Installing DVWA in Kali Linux

hi my name's robin wood and i'm the current maintainer of dvwa damn thundable web app up until this point i've always avoided making videos for installing my tools and applications mostly because you can guarantee five minutes after making the video suddenly will change os or application change and parts of the video will become invalid but recently quite a lot of people have been asking for a video for dvwa so i've finally given in and this is it the video is going to walk through getting dvwa working in cali that's running in virtualbox similar technique should work in similar operating systems but for now i'm going to go through the most basic option which is cali full install of it and running in virtualbox so you don't have to do it on bare hardware version i'm installing it on if we go to the kali site virtual machines and it's this 64-bit virtual box so what i'm saying will probably also work in vmware and other versions but this is the one i'm using so i've downloaded this and got it installed i haven't done any other updates to the system yet so this is just a bare install so the first thing we're going to do is we're going to go to the dvwa github repo now this is the only version that i support uh there are various versions out there people made docker containers and all sorts of other packages come with different os's i know this version and i know how it installs how it works therefore this is the version i support if you want to install from a package on some other os go for it but you won't be getting get much support because package maintainers can make changes and it's really hard to look after and debug problems that other people have created so if you want support this is the one to to use so what we'll do we grab the code from here and let's clone the repo now we've got that cloned we need to move into the apache document route this version of kali comes with the patch installed so we have to worry about installing it all we need to do is move the uwa into the document root we need sudo on this because rww html is a protected directory you can't access it with the standard cali user default password for this is cali there we go so if we now do go change its directory document route we'll see we've got a dvwa directory inside it let's have a quick look over here if we go little host what we should see is uh nothing's working we're not we can't connect that's because the apache web server doesn't run by default so sudo service apache apache to start and that will start the apache web server come back over here try again yeah well start up it's gone for some reason it's default to https let's strip that back down to http and there we go so we've now got our apache 2 default web page this is what you'd expect when you look in the root directory we've put dvwa in its own directory notice it's capitalized apache is case sensitive let's have a look there slash dvwa and we getting an error config file not found copy the config ink php dist to config inch p ink php so that's we're stripping off the disk reason this is done is we distribute a sample config file in the dist file name and you need to copy it to your standard files dot php and set your own make your own changes to it that prevents people accidentally trying to commit their changes with their database passwords and other things in it into the git repo if you're not sure how to do copying and stuff like that if we go into here and we scroll down and there's the instructions for it so what we're going to do as it says we're going to copy config the dist file to with the php extension you could move it as well if you want to but copying is best so you've got a backup of the file let's see dvwa so we're going to config file we can see our dist version of the file and we copy it to there now what we do is have a quick check of that file and if we make this bit bigger we can see it comes with standard defaults main things you need to worry about during a basic install is the database credentials database server will be localhost database name dvwa user again dbwa and fairly weak password let's leave that there for a minute we come back over to dwa and we refresh this we'll start to get errors let's go back let's try setup and this is where most people end up we get to this don't worry about these red bits for a minute let's try to create the database again we're getting errors reason for this is the database server isn't running yet so come out here we'll quit this and let's get the database server running that should be done with the pseudo but the the os problems anyway so we now started the database server let's go back if we look at the setup and work through the setup we can ignore a little bit of this for now we'll come back to linux packages in a minute what this is telling us is do the config change which we've done these are the defaults database credentials so now we need to create the database and create the user for it so what i'm going to do is i'm going to put up a new shell i'm going to do this in a very deliberate way so become root and back back over here i want to bring up my database credentials let's start mysql now even though it's called mariadb um historically this was fought for mysql if you're interested in that go do your research um but we're now in the uh radio b client console and we're not connected to a database we're just in as root notice we are going in as root and there's no password by default go over here we've got all the instructions we need we're just going to do some copy pasting create the database something to look out for we're doing all these commands check for errors so query okay one row affected it worked if we made a typo in here put some stuff in you you're not getting an error you're not getting a good response so always check that you get good messages back so there we go again we've got an error if we've maybe spelt create wrong oh let's get rid of that there we go okay we've got create wrong we've got errors so always look when it works it tells you it's worked it says okay when it fails it gives you an error if you get an error don't just press on look through the error work out what it is work out what it's trying to tell you the vast majority of uh issues tickets i get raised are people who have pushed through things like this there's been errors and they've just carried on regardless so if you get an error stop look at it work out what you've done wrong it's quite often a typo so next thing we're going to do we're going to create our user now just before i hit enter on this we'll notice create user the username dvwa and the password is there p at's word come back over here and we're going to check then match these credentials in here dvwa and the password this password and this username have to match what you put in here similarly the database name is one we just created up here with the create database if these don't match it will fail you will get errors so again make sure all this works so we're creating a user dvwa at load host identified by let's make that a bit bigger it's not going to expand but i don't find my password and again query okay it worked next