DVWA Open HTTP Redirect Low Sec - Red Blue Team
This penultimate blog post covers how to execute the Open HTTP Redirect exploit in the DVWA on Low Security. In the Blue Team section I cover how to detect potential Open HTTP Redirect attempts usi...
Shieldia
DVWA Authorisation Bypass Low Sec - Red Team
In this short blog post I cover how to undertake the simple Authorisation Bypass in the DVWA on Low Security. It’s a very simple bypass, however the recon to find the page organically is the key ta...
DVWA JavaScript Low Sec - Red Team
This blog post explains how to decode obfuscated JavaScript in the DVWA on Low Security. I propose a heuristic for when you are presented with unknown code - start from the bottom and work your way...
DVWA CSP Bypass Low Sec - Red Team
In today’s blog post I demonstrate how to execute a Content Security Policy (CSP) Bypass in the DVWA on Low Security. The side channel demonstrates how to execute custom JavaScript for domains with...
DVWA XSS (Stored) Low Sec - Red Purple Team
In this blog post I demonstrate how to undertake Stored Cross-Site Scripting in the DVWA on Low Security and exfiltrate valid session tokens with a simple Python web server. The Purple Team section...
DVWA XSS (Reflected) Low Sec - Red Blue Pruple Team
Today I will demonstrate how to undertake the Reflected Cross-Site Scripting in the DVWA on Low Security. We will do the exploit in the browser first, then I’ve updated the ffuf + Python script to ...
DVWA XSS (DOM) Low Sec - Red Purple Team
This blog post covers how to undertake Cross Site Scripting (XSS) using the Document Object Model (DOM) as an injection point on in the DVWA on Low Security. Since this exploit is fully client side...
DVWA Weak Session IDs Low Sec - Red Team
In today’s short Red Team only post we will look at Weak Session IDs on Low Security. It’s a swift read and simple (Vulnerable) tracking system. Prerequisites If you don’t currently have a Damn Vu...
DVWA SQL Injection Blind Low Sec - Red Blue Purple Team
In today’s blog post I cover all aspects of SQL Injection Blind. You’ll learn how to execute SQL Injection without receiving the returned results with a browser first then moving on to ffuf, a litt...
DVWA SQL Injection Low Sec - Red Blue Purple Team
This blog post covers how to do all aspects of the Structured Query Language Injection - SQL Injection or SQLi. You will use a basic browser to enumerate what parameters are injectable and how to ...