This repository contains a practical Web Application Vulnerability Assessment and Penetration Testing (VAPT) of the Damn Vulnerable Web Application (DVWA) conducted in an isolated laboratory environment.
The assessment focuses on identifying, validating, documenting, and recommending remediation for common web application vulnerabilities using industry-standard tools and manual testing techniques.
Each vulnerability has been documented independently with detailed findings, supporting evidence, remediation guidance, and client-style assessment reports.
- Identify common web application vulnerabilities
- Analyze HTTP requests and responses
- Validate vulnerabilities through manual testing
- Assess the security impact of identified issues
- Document findings following professional VAPT reporting practices
- Recommend secure coding and mitigation strategies
| Component | Details |
|---|---|
| Target Application | Damn Vulnerable Web Application (DVWA) |
| Operating System | Kali Linux |
| Web Server | Apache |
| Database | MySQL |
| Proxy Tool | Burp Suite Community Edition |
| Browser | Firefox |
| Additional Tools | Netcat |
Tested the application's handling of user-supplied input and demonstrated SQL query manipulation through manual SQL Injection techniques.
Key areas covered:
- SQL Injection validation
- HTTP request analysis using Burp Suite
- Database enumeration
- UNION-based SQL Injection
- Impact assessment and remediation
Assessed whether user-controlled input was reflected without proper output encoding, allowing JavaScript execution within the browser.
Key areas covered:
- Reflected XSS validation
- JavaScript execution
- HTTP request and response analysis
- Impact assessment and remediation
Tested whether user-controlled input could be used to execute operating system commands on the underlying server.
Key areas covered:
- Command injection validation
- HTTP POST request analysis
- Operating system command execution
- Reverse shell demonstration in a controlled lab environment
- Impact assessment and remediation
Assessed the application's file upload functionality and demonstrated the security impact of insufficient validation of uploaded files.
Key areas covered:
- File upload validation testing
- HTTP request interception using Burp Suite
- MIME type manipulation
- Server-side file execution
- Command execution and reverse shell demonstration in a controlled lab environment
- Impact assessment and remediation
- Kali Linux
- Burp Suite Community Edition
- DVWA
- Metasploitable 2
- Metasploit Framework
- Netcat
- Firefox
- Web Application VAPT
- Manual Vulnerability Assessment
- HTTP Request and Response Analysis
- Burp Suite Proxy and Repeater
- SQL Injection Testing
- Reflected XSS Testing
- Command Injection Testing
- File Upload Vulnerability Testing
- Linux Fundamentals
- Vulnerability Documentation and Reporting
- Remediation Recommendations
This assessment was conducted only within an authorized and isolated laboratory environment using intentionally vulnerable applications for educational and cybersecurity training purposes. No unauthorized systems or production environments were targeted.