[Approved by AICTE, Govt. of India & Affiliated to Dr.

APJ Abdul
Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering
[Approved by AICTE, Govt. of India & Affiliated to Dr. APJ Abdul
Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering
Experiment No:1

Aim: Basic Packet Inspection: Capture network traffic using Wire shark and analyze
basic protocols like HTTP, DNS, and SMTP to understand how data is transmitted and
received.

Solution

a. Open Wireshark.
b. The following screen showing a list of all the network connections you can monitor is
displayed. You can select one or more of the network interfaces using shift+left-click or
by clicking on the tab All Interfaces Shown

c. Once the network interface is selected, you can start the capture, and there are several
ways to do that.
i. Click the first button on the toolbar, titled “Start capturing packets.”
 [Approved by AICTE, Govt. of India & Affiliated to Dr. APJ Abdul
OR Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering
you can select the menu item Capture-> Start

d. During the capture process, Wireshark will show the following screen

e. Once you have captured all the packets needed, use the same buttons or menu options to

stop the capture as you did to begin.

Analyzing data packets on Wireshark: Wireshark Interface

Wireshark shows you three different panes for inspecting packet data. The Packet List, the top

pane, lists all the packets in the capture. When you click on a packet, the other two panes change to

show you the details about the selected packet. You can also tell if the packet is part of a

conversation.
 [Approved by AICTE, Govt. of India & Affiliated to Dr. APJ Abdul
Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Here are details about each column in the top pane:

No.: This is the number order of the packet captured. The bracket indicates that this packet

is part of a conversation.

Time: This column shows how long after you started the capture this particular packet was

captured. You can change this value in the Settings menu to display a different option.

Source: This is the address of the system that sent the packet.

Destination: This is the address of the packet destination.

Protocol: This is the type of packet. For example: TCP, DNS, DHCPv6, or ARP.

Length: This column shows you the packet’s length, measured in bytes.

Info: This column shows you more information about the packet contents, which will vary
 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

depending on the type of packet.

Packet Details, the middle pane, shows you information about the packet depending on the packet

type. You can right-click and create filters based on the highlighted text in this field.

The bottom pane, Packet Bytes, displays the packet exactly as it was captured in hexadecimal.

When looking at a packet that is part of a conversation, you can right-click the packet and select

Follow to see only the packets that are part of that conversation.

Wireshark filters

Filters allow you to view the capture the way you need to see it to troubleshoot the issues at hand.

Below are several filters.

Wireshark capture filters

Capture filters limit the captured packets by the chosen filter. If the packets don’t match the filter,

Wireshark won’t save them. Examples of capture filters include:

a. host IP-address: This filter limits the captured traffic to and from the IP address

b. net [Link]/24: This filter captures all traffic on the subnet

c. dst host IP-address: Capture packets sent to the specified host

d. port 53: Capture traffic on port 53 only

e. port not 53 and not arp: Capture all traffic except DNS and ARP traffic

Wireshark display filters

Wireshark display filters change the view of the capture during analysis. After you’ve stopped the

packet capture, use display filters to narrow down the packets in the Packet List to troubleshoot
 Department of Applied Computational Science & Engineering

your issue.

a. [Link]==IP-address and [Link]==IP-address This filter shows packets sent from one

computer ([Link]) to another ([Link]). You can also use [Link] to show packets to and from

that IP.

b. [Link] eq 25: This filter will show you all traffic on port 25, which is usually SMTP traffic

c. icmp: This filter will show you only ICMP traffic in the capture, most likely they are pings

d. [Link] != IP_address: This filter shows you all traffic except the traffic to or from the

specified computer
 Experiment No:2

Aim: Detecting Suspicious Activity: Analyze network traffic to identify suspicious patterns,
such as repeated connection attempts or unusual communication between hosts.

Solution:

HTTPS traffic analysis

The Hypertext Transfer Application Layer Protocol (HTTP) utilizes the internet to establish
protocols whenever the HTTP client/server transmits/receives HTTP requests.

Start a Wireshark capture -> Open a web browser -> Navigate to any HTTPS-based website ->
Stop the Wireshark capture.

Input ' ssl' in the filter box to monitor only HTTPS traffic -> Observe the first TLS packet -> The
destination IP would be the target IP (server).

