This document discusses the Damn Vulnerable Web Application (DVWA) project, which allows users to practice penetration testing techniques on a web application in a safe legal environment. DVWA has different security levels that change the difficulty of exploiting vulnerabilities. It is a PHP/MySQL web application that can be installed on systems with a web server, MySQL, and PHP. DVWA contains various exploitable vulnerabilities like SQL injection, file upload, and cross-site scripting that can be practiced manually or with automated scanning tools.

1. DVWA
EXPLOITATION AND PREVENTATION
Presented by
SHIVAM PANCHAL
&
KRASH CHAUHAN

2. The idea behind this project is to try Penetration Testing
techniques on a web-application in a total legal environment.
Among the different possibilities that are available over the
Internet,
I’ve chosen the Damn Vulnerable Web Application (DVWA)
project.
OVERVIEW

3. IDEOLOGY
• Security Testing - Security Testing is the activity of assessing a
system for the presence of security weaknesses.
• Vulnerability Assessment - identify security vulnerabilities and
improves by placing the findings into the tested environment
• Penetration Testing - Involves simulating real attacks to assess the
risk associated with potential security vulnerabilities.

4. AIM
The aim of DVWA is to practice with some of the web vulnerabilities,
with various difficultly levels interacting with a simple
straightforward interface.
There are four different security levels that can be set in order to
change the difficulty of the research and exploit of security breaches:
• Low
• MEDIUM
• HIGH
• IMPOSSIBLE

5. ABOUT - DVWA
DVWA is a PHP/MySQL web application that could be
installed in every Operating System on which are
installed a Web Server, Mysql and PHP. The application
has been designed and developed to have various kind of
exploitable vulnerabilities (more or less easy to find).

6. The vulnerabilities that could be practiced with both manual
exploitation and automated scanning tools on DVWA are:
1. Brute Force
2. Command Injection
3. Cross Site Request
4. File Inclusion
5. File Upload
6. Insecure CAPTCHA
7. Sql Injection
8. Blind Sql Injection
9. Reflected Scripting
10. Cross Site Scripting
TECHNOLOGIES

7. TOOLS OVERVIEW
• Burp Suite
• Hydra
• Mysql
• Jtr – Jony The Ripper
• Wireshark
• Nmap