? bob<javascript blah blah blah send cookie to website blah blah blah

can be done with javascript: from address bar by rewritting variables.

lets see stuff mroe like buffer overflows, snmp traps, hping, nmap. Not more or less script kiddy stuff.

Lets see gdb