Sara Sartoli
Akbar Siami Namin
NSF-SFS workshop
July 14-18, 2014




How to install and run DVWA
Exploit a some SQL Injection attacks
Upload a malicious file
Exploit an XSS attack


DVWA is a PHP/MySQL web application that is damn
vulnerable to most common web attacks.
The main goals are:
◦ to be an aid for security professionals to test their skills and
tools in a legal environment.
◦ to help web developers better understand the processes of
securing web applications.
◦ To be an for aid teachers/students to teach/learn web
application security in a class room environment.
1.
Install Xampp
1.
Download DVWA and extract that
Copy DVWA folder in web server root
Go to DVWA Directory>>Config>> Open config.inc.php and
change $_DVWA[ 'db_password' ] = 'p@ssw0rd' to $_DVWA[
'db_password' ] = 'p@ssw0rd' to $_DVWA[ 'db_password' ] =''
2.
3.

A SQL injection attack consists of insertion or “injection” of a
SQL query via the input data from the client to the application.

In SQL injection, SQL commands are injected into data-plane
input in order to effect the execution of predefined SQL
commands.

Input data must be validated to ensure that the web application
is operated on clean, correct and useful data .

The query, executed back in the database looks like:
SELECT first_name, Last_Name from users where ID=‘1’;

A solution that would extract all the first name and passwords
from the table is to use following injection string:
SELECT first_name, Last_Name from users where ID=‘1’ or ‘0’=‘0’;
The basic idea is to make the database to respond with error message
containing database type and version.
 Entering a quote make the DB to consider any characters after quote as a
simple string and non sql code and cause syntax error.
 Now we know that the database is MySQL so we can use appropriate
queries to find out the version.
 In MySQL the queries that return the version are:
SELECT version()
SELECT @@version
 Enter the following srings:
1.
‘ union select @@version#
2.
' union select null, @@version #
 The query that would extract DB version is:
SELECT first_name, Last_Name from users where ID=‘ ’union select null,
@@version #’;



In MySQL the queries that retrieve the host_name anddatabase
name are:
SELECT database()
SELECT @@ hostname()
So, What would be the injection string????




Information schema is a database that contains information about
all of databases that the installed MySQL contains.
Enter the following string:
a' UNION select table_schema,table_name FROM
information_Schema.tables;#
Try to find damn vulnerable web app database and its tables.
Now , set DVWA to high security and attack again.

The first step in many attacks is to get some code to
the system to be attacked. Then the attacker only
needs to find a way to get the code executed. Using a
file upload helps the attacker accomplish the first step.
1.
2.
3.
4.
Copy a JPG file and a PNG file to the root.
Choose a PHP file in the root Path and try to upload that.
Try to upload JPG and PNG file as well.
Give it a try with medium and high security.
Note:
 Check the PHP code to figure out What the differences are?

Cross-Site Scripting attacks are a type of injection
problem, in which client-side script is injected into
web pages viewed by other users.
1.
2.
3.
4.
Select “XSS Stored” from the left navigation menu.
Name: Test 1
Message: <script>alert(“my xss attack”)</script>
Sign guestBook
Note:
 This XSS exploit will be displayed for all of users.
1.
2.
3.
4.
5.
Reset the DataBase
Select “XSS Stored” from the left navigation menu.
Input Name: Test 2
Input Message: <iframe src=“http://www.cnn.com”></iframe>
Sign Guest Book
Notes:
 We need to reset the database otherwise the each XSS exploit will
appear for each example.
 This is a powerful exploit because a user could use SET to create
Malicious cloned website and place in here.
1.
2.
3.
4.
5.
Reset the DataBase
Select “XSS Stored” from the left navigation menu.
Input Name: Test 3
Input Message: <script>alert(document.cookie)</script>
Sign Guest Book
Notes:
 It is possible to modify this XSS script to send the cookie to a
remote location instead of displaying it.(man in the middle attack)
 Check the PHP code to figure out What the differences are?
Thank you