🛡️ DVWA Web Application Pentesting

Offensive Security Practice on the Damn Vulnerable Web Application

A structured, hands-on penetration testing project covering the OWASP Top 10 vulnerability classes — from Low to High difficulty.

---

📖 Table of Contents

• Overview
• Objective
• Lab Environment
• Vulnerabilities Covered
• Repository Structure
• Methodology
• Key Takeaways
• Disclaimer
• Author

---

🔍 Overview

This repository documents a full offensive security assessment of DVWA (Damn Vulnerable Web Application), a deliberately insecure web app built for practicing common exploitation techniques in a legal, controlled setting.

Each vulnerability class is tested at DVWA's Low, Medium, and High security levels to demonstrate how server-side mitigations progressively reduce — but don't always eliminate — exploitability.

🎯 Objective

To build and demonstrate practical, job-ready web application security skills — identifying, exploiting, and documenting vulnerabilities the way a penetration tester or SOC analyst would, along with an understanding of the corresponding attacker techniques that defenders need to detect.

🖥️ Lab Environment

Component	Details
Attacker Machine	Kali Linux (VirtualBox)
Target Application	DVWA hosted on Metasploitable 2
Core Tools	Burp Suite, Nmap, Wireshark, sqlmap, browser DevTools
Network	Isolated host-only VirtualBox network

🧪 Vulnerabilities Covered

#	Category	Focus
1	SQL Injection (SQLi)	Extracting and manipulating database data via unsanitized input
2	Cross-Site Scripting (XSS)	Reflected, Stored, and DOM-based script injection
3	Command Injection	Executing arbitrary OS commands through vulnerable inputs
4	File Inclusion (LFI/RFI)	Exploiting local/remote file inclusion flaws
5	File Upload	Bypassing upload filters to achieve remote code execution
6	Brute Force	Credential attacks via Burp Suite Intruder
7	CSRF	Forging unauthorized requests as an authenticated user

📁 Repository Structure

DVWA-Web-App-Pentesting/
├── SQLi/          # SQL Injection walkthroughs (Low → High)
├── XSS/           # Cross-Site Scripting walkthroughs (Low → High)
└── README.md

Additional folders for Command Injection, File Inclusion, File Upload, Brute Force, and CSRF are in progress and will follow the same structure.

Each folder includes:

• ✅ Step-by-step exploitation walkthroughs
• 🖼️ Screenshots of payloads and results
• 📝 Notes comparing behavior across security levels

🧭 Methodology

1. Recon — Map the application's input points and functionality per module
2. Exploit (Low) — Establish baseline exploitation with no mitigations
3. Exploit (Medium/High) — Adapt payloads to bypass increasing filters/sanitization
4. Document — Capture payloads, requests/responses, and screenshots
5. Reflect — Note the defensive control that would have stopped each attack

📌 Key Takeaways

• Practical understanding of how input validation failures lead to real exploitation
• Comfortable reading, intercepting, and manipulating HTTP requests/responses
• Clear picture of how the same vulnerability class shifts in difficulty as security hardening increases
• Bridges offensive technique with defensive/detection thinking

⚠️ Disclaimer

This project is for educational purposes only, performed entirely in an isolated lab environment (DVWA / Metasploitable 2) that is intentionally vulnerable by design. These techniques must never be used against systems without explicit authorization.