Scribd
Upload
7 views14 pages

CSFile

The document outlines a series of experiments focused on various web vulnerabilities using DVWA, including SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), File Inclusion vulnerabilities, and Brute Force attacks. Each experiment emphasizes the installation of XAMPP server, manipulation of input fields, and the demonstration of potential impacts of these attacks. The document serves as a practical guide for understanding and exploiting common web security vulnerabilities.

Uploaded by

kambojsonakshi88
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
7 views14 pages

CSFile

The document outlines a series of experiments focused on various web vulnerabilities using DVWA, including SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), File Inclusion vulnerabilities, and Brute Force attacks. Each experiment emphasizes the installation of XAMPP server, manipulation of input fields, and the demonstration of potential impacts of these attacks. The document serves as a practical guide for understanding and exploiting common web security vulnerabilities.

Uploaded by

kambojsonakshi88
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Experiment: 06

Objective:
SQL Injection:
Use DVWA to practice SQL injection attacks. Demonstrate how an attacker
can manipulate input fields to extract, modify, or delete database
information.

Install XAMPP server

Vulnearibility : SQL Injection


Running The File
Experiment: 07

Objective:
Cross-Site Scripting (XSS):
Exploit XSS vulnerabilities in DVWA to inject malicious scripts into web pages.
Show the potential impact of XSS attacks, such as stealing cookies or defacing
websites.

Install XAMPP server

Connect to the DVWA:


To start, boot up a system running DVWA. Then, connect to the DVWA with your
browser from your Kali system.

Set Security to Low:


Using some simple XSS that is usually sanitized by modern secure web applications.
For demonstration purposes we are disabling that sanitizing process. For that
reason, we need to set the security level on our DVWA to "low".
Running The File:

Reflected XSS Attacks:

URL Address Attack:


Persistent or Stored XSS Attacks:
Experiment: 08

Objective:
Cross-Site Request Forgery (CSRF):
Set up a CSRF attack in DVWA to
demonstrate how attackers can manipulate authenticated users into performing
unintended actions. (In our case, changing their password on DVWA.)

Install XAMPP server

Changing Password with CSRF using DVWA:


Running The File:

URL Address Check:


Changing File Name:
Experiment: 09

Objective:
File Inclusion Vulnerabilities:
Explore remote and local file inclusion
vulnerabilities in DVWA. Show how attackers can include malicious files on a
server and execute arbitrary code.

Login to DVWA:

Change the URL from [Link] to ?page=../../../../../../etc/passwd:


Change the URL from?page=../../../../../../etc/passwd
to?page=../../../../../../proc/version:

Change [Link] to /etc/passwd:


Changing File URL:
Experiment: 10

Objective:
Brute Force and Dictionary Attacks:
Use DVWA to simulate login pages and demonstrate Brute Force and Dictionary
Attacks against weak passwords. Emphasize the importance of strong password
policies.

Brute Force Login to DVWA:


Raw Request Data:

Select Repeater Tab:

Payload Marker:
Selected Choose an attack type → Cluster bomb.:

Start the Attacking with Kali Linux.:

Burp Proxy:

You might also like