Web Security Lab Part 1: Setting up DWVA - Hsanokklis/2022-2023-Tech-journal GitHub Wiki

Summary: Using a tool called Damn Vulnerable Web Application(DVWA) to get experience with software vulnerabilities including: command execution, SQL Injection, and Cross-Site Scripting.

Lab Link

Doc Link

---

Part 1: setup

1. Take a snapshot of your windows VM as a backup

2. Disable Internet Information Services(IIS) from last week's lab

Go to "turn windows features on or off"

3. Download save and install XAMPP

• using version 8.2.0 since its the latest one

• Doing setup with all default options

• save to the C drive on the xampp folder

• Allow access(this screen means that the IIS has been disable and the program will actually work)

• Start Apache and MySQL(these are the 2 programs we are interested in for DVWA, we know they are running because they are both showing green

• We can test apache by going to our browser and then typing in localhost. This is the webpage that should come up

4. Download a copy of DVWA from https://github.com/digininja/DVWA (as a zip file)

code ---> zipfile

• extract all files from the DVWA-master zip file

• rename the folder to just DWVA

5. Copy the DVWA folder into htdocs in the xampp folder

Local Disk(C) --> xampp --> htdocs

• to test that you have done this right go to your browser and type in localhost/DVWA and you should get an error(which means its correct

6. Go to DVWA --> config --> rename config.inc.php.dist to config.inc

• file should look like this

7. Go to admin for MySQL

• should open this site

8. create a dvwa database

This is the list of databases

• creating the database

9. Add the user

• go to privileges ---> add user account

10. Add in user specifications

• They have to match what it says in the config.inc.php file(which you can open with notepad)

11. Grant all privileges on database dvwa

12. Click go to make your new user and make sure you get the popup

13. Go to the DVWA setup page

14. Click the create database button

• _ if things go right you should get these popups_

15. Fix allow_url_include, missing gd and reCAPTCHA key

16. Edit the php.ini file

• Go back to the control panel --> Apache --> config --> php.ini

17. turn on allow_url_include

• edit the file to turn it on

18. enable gd

• to enable it remove the semi colon so that it is no longer a comment

19. Save the file and stop/start apache

20. Input the reCAPTCHA key(in the lab instructions)

21. Change default secuirty level to low

Fully setup DVWA