TCP traffic analysis

A standard port scan takes advantage of the TCP three-way handshake. The attacker sends the
SYN packet to the target port. The port is considered open when he gets SYN+ACK as a response,
whereas the arrival of RST shows the port is closed. After receiving SYN+ACK, the hacker
would send an ACK packet to establish a TCP connection.
 Department of Applied Computational Science & Engineering

Analyze TCP SYN traffic

Input ‘[Link] == 80’ to see only TCP traffic connected to the webserver connection.

Observe the TCP [SYN] packet. Expand Ethernet and observe the destination address that is the
default gateway address; whereas, the source is your own MAC address.

To check the IP details, observe Internet Protocol Version 4; in our case, the destination IP is
Googles' web server IP, and the source IP is the local IP address.

To view TCP details, observe Transmission Control Protocol, like port numbers. Monitor the flag
values. SYN, which is enabled, shows the initial section of the TCP three-way handshake.

Analyze TCP SYN, ACK traffic

Take a look at the TCP [SYN, ACK] packet. Expand Ethernet and observe the destination address
now would be your own MAC address; whereas the source is the default gateway address.

Monitor the acknowledgement code. It's worth noting that the number is one relative ACK
number. The real acknowledgement value is one higher than the previous segment's identifier.

Monitor the flag values. [SYN, ACK], which is enabled, shows the second section of the
TCP three-way handshake.
 [Approved by AICTE, Govt. of India & Affiliated to Dr. APJ Abdul
Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Analyze SYN flood attack

SYN flood occurs when an attacker delivers a substantial amount of SYN packets to a server using
fake IPs, causing the server to respond with an SYN+ACK and keep its ports partially open,
expecting a response from an invisible client.

By overwhelming a victim with SYN packets, an attacker can effectively overrun the victim's
resources. In this state, the victim fights with traffic, which causes processor and memory usage to
rise, eventually exhausting the victim's resources.

Use the hping3 tool to flood the victim IP. Simultaneously, start capturing the traffic on
Wireshark. Input '[Link] == 1' in the filter box to view SYN packets flood.

Notice a lot of SYN packets with no time lag.

 [Approved by AICTE, Govt. of India & Affiliated to Dr. APJ Abdul
Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Analyze DoS attacks

Let’s simulate a Denial of Service (DoS) attack to analyze it via Wireshark. For the demo, I am
using the macof tool, the component of the Dsniff suit toolkit, and flooding a surrounding device's
switch with MAC addresses.

The image below shows IP address is generating requests to another device with the same data
size repeatedly. This sort of traffic shows a standard network DoS attack.

For a DDoS attack, use the macof tool again to generate traffic. Observe the fake source and
destination IP addresses are sending many packets with similar data sizes.
 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:3
Objective: Malware Traffic Analysis: Analyze captured traffic to identify signs of malware communication,
such as command-and-control traffic or data infiltration.

Package: [Link] What are

we looking for:

1. What are the infected file(s) downloaded and their hashes?

2. What is URL/ Domain of the infected site?

3. What is the IP address of the infected website?

4. What is the IP address of the infected machine ?

5. What is the hostname of the infected machine?

6. What is the mac address of the infected machine ?

To see only Get and Post Request : Filter --- [Link]

To get the better understanding of destination: Right Click on host user HTTP

Now check Host Column

Sort column by Content type

We can save all suspicious files

We can directly upload the files to virus total but we avoid due to confidentiality, instead we find the
hash of file and then check for malicious activity.
Now, we checked the hash in virus total and found it infected.

2. What is URL/ Domain of the infected site?

Answer: see the host name of infected file.
[Link]

3. What is the IP address of the infected website?

[Link]

4. What is the IP address of the infected machine ?

[Link]
5. What is the hostname of the infected machine?

K34EN6W3N-PC

6. What is the mac address of the infected machine ?

f0:19:af:02:9b:f1

Host name using DHCP:

 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:4

Aim: Password Sniffing: Simulate a scenario where a password is transmitted in plaintext. Use
Wireshark to capture and analyze the packets to demonstrate the vulnerability and the
importance of encryption.

Password Sniffing: Password sniffing is a type of network attack in which an attacker intercepts
data packets that include passwords. The attacker then uses a password-cracking program to
obtain the actual passwords from the intercepted data. Password sniffing can be used to obtain
passwords for any type of account, including email, social media, and financial accounts.

