The Ethical Hacker Network

ethicalhack3r

Full Member

Offline

Posts: 139

DVWA v1.0.5

« on: August 27, 2009, 08:40:59 PM »

Hello,
Damn Vulnerable Web App (DVWA) v1.0.5 is near completion and I am looking for some feedback/suggestions before the official release.

You can download v1.0.5 from our SVN repository:
https://dvwa.svn.sourceforge.net/svnroot/dvwa
svn co https://dvwa.svn.sourceforge.net/svnroot/dvwa dvwa

For more information on the project:
http://www.dvwa.co.uk
http://www.ethicalhack3r.co.uk/
http://sourceforge.net/projects/dvwa/

Theres still some things that need completeing:
Need to fix the 'File Inclusion' vulnerability.
Make IE friendly.

Any feedback is much appreciated! Thanks guys/girls! Grin


« Last Edit: September 01, 2009, 01:45:08 PM by ethicalhack3r »	Logged

nebu10uz

Sr. Member

Offline

Posts: 368

Re: DVWA v1.0.5

« Reply #1 on: September 03, 2009, 01:53:25 PM »

Downloaded for the purpose to test websecurify. It looks nice and instrumental in learning web application security.

I'm not sure if the XSS reflected section was or was not intentionally left out since I know you are still working on this version but just in case I wanted to let you know.

And another thing, I saw it some where on the web that you have tested websecurify and I wanted to know if you used it against dvwa. I tried it but it appears that this tool needs to authenticate to dvwa to fully test it. There's no way to add login information to websecurify unless its possible to add it to the URL. Any tips you can provide? Thanks.


	Logged

Security+, OSCP, CEH

ethicalhack3r

Full Member

Offline

Posts: 139

Re: DVWA v1.0.5

« Reply #2 on: September 03, 2009, 02:53:16 PM »

The reflected XSS was a SVN conflict that we had, for some reason the client didnt update those files.

v1.0.5 was officially released today wich includes the reflected XSS files.

I could never get websecurify to work with DVWA either, due to the authentication. I was hoping the main dev would have fixed it in the recent newer releases but they still did not work. I will contact him and see if he can help us out.

We also have a new homepage:
http://www.DVWA.co.uk

Thanks for the feedback! Grin


	Logged

nebu10uz

Sr. Member

Offline

Posts: 368

Re: DVWA v1.0.5

« Reply #3 on: September 03, 2009, 03:05:10 PM »

Hey! thanks for your speedy response. I will download the official version and hopefully in the future websecurify will work against dvwa.

Keep up the good work. DVWA is a nice piece of work. Thanks again.


	Logged

Security+, OSCP, CEH

nebu10uz

Sr. Member

Offline

Posts: 368

Re: DVWA v1.0.5

« Reply #4 on: September 03, 2009, 04:34:48 PM »

As mentioned by Ketchup in

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,4586.msg22191/topicseen,1,1/

websecurify has the ability to login to the web application before testing. I didn't see the login link underneath the URL input field.


	Logged

Security+, OSCP, CEH

nebu10uz

Sr. Member

Offline

Posts: 368

Re: DVWA v1.0.5

« Reply #5 on: September 03, 2009, 04:54:24 PM »

Ok, I tested DVWA 1.0.5 using WEBSECURIFY. You first have to click on the "login to the application first" link in websecurify then supply http://127.0.0.1 and it will scan it completely.

Now, websecurify only reported CSRF, Autocomplete enabled and banner disclosure. I know this tool is in beta stage and I'm looking forward to future improvements.


	Logged

Security+, OSCP, CEH

ethicalhack3r

Full Member

Offline

Posts: 139

Re: DVWA v1.0.5

« Reply #6 on: September 03, 2009, 05:00:14 PM »

I think it only shows those because its only testing login.php.

WEBSECURIFY would think that the login script was vulnerable to CSRF becuase it does not know the context of what the page is used for. The login page doesnt have 'AUTOCOMPLETE=OFF' in the source and the banner just comes from the webserver.

I posted on the WEBSECURIFY mailing list for some help, hopefully they will guide us in the right direction.


	Logged

nebu10uz

Sr. Member

Offline

Posts: 368

Re: DVWA v1.0.5

« Reply #7 on: September 03, 2009, 05:06:57 PM »

When WEBSECURIFY is scanning, it shows the directories that it is scanning so I assume its going through all of them. Also, I don't know if the built-in browser remembers the security settings when I set it to low.


	Logged

Security+, OSCP, CEH

nebu10uz

Sr. Member

Offline

Posts: 368

Re: DVWA v1.0.5

« Reply #8 on: September 03, 2009, 05:15:41 PM »

The WEBSECURIFY tool is not just scanning the login page but other dwva directories as well. This is indicated in the tool report.


	Logged

Security+, OSCP, CEH

ethicalhack3r

Full Member

Offline

Posts: 139

Re: DVWA v1.0.5

« Reply #9 on: September 03, 2009, 05:27:17 PM »

Your right!

I was pointing WEBSECURIFY to http://127.0.0.1/dvwa instead of http://127.0.0.1. Once I moved everyhting else off my webserver and pointed it to http://127.0.0.1 it scans eveything.

I'll do some further testing and see if I can get it to recognise the security level cookie.


	Logged

nebu10uz

Sr. Member

Offline

Posts: 368

Re: DVWA v1.0.5

« Reply #10 on: September 03, 2009, 05:36:13 PM »

As far as WEBSECURIFY built-in browser is concern, it does remember the security settings. If I log out of dvwa and log in again, I can see at the bottom left hand corner of the home page that the security level is set to low. Now, I'm not sure about WEBSECURIFY scanner tool. This has to be check.


	Logged

Security+, OSCP, CEH

ethicalhack3r

Full Member

Offline

Posts: 139

Re: DVWA v1.0.5

« Reply #11 on: September 05, 2009, 07:13:47 PM »

Im still waiting on a reply from pdp (the author) about this. Will get back to you when he gets back to me.


	Logged

Pages: [1] Go Up

« previous next »