INDIVIDUAL PROJECT REPORT
DVWA VULNERABILITY / ATTACK
NAME : Alya Batrisyia Binti Khairul Nizam
Student ID : 2022883382
Group : CDCS2514A
SUBMITTED TO:
DR. MOHSEN BIN MOHAMAD HATA
Chapter 1 : Introduction
1.1 DVWA background
This purposefully flawed website is supposed to be used as a teaching aid, particularly for
online security students. By learning about common online security vulnerabilities and how
to address them, DVWA may be beneficial to developers, security specialists, and students
alike. It offers a secure setting where users may practice finding and fixing vulnerabilities
without endangering real-world systems. Since DVWA was created in PHP and uses a MySQL
database, it is simple to install on a variety of web hosts. The application has several security
flaws, including SQL injection, weak session, command injection, file inclusion and cross-site
scripting (XSS).
This fosters a collaborative environment where developers, instructors, and enthusiasts for
security can collaborate to improve the product and fix flaws.
Users may learn how attackers could exploit these vulnerabilities to compromise a web
application, get unauthorised access, or do unwanted actions. Additionally, as users get
more adept at identifying and fixing vulnerabilities, they may gradually increase the level of
complexity with DVWA's security levels, which range from low to high.
All things considered, DVWA is a fantastic resource for imparting knowledge about online
security concepts in a hands-on and engaging manner.
1.2 Brief explanation on the setup
The setup of Damn Vulnerable Web Application (DVWA) involves configuring a web
application designed to be vulnerable to various security threats for educational and
testing purposes.
Firstly the installation and configuration. Install DVWA on a local server or web hosting
platform and then configure the application to run within the desired environment,
ensuring the necessary dependencies are [Link] three shell and type these code.
For each shell the code can be refer at the attachment 1.2.1 , 1.2.2 and 1.2.3.
1.2.1 Code for the first shell
1.2.2 Code for the second shell
1.2.3 Code for the third shell
After finishing this setup users then need to open the firefox and search
[Link] ,then it will direct the user to the DVWA website.
User then need to login to the website using the username admin and the password is
password. After the login we need to set the security level to low level.
Chapter 2: Vulnerability or attack in DVWA
2.1 Explain the vulnerability or attack done towards DVWA.
2.1.1 Weak Session IDs
The first attack is weak session IDs. The "weak session IDs" problem in DVWA introduces
users to the dangers of inadequate session management. If a session ID is easily
anticipated or guessed by an attacker, it is considered weak. Numerous variables,
including predictability, inadequate duration, and unsecured transmission, might
contribute to this [Link] may be able to estimate legitimate session IDs
if the session ID creation mechanism is based on predictable patterns like timestamps,
consecutive integers, or minimal randomization. In a weak session IDs attack scenario,
bad actors usually try to guess or change session IDs in order to obtain access without
authorization. Weak session IDs can have severe consequences. If an attacker is able to
guess or intercept a session ID, they can take control of the associated user session and
access private data and features without authorization. Depending on the privileges of
the affected session, this breach may result in data theft, unauthorised transactions, and
wider system breaches.
.
2.1.2 SQL Injection
One of the most common and harmful vulnerabilities in online applications is SQL
Injection. An attacker can modify a web application's SQL query by inserting malicious
SQL code through user input fields, a technique known as SQL Injection. Due to poor
processing of the input data, this vulnerability develops, which gives attackers the ability
to run unauthorised SQL operations and compromise the database and its contents. SQL
Injection attacks have serious and varied repercussions. Among these is unauthorised
access, in which hackers may access user accounts,including those with administrator
privileges and without authorization by ignoring authentication [Link] is the
theft of data, in which passwords, sensitive user information, financial records, and
usernames may all be obtained from the database by an attacker via SQL Injection.
2.2 Provide screenshots to demo steps taken.
2.2.1 Weak Session Ids
This page will set a new cookies named dvwaSession everytime user
click the generate button.
Before user click the generate button, there are no dvwaSession ind
the cookies section .
When the generate button has been clicked , the dvwaSession appears
and the value assigned is 1.
When the generate button is clicked again, the value of dvwaSession is
incresed by one and to see if the pattern is the same as the predictable
which is increase by one , the genrate button will be click again. The
screenshots below shows that the value is increment from 2 to 3 and
they are predictable.