Step 1: First of all, open your Wireshark tool in your window or in Linux virtual machine. and start
capturing the network. suppose you are capturing your wireless fidelity.

Step:2 After starting the packet capturing, we will go to the website and login the credential on
that website as you can see in the image.
 [Approved by AICTE, Govt. of India & Affiliated to Dr. APJ Abdul
Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Step-3: Now after completing the login credential, we will go and capture the password in
Wireshark. for that we have to use some filter that helps to find the login credential through the
packet capturing.

Step 4: Wireshark has captured some packets but we specifically looking for HTTP packets. so, in
the display filter bar we use some command to find all the captured HTTP packets. as you can see
in the below image the green bar where we apply the filter.

Step 5: So, there are some HTTP packets are captured but we specifically looking for form data
that the user submitted to the website. for that, we have a separate filter.
As we know that there is main two methods used for submitting form data from web pages like
login forms to the server. the methods are- GET and POST
 [Approved by AICTE, Govt. of India & Affiliated to Dr. APJ Abdul
Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering
Step 6: So firstly, for knowing the credential we use the first method and apply the filter for the
GET methods as you can see below.

As you can see in the image there are two packets where the login page was requested with a GET
request as well, but there is no form data submitted with a GET request.
Step 7: Now after checking the GET method if we didn’t find the form data, then we will try the
POST method for that we will apply the filter on Wireshark as you can see.
As you can see, we have a packet with form data click on the packet with user info and the
application URL encoded. and click on the down-
HTML form URL Encoded where the login credential is found. login credential as it is the same that
we filed on the website in step 2.
 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:5

Objective: ARP Poisoning Attack: Set up an ARP poisoning attack using tools like Ettercap. Analyze the
captured packets to understand how the attack can lead to a Man-in-the-Middle scenario.

Install Virtual Box Manager on Windows

Install Kali Linux through Virtual Box

Choose Installer Image

Start Kali Linux:
Open Terminal and write command: ip add

Copy MAC address from above and run command in wireshark @kali

We observe: No traffic is being captured

Aim is to capture the traffic between Target and default gate way on same line.
So we go to Target Device (Windows) and find IP address and default gateway.
IPv4 Address. .................. : [Link]
Default Gateway .................. : [Link]
We are going to sniff traffic once we enable ARP poising using Tool Ettercap

OR

Click on three dots and scan for hosts

Select Ip Address and Add to Target 1
Select Default Gateway and Add to Target 2

Still Nothing is capturing

Select Current Targets

Click ARP Poisoning and start sniffing

Now we can see, packets are being captured

Open Wireshark on target Machine and check ARP Poisoning

 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:6

SQL Injection: Use DVWA to practice SQL injection attacks. Demonstrate how an attacker can
manipulate input fields to extract, modify, or delete database information.

Setting Up DVWA

1. Install DVWA:

 You can set up DVWA on your local machine using XAMPP or Docker.

 After installation, open DVWA in your web browser (usually accessible at

[Link]

 Log in with the default credentials (username: admin, password: password).

2. Set Security Level:

 Go to the DVWA Security tab and set the security level to "Low" for simplicity in
this demonstration.

Basic SQL Injection Attack

1. Navigate to the SQL Injection Page:

 In the DVWA menu, click on "SQL Injection".

2. Understanding the Input Field:

 You will see an input field where you are asked to enter a user ID to fetch
information from the database.

3. Testing for SQL Injection Vulnerability:

 In the input field, enter a simple SQL injection payload, such as 1' OR '1'='1. This
input attempts to manipulate the SQL query behind the scenes.

 Click "Submit".

4. Analyzing the Result:

 If the application is vulnerable, it should return all user information from the
database, because the condition 1' OR '1'='1 is always true.

Extracting Database Information

1. Extracting All Users:

  Try a more sophisticated injection: ' OR 1=1--.

 This payload comments out the rest of the SQL query, causing the database to
return all records.

2. Retrieving Specific Information:

 To extract specific information, you can tailor your query. For example: 1'
UNION SELECT user, password FROM users--.

 This payload combines the results from the user ID query with a UNION
statement that fetches all usernames and passwords from the users table.

Modifying Database Information

1. Altering Data:

 SQL injection can also be used to modify database entries. For example: 1';
UPDATE users SET password='hacked' WHERE user_id=1--.

 This payload attempts to change the password of the user with user_id=1 to
'hacked'.

