Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
Questions tagged [dvwa]
40 questions
17
votes
5 answers
Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?
I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA):
![](../../users/profiles/31533.webp)
Guillaume Néry
- 173
- 1
- 1
- 6
6
votes
2 answers
Why some sites are not shown when embedding them in an iframe?
Exploiting the DVWA's stored XSS option, I'm using the following payload:
5
votes
1 answer
DVWA - Command Injection (high level)
I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level
The help states
The developer has either made a slight typo with the filters and believes a certain PHP command will save…
![](../../users/profiles/94955.webp)
Ian
- 153
- 1
- 5
4
votes
1 answer
How to use http-get-form in THC-Hydra?
I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App"
brute force section but the problem is when I use http-get-form it said:
Warning: child 1 seems to have died, restarting (this only happens if a module is bad)
And…
![](../../users/profiles/10151.webp)
AmA
- 41
- 1
- 1
- 2
3
votes
1 answer
Deliberately vulnerable Flash applications?
I'm trying to find some deliberately vulnerable Flash applications that I can practice security testing on (in the same vein as applications like the Damn Vulnerable applications).
Ive noticed there are a lot of resources on the net that show how…
![](../../users/profiles/78535.webp)
Brewer
- 41
- 3
3
votes
0 answers
Hydra does not display the right answer in DVWA
I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax?
Query is:
hydra 127.0.0.1 -l admin -P…
user165319
3
votes
3 answers
How to make a victim submit a post via XSS?
In DVWA I'm trying to understand different methods of attack than the usual alert('XSS'); scenario.
I am using reflective XSS to deliver a payload which then makes the user who follows the URL submit a post in the Stored XSS section on the same web…
![](../../users/profiles/56738.webp)
user1949280
- 61
- 1
- 2
2
votes
0 answers
Navigating SQL Injection Safeguards
I'm trying to get around the DVWA high security SQL injection challenge, I've tried a bunch of automated scanning tools with no luck, read a bunch of articles saying it's impossible now i've turned to the source code:
You can submit a number (id) to…
![](../../users/profiles/43059.webp)
Crizly
- 2,597
- 4
- 18
- 29
2
votes
1 answer
Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?
$query = " $sql = select * from users where id = '$id' "
Won't $id=3' OR '1'='1 break the query ?
The doubt arose because someone claimed it can't be broken.
![](../../users/profiles/18220.webp)
wanttomasterpython
- 47
- 2
- 4
2
votes
1 answer
How exactly works this SQL injection example related to the DVWA application?
I am a software developer converting do application security and I have some doubts about SQL injection example.
I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/
So I have the following doubt (probably pretty trivial).
I…
![](../../users/profiles/42613.webp)
AndreaNobili
- 235
- 1
- 5
2
votes
1 answer
Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?
I am learning about file upload vulnerabilities using DVWA.
After cranking the website's security level to High,
the website checks both the post request's content type & file extension, so in order to bypass it I changed the file extension to .jpg…
![](../../users/profiles/212474.webp)
LazyDaisy
- 23
- 1
- 5
2
votes
2 answers
DVWA vulnerability list or guide?
Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide.
By guide I mean an exhaustive list of vulnerabilities to work through.
user13785
2
votes
0 answers
XSS stored in DVWA
Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used the :"img src", "body onload","onmouseoover" etc…
![](../../users/profiles/202291.webp)
SAM SAMULE
- 21
- 2
2
votes
1 answer
Is it safe to install Xampp to learn Security and Penetration testing using DVWA?
I have heard Xampp is not safe and has a lot of security loopholes. What steps need to be taken to close the loopholes? Is it better if I use a VM instead?
I new to Security Testing and want to learn using DVWA. Kindly provide some feedback...
![](../../users/profiles/178935.webp)
Rishikesh
- 123
- 5
1
vote
2 answers
Issues setting up DVWA for SQLMAP
I am starting on sqlmap, and have dvwa for practicing web app penetration.
I am having the error "Could not connect to the database - please check the config file."
Not sure what the problem is but I have been searching. Nothing seems to be working.…
![](../../users/profiles/27823.webp)
XcutionX
- 21
- 1
- 3