Damn Vulnerable Web App – Learn & Practise Web Hacking

The New Acunetix V12 Engine


Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be light weight, easy to use and full of vulnerabilities to exploit. Used to learn or teach the art of web application security.

Vulnerabilities

  • SQL Injection
  • XSS (Cross Site Scripting)
  • LFI (Local File Inclusion)
  • RFI (Remote File Inclusion)
  • Command Execution
  • Upload Script
  • Login Brute Force

Changes


  • Added Acunetix scan report.
  • All links use http://hiderefer.com to hide referrer header.
  • Updated/added ‘more info’ links.
  • Moved change log info to CHANGELOG.txt.
  • Fixed the exec.php UTF-8 output.
  • Moved Help/View source buttons to footer.
  • Fixed phpInfo bug.
  • Made DVWA IE friendly.
  • Fixed html bugs.
  • Improved README.txt and fixed typos.
  • Made SQL injection possible in sqli_med.php.

WARNING

It should come as no shock..but this application is damn vulnerable! Do not upload it to your hosting provider’s public html folder or any working web server as it will be hacked. It’s recommend that you download and install XAMP onto a local machine inside your LAN which is used solely for testing.

You can download DVWA 1.0.4 here:

dvwa_v1.0.4.zip

Or read more here.

Posted in: Exploits/Vulnerabilities, Secure Coding, Web Hacking

, , , , , , , , , ,


Latest Posts:


Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.


8 Responses to Damn Vulnerable Web App – Learn & Practise Web Hacking

  1. Superman July 15, 2009 at 12:07 pm #

    lol… It’s vulnerable for expert like you but not beginners like me :p

  2. Jeff Price July 16, 2009 at 7:32 pm #

    Lol, those are all very old exploits,
    brute force, since computers came out
    command execution, who doesn’t know to use ; then command
    file inclusion, does anyone really use this? Page=/etc/passwd comeon now

    sql injection- old hat, only caused by programmers who don’t know what they are doing. They have a whole escaping system just for sanitizing inputs.

    upload- yeah upload your own shell to run remote commands, i think

    would work just fine

    xss – inject code into the page, what is your name? bob<javascript blah blah blah send cookie to website blah blah blah

    can be done with javascript: from address bar by rewritting variables.

    lets see stuff mroe like buffer overflows, snmp traps, hping, nmap. Not more or less script kiddy stuff.

    Lets see gdb

  3. Jeff Price July 16, 2009 at 7:34 pm #

    :( it striped out the php code i placed between i think and would work just fine, if you need it email me at staxjp\ \[ @ \] gmail.com

  4. ethicalhack3r July 17, 2009 at 4:38 pm #

    @Jeff Price

    “Lol, those are all very old exploits,
    brute force, since computers came out
    command execution, who doesn

  5. Jeff Price July 17, 2009 at 4:50 pm #

    @Ryan, the first post I put I has put an example php shell, simple just using get [ ‘cmd’ ] and then using the system command, used for the file upload section so site would be host/uploaded/cmd.php?cmd=ls

    Now that I read back on it I sounded mean. I acctually wish I had something like this when I started out. Good Job. I will give a new version a try.

    Buffer overflows, now just for web services, rpc services, smtp, and yes apache still has the occasional buffer overflow in the server itself.

    It is still surprising how many sql injections there still are. new releases of php stop them be default without using the escaping function.

    If anything, it opens peoples eyes alittle more to what vulnerabilities really are.

  6. rio August 14, 2009 at 2:35 am #

    @jeffprice…,

    read the the goddamn name… it’s written “DAMN” vuln… off course it’s really vuln… if you know something about nmap, buffer overflow, bla..bla… then why you don’t write your godDAMN own… :)

    It seem you are kiddie that act like an expert… haha… sorry

  7. ethicalhack3r September 1, 2009 at 11:40 pm #

    Just a quick update to let everyone know that DVWA has a new home and that we will be releasing the new shiny version (1.0.5) soon!

    http://www.dvwa.co.uk/

  8. HackTalk September 2, 2009 at 1:29 pm #

    @Jeff dude saying that LFI isn’t a valid method for web app hacking shows your ignorance. LFI can be used to poison Apache logs and allow the hacker RCE. As for putting BoFs in web apps, it really is quite impossible. If you want to hack the backend though, please, go ahead and enlighten us with your skills by finding the Apache 0day or the litespeed http 0day