Web App Penetration Testing - #2 - Spidering & DVWA

Introduction

This tutorial focuses on web application penetration testing with an emphasis on spidering and utilizing DVWA (Damn Vulnerable Web Application). By following these steps, you will learn how to identify vulnerabilities in web applications using Burp Suite, a powerful tool for security testing. This guide is perfect for both beginners and those looking to enhance their skills in web application security.

Step 1: Setting Up Your Environment

1. Install Burp Suite

   • Download the latest version of Burp Suite from the PortSwigger website.
   • Install it on your system following the provided installation instructions.

2. Install DVWA

   • Set up DVWA on a local server (e.g., XAMPP or WAMP).
   • Ensure that DVWA is configured properly and is running. You can access it via http://localhost/dvwa.

3. Configure Burp Suite

   • Launch Burp Suite and configure your browser to route traffic through Burp's proxy.
   • Set your browser's proxy settings to 127.0.0.1 with port 8080 (default for Burp).

Step 2: Understanding Spidering

1. What is Spidering?

   • Spidering is the process of mapping out a web application by automatically discovering its pages and resources.
   • It helps identify all possible entry points for testing.

2. Using Burp Suite for Spidering

   • In Burp Suite, navigate to the "Target" tab.
   • Ensure your DVWA site is added to the scope.
   • Go to the "Spider" tab and click on "Spider this host" to start the spidering process.
   • Monitor the progress in the "Target" tab and review the discovered content.

Step 3: Analyzing the Results

1. Review Discovered URLs

   • After spidering, look at the list of URLs and resources that Burp has discovered.
   • Identify any interesting endpoints that could be potential targets for further testing.

2. Check for Vulnerabilities

   • Use the "Scanner" tool in Burp Suite to analyze the discovered endpoints for common vulnerabilities like SQL Injection, XSS, and CSRF.
   • Review the results and note any vulnerabilities that are found.

Step 4: Exploiting Vulnerabilities in DVWA

1. Testing with DVWA

   • Use the vulnerabilities identified to practice exploitation.
   • DVWA provides various levels of difficulty; start with low and progressively increase the difficulty.

2. Common Exploits

   • For SQL Injection, try inputting common SQL payloads into form fields.
   • For XSS, test by injecting scripts into input fields and observing the application's response.

Conclusion

In this tutorial, you learned how to set up your environment for web application penetration testing, understand the spidering process using Burp Suite, and analyze the results to identify vulnerabilities. Remember to practice these techniques regularly to enhance your skills. As you gain confidence, explore more complex applications and advanced exploitation techniques. Happy testing!