2.2.2 SQL Injection
First, take a look at the scource code of the sql. In this code, the user’s
input is directly inserted into the SQL statement.
After check the source code, use the code 1’ or ‘1’=1 to check if there
Is any vulnerabilities by using that code.
After we hit the enter button, it shows that there is vulnerability as it
list out the firstname and the surname without being encrypted.
Use “ORDER BY” to know how may tables in the [Link] the
code reach the “ORDER BY 3#” it brings user to the blank page . By
doing this, it shows that there are only two columns. The screenshot
belows shows the results of the code used.
The blank page result when the user type “ORDER BY 3#”.
Lastly the code used is “ ‘UNION SELECT user, password FROM users#”.
Since there are vulnerabilities in the system, it will list out the first and
surname but instead of list the surname, the system outputs a list of
passwords that have been securely hashes. The password still can be
decrypted using any website that provide this service.
The screenshot below shows that the password that can be decrypted
using any website that can decrypt the hashes password.
The result of the hashes password that have been decrypted.
Chapter 3 : Conclusion
3.1 Explain the severity and trend of the vulnerability or attack done.
3.1.1 Weak session IDS
Session IDs are essential for maintaining the integrity and security of online
sessions. These are unique tokens that are given to users when they enter into a web
application, making sure that requests made afterwards are verified and linked to the
right person. The strength and randomness of the session IDs determine how secure
these sessions are since attackers may anticipate or intercept weak session IDs with
ease, they represent a serious risk. An attacker can obtain unauthorised access to a
user's account, sensitive data connected to it, and other features by pretending to be
the authorised user and guessing or stealing a session ID. This might jeopardise the
entire system and result in more serious issues including data corruption, interrupted
services, and total takeover of the system. The field of web application security is
always changing, and with it, the methods and patterns related to session ID
vulnerabilities.
Secure session management is becoming more and more important because
to products like DVWA. A growing number of contemporary web frameworks and
tools come pre-configured with secure session management. For example, a lot of
frameworks now create session IDs using cryptographically secure random number
generators, which greatly lowers the danger of predictability. Secure session
management is vital, as demonstrated by DVWA, which emphasises the seriousness
of weak session IDs in online applications. These vulnerabilities have the potential to
cause serious breaches of security, illegal access, and wider system intrusions. But
the trend is shifting in towards more knowledge, the use of secure technology, HTTPS
enforcement, enhanced monitoring, and Multi-Factor Authentication (MFA).
Together, these developments are strengthening online applications' security posture
against the threats presented by poor session IDs.
3.1.2 SQL Injection
SQL Injection involves the manipulation of a web application's SQL queries by
inserting malicious SQL code through user inputs. The impact of SQLI vulnerabilities
on online applications' security and integrity is significant, since they can lead to data
breaches among other important consequences. Attackers may be able to get
sensitive data with SQL Injection, including bank records, login credentials, and
personal information. Users and companies suffer financial losses as well as serious
privacy infractions as a result of this.
Next, there is authentication bypass, wherein attackers can obtain
unauthorised access to user accounts, even those with administrator capabilities, by
using SQL Injection to get around authentication systems. This can result in an
application takeover from scratch. Despite being a known vulnerability for many
years, SQL Injection is still important today because of the ongoing development of
new online applications and the evolution of attack methods.
The current state of SQL Injection trends reflects both the continued
difficulties and the progress made in mitigating the more sophisticated assaults.
Attackers are become more skilled and are employing complex methods to hide their
payloads and avoid discovery. This involves making use of automated technologies
and taking advantage of less evident injection locations in [Link] last trend
is the deployment of Web Application Firewalls (WAFs), which are being used by
more and more enterprises to instantly identify and thwart SQL Injection attacks.
Advanced algorithms and machine learning are used by modern WAFs to spot
harmful tendencies. The seriousness of SQL Injection, as DVWA has shown,
emphasises how important it is to have careful security procedures. Serious
repercussions from SQL Injection include data leaks, bypassing authentication, and
total system penetration. Present patterns indicate a positive change in the direction
of stronger defences, nonetheless.
3.2 Explain the tool or technique to prevent or mitigate the vulnerability or
attack.
