Session Security & File Upload
Vulnerabilities Lab Report
Name: Maryam Fatima
Date: October 30, 2025
Lab Environment: DVWA (Damn Vulnerable Web Application)
Table of Contents
1. Executive Summary
2. Lab Environment Setup
3. Session Security Findings
4. File Upload Vulnerability Findings
5. Conclusion
1. Executive Summary
This report documents security testing of session management and file upload
functionality in DVWA. Testing identified critical vulnerabilities including weak
session management, session hijacking vectors, unrestricted file upload leading to
Remote Code Execution (RCE), and conceptual demonstration of insecure
deserialization.
Key Findings:
3 session security vulnerabilities identified
1 critical file upload vulnerability (RCE)
Multiple filter bypass techniques tested
All vulnerabilities successfully exploited with proof-of-concept
2. Lab Environment Setup
Target Application: DVWA
Access URL: [Link]
Security Level: Low and Medium (tested both)
Container Platform: Podman
Testing Tools:
Firefox Developer Tools (F12)
Burp Suite Community Edition
Command-line PHP for demonstrations
Setup Commands:
# Start DVWA
podman run -d -p 80:80 [Link]/vulnerables/web-dvwa
# Default credentials
Username: admin
Password: password
# Security configuration
DVWA Security: Low → Medium (for bypass testing)
3. Session Security Findings
Finding #1: Weak Session Token Implementation
Severity: High
Category: Session Management
Description: Session tokens use limited entropy and may not regenerate on
privilege changes, making them vulnerable to prediction and fixation attacks.
Testing Steps:
1. Logged into DVWA with admin credentials
2. Extracted session cookie using Firefox Developer Tools (F12 → Storage →
Cookies)
3. Analyzed PHPSESSID token characteristics
4. Tested session fixation by comparing session IDs before and after
authentication
Findings:
Session ID Format: PHPSESSID:"mj2127p6datlevginvlj8hlj03"
Token Length: Approximately 26-32 characters
Character Set: Hexadecimal
Session Fixation Test: Session ID did not regenerate after login
State PHPSESSID value
Before login mj2127p6datlevginvlj8hlj03
After login mj2127p6datlevginvlj8hlj03
Proof of Concept:
Session ID before and after login = Same (Vulnerable)
Impact:
Session Fixation: Attacker can force victim to use predetermined session ID
Session Prediction: Limited entropy makes brute-force attacks feasible
Account Takeover: Combined with other attacks, leads to full compromise
Screenshots:
Finding #2: Session Hijacking via Cookie Theft and Replay
Severity: Critical
Category: Authentication Bypass
Description: Session cookies lack HTTPOnly and Secure flags, making them
vulnerable to JavaScript-based theft. Captured cookies can be replayed to hijack
authenticated sessions without credentials.
Testing Steps:
1. Authenticated to DVWA as admin user
2. Captured valid PHPSESSID cookie value
(PHPSESSID:"mj2127p6datlevginvlj8hlj03")
3. Logged out from application
4. Injected captured cookie using JavaScript console
5. Verified unauthorized access to authenticated session
Proof of Concept:
Method 1: JavaScript Cookie Injection
In Firefox Developer Console (F12)
[Link] = "PHPSESSID= mj2127p6datlevginvlj8hlj03; path=/;
domain=[Link]";
[Link]();
Method 2: Burp Suite Request Manipulation
GET /[Link] HTTP/1.1
Host: [Link]
Cookie: PHPSESSID= mj2127p6datlevginvlj8hlj03; security=low
Impact:
Complete Account Takeover: Full access to victim's account
No Credentials Required: Bypasses password entirely
Persistent Access: Session remains valid until timeout
Privilege Escalation: If admin session stolen, attacker gains admin rights
Data Breach: Access to sensitive user data and functionality
Screenshots:
Finding #3: Session Persistence After Logout
Severity: Medium
Category: Session Management
Description: Session tokens remain valid after user logout, allowing replay of old
session IDs to regain authenticated access.
Testing Steps:
1. Authenticated to DVWA
2. Captured PHPSESSID value
3. Clicked "Logout" button
4. Attempted to replay captured session token
5. Verified whether session was properly invalidated
Proof of Concept:
// Captured session while logged in
var old_session = "abc123def456";
// After logout, inject old session
[Link] = "PHPSESSID=" + old_session + "; path=/";
// Refresh page
[Link]();
Impact:
Session Reuse: Old sessions can be replayed indefinitely
Stolen Tokens Remain Valid: Even after user logs out
Cached Sessions Exploitable: Sessions in browser history/logs can be
reused
Compliance Issues: Violates PCI-DSS, HIPAA session requirements
Proof of Concept:
Upload [Link]
Access: [Link]
Result: www-data (confirmed RCE)
Additional commands executed:
[Link]
[Link] -la /var/www
[Link] /etc/passwd
Impact:
Critical: Complete server compromise
Remote Code Execution as web server user (www-data)
Access to sensitive files (/etc/passwd, config files)
Potential for privilege escalation
Can modify website, steal data, pivot to internal network
Install persistent backdoors
Attack Chain:
1. Upload PHP shell
2. Execute commands
3. Download privilege escalation scripts
4. Escalate to root access
5. Install rootkit/backdoor
6. Exfiltrate sensitive data
Screenshots:
Finding #5: File Upload Filter Bypass Techniques
Test Environment: DVWA Medium Security
Result: Upload blocked at medium security
Filter Bypass Attempts:
1. Double Extension:
Filename: [Link]
Result: Worked
2. Case Manipulation:
Filename: [Link]
Result: Blocked
3. Null Byte Injection:
Filename: [Link]%[Link]
Result: Blocked
Impact:
Even with basic filters, file upload is still exploitable
Single security control is insufficient
Finding #6: Insecure Deserialization
Vulnerability: Application deserializes user-controlled data without validation
Demonstration:
Created PHP script showing how serialized objects can be manipulated:
Normal User Object:
O:4:"User":2:{s:8:"username";s:4:"john";s:7:"isAdmin";b:0;}
Malicious Modified Object:
O:4:"User":2:{s:8:"username";s:8:"attacker";s:7:"isAdmin";b:1;}
Real-World Impact:
Privilege escalation (normal user → admin)
Remote Code Execution (injecting malicious objects)
Authentication bypass
Example Vulnerable Code:
<?php
// Demonstration of serialization vulnerability
class User {
public $username;
public $isAdmin = false;
function __destruct() {
if($this->isAdmin) {
echo "Admin access granted to: " . $this->username;
}
}
}
// Legitimate serialized user
$user = new User();
$user->username = "john";
$user->isAdmin = false;
echo "Normal user serialized:\n";
echo serialize($user) . "\n\n";
// Malicious serialized user (attacker modifies)
$malicious = 'O:4:"User":2:{s:8:"username";s:7:"attacker";s:7:"isAdmin";b:1;}';
echo "Malicious serialized data:\n";
echo $malicious . "\n\n";
// Unsafe deserialization
echo "Deserializing malicious data:\n";
$evil_user = unserialize($malicious);
?>