Deleting Database Information

1. Deleting Data:

 An attacker can delete records with a similar approach. For example: 1'; DELETE
FROM users WHERE user_id=1--.

 This payload deletes the user with user_id=1 from the database.

Protecting Against SQL Injection

To prevent SQL injection attacks:

1. Use Prepared Statements: Prepared statements with parameterized queries ensure that
SQL code is passed separately from data.
 2. Validate and Sanitize Input: Always validate and sanitize user inputs.

3. Use ORM Libraries: Object-Relational Mapping (ORM) libraries abstract away the SQL
queries.

4. Least Privilege Principle: Grant the minimum necessary database privileges to your
application.

Conclusion

Practicing SQL injection on DVWA provides hands-on experience on how attackers exploit
vulnerabilities in web applications. By understanding these attacks, developers can better secure
their applications against such threats. Always ensure you have permission to test and attack
systems and never use these skills maliciously.
 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:7

Cross-Site Scripting (XSS): Exploit XSS vulnerabilities in DVWA to inject malicious scripts
into web pages. Show the potential impact of XSS attacks, such as stealing cookies or defacing
websites.

Steps to Exploit XSS Vulnerabilities in DVWA

1. Setup DVWA

 Install DVWA: Install DVWA on your local machine or a virtual environment. Ensure
you have a web server (e.g., Apache) and a database server (e.g., MySQL) set up.

 Configure DVWA: Modify the config/[Link] file with your database credentials
and other necessary configurations.

 Access DVWA: Navigate to [Link] or the appropriate URL to access the

DVWA interface.

2. Log in to DVWA

 Use the default credentials (admin / password).

 Set the DVWA security level to low for easier exploitation.

Injecting Malicious Scripts

Example 1: Stealing Cookies

1. Navigate to the XSS (Stored) section: This section allows you to inject scripts that will
be stored and executed whenever the affected page is loaded.

2. Inject a Malicious Script:

 In the message or input field, enter the following script:

  This script sends the user's cookies to an external server controlled by the
attacker. Replace [Link] with the attacker's actual server
address.

3. Submit the Form: Submit the input containing the script.

4. Verify Cookie Theft: On the attacker's server, verify that the cookies have been
received. This can be done by checking the logs or the [Link] script designed to log
cookies.

Example 2: Defacing Websites

1. Navigate to the XSS (Reflected) section: This section reflects input back to the user,
providing an opportunity to inject and execute scripts.

2. Inject a Defacement Script:

 In the input field, enter:

3. Submit the Form: Submit the input containing the script.

4. Verify Defacement: The web page should now display "Hacked by Attacker" instead of
its original content.

Potential Impact of XSS Attacks

1. Stealing Cookies:

 Attackers can hijack user sessions by stealing cookies, gaining unauthorized

access to user accounts.

 Example: If an attacker steals a session cookie from a logged-in user, they can
impersonate that user on the website.

2. Website Defacement:

 Attackers can alter the appearance of web pages, causing reputational damage to
the website.
  Example: Changing the content of a homepage to display offensive messages or
propaganda.

3. Phishing Attacks:

 XSS can be used to create realistic-looking login forms to steal credentials.

 Example: Injecting a fake login form that sends user credentials to the attacker.

4. Malware Distribution:

 Attackers can inject scripts that redirect users to malicious sites or download
malware.

 Example: Redirecting users to a site that automatically downloads ransomware.

Mitigating XSS Vulnerabilities

1. Input Validation: Sanitize and validate all user inputs to ensure they do not contain
malicious scripts.

2. Output Encoding: Encode outputs to ensure that any potentially malicious code is
rendered harmless.

3. Content Security Policy (CSP): Implement CSP to restrict the sources from which
scripts can be loaded.

4. Use Security Libraries: Utilize libraries and frameworks that offer built-in protection
against XSS.
 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:8

Title: Demonstration of Cross-Site Request Forgery (CSRF) Attack using DVWA

Aim: To study and demonstrate how a Cross-Site Request Forgery (CSRF) attack can exploit
authenticated user sessions in DVWA, forcing users to perform unintended actions without
their knowledge, and to understand security controls used to prevent such attacks.

Objective:
• To understand the working principle of CSRF attacks.
• To perform a CSRF attack in a controlled DVWA lab environment.
• To analyze how attackers misuse browser trust and session cookies.
• To observe the risks of unauthorized password changes or account actions.
• To study prevention methods such as CSRF tokens, Same Site cookies, and secure headers.
• To understand the importance of secure session management in web applications.