3.2.1 Weak Session IDS
To guarantee the security of online applications, weak session IDs must be
prevented and mitigated. Strong randomization is one of the methods used to
prevent Weak Session IDs. Ensure that random number generators that are
cryptographically safe are used to generate session IDs. Functions and libraries
created to offer high entropy and unpredictability for session ID creation can be used
in the implementation. Next, make sure that session IDs are long enough to fend off
brute-force attacks by using enough length. The employed session IDs must have a
minimum length of 128 bits and guarantee that the random bytes are translated into
a long enough hexadecimal string.
OWASP ZAP is a tool for mitigating Weak Session Ids. This open-source online
application security scanner assists in locating problems with session management,
such as weak session IDs. The tools are used to scan the web application and find
session management flaws. For instance, set up OWASP ZAP to do a thorough scan
and examine session ID patterns. The Burp Suite is the second tool. A popular web
vulnerability scanner that has session management testing tools is called Burp Suite.
Session IDs may be tested for predictability and randomization using the Burp suite.
To protect online applications from session hijacking and other threats, weak
session IDs must be prevented and mitigated. Sufficient length developers can greatly
improve the security of their session management procedures by using strong
randomization. OWASP ZAP and Burp Suite are two other tools that help find and fix
vulnerabilities in session IDs. By using these methods and resources, one may
guarantee strong session management and shield apps and users from possible
security risks.
3.2.2 SQL Injection
Preventing and mitigating SQL Injection involves adopting best practices in
coding, employing secure database interactions, and using specialized security tools.
Prepared statements and parameterized queries are two methods to stop SQL
Injection. Prepared statements and parameterized queries are essential methods for
stopping SQL Injection issues. They reduce the possibility of malicious SQL code
execution by ensuring that user inputs are treated safely by the [Link] inputs
are handled solely as data and not as executable code thanks to parameterized
queries. It generated statements that bind variables, detaching data and SQL logic in
the process. The advantages of doing this include that parameterized queries and
prepared statements guarantee that user-provided data cannot change the SQL
query's structure by isolating the SQL logic from user inputs. By making certain that
the database processes only legitimate and secure data, these methods aid in
maintaining data integrity.
The second technique is input validation and sanitization. When developing
online applications, input validation and sanitization are essential security
procedures. They shield programmes from a variety of threats, including SQL
Injection, by making ensuring user inputs are properly structured and devoid of
dangerous material. Validating user inputs to ensure they adhere to predetermined
standards or guidelines is known as input validation. The security of the application
may be kept safe from dangerous data by developers by making sure that user inputs
are thoroughly vetted and sanitised.
Developers and security experts can find, stop, and mitigate SQL Injection
issues with the use of a variety of technologies. The first one is installing a firewall
layer on the website is one practical method of mitigation . By putting in place
specific regulations intended to restrict and get rid of potentially harmful traffic,
these firewalls are essential for safeguarding websites .The rules that this firewall
applies are designed to thwart several kinds of attacks, such as SQL injection and
cross-site scripting . Websites that use firewalls are better equipped to recognise and
react swiftly to SQLI attack attempts that might jeopardise the security and integrity
of the data they contain. Consequently, one of the most important elements of a
mitigation plan that might support preserving a website's security and integrity
against different SQLi assaults is putting in place a firewall. The second one to find
possible SQL Injection locations, the tools that can be used SQLMap. An open-source
programme called SQLMap was created expressly to find and take advantage of SQL
Injection flaws. It streamlines the process of identifying and taking advantage of SQL
Injection vulnerabilities in online apps. Numerous SQL Injection methods, database
fingerprinting, data fetching, and database manipulation are all supported by
SQLMap.
Organisations may prevent one of the most serious online security concerns
and greatly improve the security of their web apps by integrating these technologies
into the development and testing processes.
References
1. Sundar, V. (2024, May 13). How to Prevent SQL Injection Attacks? Indusface.
[Link]
2. B. (n.d.). DVWA - Weak Session IDs - Braincoke | Security Blog.
[Link]
3. [Link] , [Link], M.A Mu’min , Mitigation from SQL Injection Attacks on Web
Server using Open Web Application Security Project Framework. (2024, April).
Retrieved May 12, 2024, from
[Link]
ection_Attacks_on_Web_Server_using_Open_Web_Application_Security_Project
_Framework