Teach Children The Alphabet With Alphabet Frisbees

When children in between the age of two and three toss a tantrum, there ought to be no implications other than to have them sit some place till they relaxed down. When most more youthful kids get…

独家优惠奖金 100% 高达 1 BTC + 180 免费旋转

DVWA and Mutillidae

I am using Burpsuit for this lab.
We first configure burpsuit and our browser proxy. I am using firefox here for my convenient i’m using foxyProxy a firefox extension which allows me to switch my proxy setting in firefox hassle free.

Try to login with username admin and password as test.

Then I start to bruteforce password by using wordlist which is locate in my /usr/share/SecLists/Passwords/probable-v2-top207.txt and greping the Username and/or password incorrect in the brup options. I found password is the correct Password for admin.

For security level medium it is still possible to bruteforce just it has 2 sec delay for each request to accept. That means it eventually consume time.

2. Command Injection

By pinging the localhost i.e. 127.0.0.1

I see its a command ping -c4. I use payload as 127.0.0.1 | ls and I got list of file available. Also able to read index.php file.

For the security level: medium

When I read source code they delete the input if contains && or ; that means my above command is still able to get index.php content.

For Security level: high

After looking source code I just need to change my command. 127.0.0.1 |cat index.php.

3. File Inclusion

4. File upload

For this I create a php file to connect a shell from weevely with payload weevely generate test reverse.php.

Then I upload this file since it’s low on security it accepts anything and I got the location of that file. Then I try to connect it by weevely by using command. And I got the shell.

5. SQL Injection

I Know sql language so I use the command 1' union select user,password from users# and I got the users username and password of all in database.

6. SQL (blind) Injection

In this I use burpsuit to verify sql injection I use the sleep function to check the response of request. Send this request to intruder and make a squence attack.

As time increase response length also increase this confirms blind injection.

7. XSS (DOM)

When we select English it reflect the selection on url so I try to append a alert script.

8. XSS (reflected)

Here I try to run the same script through input.

For Medium level Security

by Capitalizing some of letters in command it doesn’t change the command.

Lab 1:

I use Netcat to get server response header. I create a file nett and edit it with the headers. Then pass the file as a input to netcat with port no and mutillidae IP. Where I see it running of apache/2.4.54

Lab 6:

After Navigating to user-info page I try to add a payload \ in the username field and enter. It cause error in SQL and shows the file causing the error.

Lab 12: