Damn Vulnerable Web Application (DVWA): Difference between revisions

From Alpine Linux
(Created page with "For testing web security tools a target which has plenty vulnerabilities is needed. The [http://www.dvwa.co.uk Damn Vulnerable Web Application (DVWA)] provides a PHP/MySQL web...")
 
No edit summary
(5 intermediate revisions by one other user not shown)
Line 5: Line 5:


Install extra packages:
Install extra packages:
{{Cmd|apk add php-mysql mysql mysql-client}}
{{Cmd|apk add php5-mysql mysql mysql-client}}


= Installing and configuring Piwik =
= Installing and configuring DVWA =


Create the a folder named ''webapps''
Create the a folder named {{Path|webapps}}


{{Cmd|mkdir -p /usr/share/webapps/}}
{{Cmd|mkdir -p /usr/share/webapps/}}
Line 16: Line 16:


{{Cmd|cd /usr/share/webapps/
{{Cmd|cd /usr/share/webapps/
wget http://dvwa.googlecode.com/files/DVWA-1.0.7.zip}}
wget https://github.com/RandomStorm/DVWA/archive/v1.9.zip}}


Unpack the archive and remove it
Unpack the archive and remove it


{{Cmd|unzip DVWA-1.0.7.zip
{{Cmd|unzip v1.9.zip
rm DVWA-1.0.7.zip}}
rm v1.9.zip}}


Change the folder permissions
Change the folder permissions
Line 34: Line 34:


{{Cmd|<nowiki>/usr/bin/mysql_install_db --user=mysql
{{Cmd|<nowiki>/usr/bin/mysql_install_db --user=mysql
/etc/init.d/mysql start && rc-update add mysql default
/etc/init.d/mariadb start && rc-update add mariadb default
/usr/bin/mysqladmin -u root password 'password'</nowiki>}}
/usr/bin/mysqladmin -u root password 'password'</nowiki>}}


Modify the database credentials within DVWA configuration file ''/config/config.inc.php''
Modify the database credentials within DVWA configuration file ''/config/config.inc.php''


{{Cmd|nano -w config/config.inc.php}}
{{Cmd|nano -w /usr/share/webapps/dvwa/config/config.inc.php}}


To complete the setup, browse to the DVWA directory on the webserver.
To complete the setup, browse to the DVWA directory on the webserver.
Line 47: Line 47:
Follow the link to setup the database.
Follow the link to setup the database.


[[Category:PHP]]
[[Category:PHP]] [[Category:SQL]] [[Category:Security]]
[[Category:SQL]]

Revision as of 07:25, 23 September 2018

For testing web security tools a target which has plenty vulnerabilities is needed. The Damn Vulnerable Web Application (DVWA) provides a PHP/MySQL web application that is damn vulnerable.

Install lighttpd, PHP, and MySql

Basic Installation

For installing the additional packages first activate community packages and update the package index

Install the required packages:

# apk add lighttpd php82 fcgi php82-cgi

Configure Lighttpd

Edit lighttpd.conf (/etc/lighttpd/lighttpd.conf) and uncomment the line:

Contents of /etc/lighttpd/lighttpd.conf

... include "mod_fastcgi.conf" ...

Edit mod_fastcgi.conf (/etc/lighttpd/mod_fastcgi.conf), find and change /usr/bin/php-cgi to /usr/bin/php-cgi82.

Contents of /etc/lighttpd/mod_fastcgi.conf

... "bin-path" => "/usr/bin/php-cgi82" # php-cgi ...

Start lighttpd service and add it to default runlevel

# rc-service lighttpd start # rc-update add lighttpd default

Install extra packages:

apk add php5-mysql mysql mysql-client

Installing and configuring DVWA

Create the a folder named webapps

mkdir -p /usr/share/webapps/

Download the source archive and unpack it

cd /usr/share/webapps/ wget https://github.com/RandomStorm/DVWA/archive/v1.9.zip

Unpack the archive and remove it

unzip v1.9.zip rm v1.9.zip

Change the folder permissions

chmod -R 777 /usr/share/webapps/

Create a symlinks to the folder dvwa

ln -s /usr/share/webapps/dvwa/ /var/www/localhost/htdocs/dvwa

Configuration and start MySql

/usr/bin/mysql_install_db --user=mysql /etc/init.d/mariadb start && rc-update add mariadb default /usr/bin/mysqladmin -u root password 'password'

Modify the database credentials within DVWA configuration file /config/config.inc.php

nano -w /usr/share/webapps/dvwa/config/config.inc.php

To complete the setup, browse to the DVWA directory on the webserver.

http://WEBSERVER_IP_ADDRESS/dvwa

Follow the link to setup the database.