Introduction:
Cross-Site Request Forgery (CSRF) is a serious web application vulnerability where an
attacker tricks a logged-in user into sending an unwanted request to a trusted website. Since
the victim is already authenticated, the browser automatically sends session cookies along
with the malicious request. As a result, the server processes the action as if it were
intentionally requested by the legitimate user.

This attack can be used to perform harmful actions such as:

• Changing account passwords
• Updating email addresses
• Making unauthorized transactions
• Deleting user data
• Modifying account settings

DVWA (Damn Vulnerable Web Application) is intentionally designed with security

weaknesses so students can safely learn and test vulnerabilities like CSRF in a legal
environment.

Theory:
CSRF attacks depend on trust relationships inside web applications.

1. Authentication Trust:
The server trusts requests coming from authenticated sessions.

2. Session Cookies:
Browsers automatically attach stored cookies to requests.

3. Hidden Malicious Requests:

Attackers embed forged requests inside web pages, emails, or scripts.

4. Lack of Verification:
If the application does not verify request origin, malicious actions are accepted.
5. User Unawareness:
Victims may not notice that any action was performed.

Requirements:

Hardware:
• Computer/Laptop
• Stable internet connection

Software:
• DVWA installed on localhost/server
• XAMPP or WAMP server
• Web browser (Chrome, Firefox)
• Basic HTML editor (optional)

Procedure:

Step 1: Setup DVWA

Install XAMPP/WAMP and configure DVWA on localhost.

Step 2: Login to DVWA

Open DVWA in browser and log in with valid credentials.

Step 3: Set Security Level

Navigate to DVWA Security settings and select LOW.

Step 4: Open CSRF Module

Choose the CSRF vulnerability section from DVWA menu.

Step 5: Observe Normal Password Change

Use the provided form to normally change password.

Step 6: Create Forged Request

Generate a malicious URL that submits password change automatically.

Example:
[Link]
ge=Change

Step 7: Embed Attack

Place malicious request inside:
• Fake webpage
• Email link
• Hidden image tag

Example:
<img src="malicious_link">

Step 8: Victim Visits Malicious Content

When victim opens page, browser sends request automatically.

Step 9: Verify Attack Success

Return to DVWA and confirm whether password changed.

Step 10: Analyze Why Attack Worked

Observe missing validation and trust in active session.

Observations:
• The browser automatically included session cookies.
• DVWA accepted the forged request.
• Password changed without user approval.
• No warning or authentication prompt appeared.
• Application failed to verify request origin.
• Attack succeeded because CSRF protection was disabled.

Result:
The CSRF attack was successfully demonstrated in DVWA.

The experiment proved that authenticated users can unknowingly execute dangerous actions
when web applications do not validate requests properly. This highlights the importance of
implementing CSRF defenses in secure web development.

Applications:
• Web vulnerability assessment
• Ethical hacking practice
• Cybersecurity education
• Secure coding training
• Penetration testing labs
• Security awareness programs

Advantages (Educational Purpose):

• Demonstrates real-world browser-based attacks
• Improves understanding of session security
• Teaches importance of request validation
• Helps developers design safer applications
• Builds awareness about web vulnerabilities

Limitations:
• Conducted only in controlled environment
• Simplified compared to real-world complex attacks
• Cannot legally test on real websites without permission
• Depends on victim being authenticated

Precautions:
• Perform experiments only in DVWA or lab systems.
• Never attack real websites.
• Follow ethical hacking rules.
• Use authorized testing environments only.
• Protect test credentials during practice.

Prevention Techniques:

1. CSRF Tokens:
Unique random tokens are added to forms. Server verifies token before accepting request.

2. Same Site Cookies:

Restricts cookie sharing during cross-origin requests.

3. Referrer/Header Validation:
Checks whether request came from trusted page.

4. Security Headers:
Use CSP and X-Frame-Options for better browser security.

5. Re-authentication:
Ask users to confirm password for critical actions.

6. Session Management:
• Expire inactive sessions
• Rotate session IDs
• Invalidate sessions after logout
 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:9

Title: Study and Demonstration of Local File Inclusion (LFI) and Remote File Inclusion
(RFI) Vulnerabilities using DVWA

Aim: To study and demonstrate how file inclusion vulnerabilities allow attackers to access
sensitive files or execute malicious code on a server, and to understand methods to prevent
such vulnerabilities.

Objective:
• To understand the concept of file inclusion vulnerabilities.
• To differentiate between Local File Inclusion (LFI) and Remote File Inclusion (RFI).
• To perform LFI and RFI attacks in DVWA.
• To analyze directory traversal techniques.
• To observe the impact of insecure file handling.
• To study preventive security measures.

Introduction: File Inclusion Vulnerabilities arise when web applications dynamically include
files based on user input without proper validation. This allows attackers to manipulate file
paths and access unauthorized resources.

Attackers can exploit these vulnerabilities to:

• Read sensitive system files (like configuration files, password files)
• Execute malicious scripts on the server
• Gain unauthorized access to server resources
• Escalate privileges and compromise the entire system

In DVWA, these vulnerabilities are intentionally present to help learners understand how
insecure coding practices can be exploited.

Theory:

1. Local File Inclusion (LFI):

Occurs when an application includes files from the local server using user input.

Example:
?page=../../../../etc/passwd

Attackers use directory traversal (../) to access restricted files.

2. Remote File Inclusion (RFI):

Occurs when the application allows inclusion of external files via URLs.

Example:
?page=[Link]

This can allow execution of remote malicious scripts.

3. Directory Traversal:
Technique used to move up directories and access protected files.

4. Code Execution:
If the included file contains executable code, the attacker can gain control over the server.

5. Impact of File Inclusion:

• Data leakage
• System compromise
• Website defacement
• Remote code execution

Requirements:

Hardware:
• Computer/Laptop
• Internet connection

Software:
• DVWA installed on localhost/server
• XAMPP/WAMP server
• Web browser (Chrome/Firefox)

Procedure:

Step 1: Setup DVWA

Install and configure DVWA on localhost.

Step 2: Login to DVWA

Access DVWA through browser and login.

Step 3: Set Security Level

Set security level to LOW.

Step 4: Navigate to File Inclusion Module

Open the File Inclusion vulnerability page.

Step 5: Perform LFI Attack

Modify URL parameter to include system file.

Example:
[Link]

Step 6: Observe Output

Check if file contents are displayed.

Step 7: Perform RFI Attack (if enabled)

Include external malicious file.

Example:
[Link]

Step 8: Analyze Results

Observe execution or inclusion of external content.

Step 9: Identify Vulnerabilities

Check absence of input validation and filtering.

Step 10: Document Findings

Record accessed files and behavior.

Observations:
• Application directly used user input in file path.
• Sensitive system files were exposed.
• Directory traversal using ../ was successful.
• External file inclusion allowed execution of remote scripts.
• No validation or filtering mechanism was present.
• Application lacked security controls.

Result:
The experiment successfully demonstrated Local File Inclusion (LFI) and Remote File
Inclusion (RFI) vulnerabilities in DVWA.

It was observed that improper validation of user input can lead to unauthorized file access and
execution of malicious code, posing serious security risks to web applications.

Applications:
• Web application security testing
• Ethical hacking practice
• Vulnerability assessment
• Penetration testing
• Secure software development training

Advantages (Educational Purpose):

• Helps understand real-world vulnerabilities
• Demonstrates impact of insecure coding
• Improves secure programming practices
• Enhances cybersecurity awareness

Limitations:
• Performed in controlled environment only
• Real-world systems have more complex protections
• RFI requires specific server configurations
• Cannot test without proper authorization

Precautions:
• Conduct experiments only in DVWA or lab setups.
• Do not attempt on real websites.
• Follow ethical hacking principles.
• Protect test environment from misuse.

Prevention Techniques:

1. Input Validation:
Always validate and sanitize user inputs.

2. File Whitelisting:
Allow only predefined files to be included.

3. Path Restriction:
Use fixed directories and avoid dynamic file paths.

4. Disable Remote Inclusion:

Disable allow_url_include and allow_url_fopen in server configuration.

5. Security Headers:
Use Content-Security-Policy (CSP).

6. File Permissions:
Restrict access to sensitive system files.

7. Error Handling:
Avoid displaying system errors to users.

8. Regular Security Audits:

Conduct vulnerability testing and code review.
 Kalam Technical University, Lucknow, U.P., India]
Department of Applied Computational Science & Engineering

Experiment No:10

Title: Detailed Study and Demonstration of Brute-Force and Dictionary Attacks on DVWA
Login System

Aim: To understand, simulate, and analyze brute-force and dictionary attacks on DVWA
login pages, and to emphasize the importance of strong password policies and authentication
security.

Objective:
• To understand the concept of password-based authentication.
• To study brute-force and dictionary attack techniques.
• To simulate attacks on DVWA login system.
• To compare efficiency of brute-force vs dictionary attacks.
• To analyze risks associated with weak passwords.
• To study preventive techniques like MFA, CAPTCHA, and account lockout.

Introduction: Passwords are widely used for authentication in web applications. However,
weak and predictable passwords are vulnerable to automated attacks. Attackers use tools to
systematically guess passwords and gain unauthorized access.

Brute-force attacks try every possible password combination, while dictionary attacks use a
predefined list of common passwords. These attacks can compromise user accounts,
especially when no protection mechanisms are in place.

DVWA provides a controlled environment to demonstrate these attacks safely.

Theory:

1. Brute-Force Attack:
A brute-force attack attempts all possible combinations of characters until the correct
password is found. Though time-consuming, it guarantees success if no restrictions are
applied.

2. Dictionary Attack:
A dictionary attack uses a list of commonly used passwords such as:
• 123456
• password
• admin
• qwerty

It is faster than brute-force and effective against weak passwords.

3. Password Weakness:
Weak passwords include:
• Short passwords
• Common words
• Reused passwords
• Predictable patterns

4. Attack Impact:
• Unauthorized login
• Data theft
• Identity misuse
• System compromise

Requirements:

Hardware: Computer/Laptop, Internet connection.

Software: DVWA installed, XAMPP/WAMP server, Web browser, Tools: Hydra / Burp
Suite

Procedure:

Step 1: Setup DVWA

Install DVWA on local server.

Step 2: Login to DVWA

Access DVWA using browser.

Step 3: Set Security Level

Set DVWA security level to LOW.

Step 4: Access Login Page

Open DVWA login interface.

Step 5: Test Normal Login

Login using default credentials (admin/password).

Step 6: Perform Brute-Force Attack

• Configure Hydra/Burp Suite
• Enter target URL
• Set username (admin)
• Use password combinations
• Start attack

Step 7: Observe Attempts

Note repeated login attempts and response behavior.

Step 8: Perform Dictionary Attack

• Use password list file
• Run attack tool
• Observe faster results

Step 9: Compare Attacks

• Brute-force: slower but exhaustive
• Dictionary: faster but limited to list

Step 10: Document Findings

Record time taken, success rate, and vulnerabilities.

Observations:
• Multiple login attempts were allowed.
• No restriction on failed attempts.
• Weak passwords were cracked quickly.
• Dictionary attack was significantly faster.
• System lacked protection mechanisms like CAPTCHA or lockout.
• Automated tools easily exploited login system.

Result:
Brute-force and dictionary attacks were successfully demonstrated in DVWA.

The experiment clearly showed that weak passwords can be easily compromised, leading to
unauthorized access. It highlights the necessity of strong password policies and additional
authentication mechanisms.

Applications:
• Cybersecurity training
• Ethical hacking labs
• Password security testing
• Penetration testing
• User awareness programs

Advantages (Learning):
• Demonstrates real-world attack techniques
• Highlights risks of weak passwords
• Encourages secure authentication design
• Improves understanding of security tools

Limitations:
• Conducted in controlled environment
• Real systems may have protections
• Requires technical setup and tools

Precautions:
• Perform only in DVWA/lab environment
• Do not attack real systems
• Follow ethical hacking principles
• Use authorized testing environments

Prevention Techniques:

1. Strong Password Policy:

• Minimum 12 characters
• Mix of uppercase, lowercase, numbers, symbols

2. Passphrases:
Use long, meaningful phrases instead of simple passwords.

3. Account Lockout:
Lock account after multiple failed attempts.

4. Rate Limiting:
Limit login attempts per second/minute.

5. CAPTCHA:
Prevent automated bots.

6. Multi-Factor Authentication (MFA):

Add extra verification step.

7. Password Hashing:
Store passwords securely using hashing algorithms.

8. User Awareness:
Educate users about secure password practices.

9. Avoid Password Reuse:

Use unique passwords for different accounts.