line this is giving the dva dva user permission to do whatever it wants to on the dvwa database okay the last thing we need to do is flush privileges what this does is it tells the database server to reload its authentication database and various other bits the privileged privilege model if you don't do this last step your new user that you've created won't have access to the system because the system doesn't know about it it's not reloaded it's used database yet so before i close this up create yet another shell and we're going to test our user so to do this mysql dash u specifies the user we're going to net use and we're going to choose gvwa and we're going to say dash p and that tells it we're going to provide a password if we don't put anything like online it will ask it for ask us for it so i'm going to do that i'm going to come over here and i'm going to copy that and make sure don't get that rogue send me a quote at the end come on we can catch this so we're going to copy that we're going to come over here and paste it i think i typed it wrong let's try something a little different because copying out of them is never easy that's better copy selection paste selection what we're doing now i'm just going to put it on this command line if you do if you want to pass on the command line dash p then no space very important no space there on the password so we can do that and there we go we're in we can use dbwa and that lets us change into the dvwa database so we've proved it works i'll just show you that dash p and go over here paste selection and there we go you can do that without putting on command line if when you raise a ticket for an issue i think the problem is with the database username and password what i will ask for is a screenshot showing this with a password on the command line so make sure there's no space if you've got funky passwords with certain special characters in you might you may need to start escaping them or use quotes but if using the default one just as it is and i'll also want screenshots of this to show that the password that you're giving it and the username match what's in here again common mistake is some you'll change password in here and then when they create the user they'll give it a different password or they'll change they'll decide the database user should be fred and they'll create a user over here called wilmer and they'll try and log in down here with bam bam it's it's a standard thing so as long as you make sure all these tie up to what you create over here and then check you can log into it on command line everything should be working so now if we come back up to here and go back to setup page we get our working setup page for now don't worry about the reds uh we're just going to see what happens when we're going to create the database run that oh there we go database created users created guestbook was created and we're going to redirect to the login page default credentials admin and password and there we go here we go we're in and that is it you have now got the most basic version of dvwa don't set up installed and working if you want to stop there that's fine the vast majority of the the features will be working for you and uh and you can get in and do some testing let's just check it we're starting security level impossible let's drop our level down to low sql injection that works throw a single quote in there and we should start getting errors things break so i'll leave that up to you to then work out what you can do with that but that's deliberate there that is a deliberate error if you want to go a step further with this and you look at setup page you say oh i don't like these these red bits red bits worry me we can we can work through we can clear those up right so the first one in the php function allow url include is disabled so let's enable that to do that become root uh we're looking the etc php directory in here we're going to 8.1 again this is where things will change uh new version of php comes out you'll get 8.2 change the 8.2 directory yeah this is where common sense starts to come in you've got to use the the version that's appropriate for um for the current day so we're running apache 2 and we need to edit the php.ini file and what we're looking for is allow url include then we've got allow url f open which is there that's enabled yes it is uh low url include is not so let's turn that on if you're not a vim user i'm sure the box probably has got nano it has i'm not a nano user so i like vim strongly suggest if you want to get into any kind of linux admin work you learn vim it will make your life a lot easier in the long run so we've done that thing we need to do now apache ctl restart i'll restart apache to um to activate the changes you've just made you can ignore this warning here about server name directive if you want to fix that again i'll let you research apache it's a fairly easy fix come back over here reload that's enabled next one php module gd again this is another thing you get tickets raised for this is only required if you want to play with i think it's either one or maybe two of the capture labs so for the vast majority of people this is completely irrelevant you can completely ignore it if you want to ins if you want to fix that get rid of the red where to do that act install php gd now this will fail if you do this by default open the box on a fresh install if kali will install it will fail what you need to do first is apt update what that does it goes off to the cali servers and it pulls down a list of all the packages so we'll give that a minute and at the end of it your output will slightly differ to mine depending on what's been updated but now we should be able to do our apt install phpgd there we go do we want to do it yeah we do i will come down phpgd is now installed restart apache i think it's probably restarts apache for you automatically but i like to do it anyway by hand gd is installed recapture key that is beyond this video you need to go off to google register for recapped keys and add them fairly simple process it is covered in the uh in the readme file if you want to do that next bit writeable folder this directory is not writable two ways to fix this the correct way or the the lazy way the correct way is to use proper linux permissions the web server is running as the www data user if we look at the directory uploads you'll see that's currently owned by the cali user so in a pro in a good world what you would do is you can shown which is change ownership of change ownership to www data to this direct oops no not that to this directory and now if we do an ls the directory is now owned by um the www www data user and so it's got right access to it refresh that and it's writable the other slightly lazy way of doing it chmod 777 on the directory um that works it's just not not quite as as smooth an option but it does work next one writeable file and we're going to do exactly the same without this is the php ids log so we're going to shown that file come back there we go we've now got another folder that's writable this one here our config folder is where we put the config file and the reason this wants to be writable we have a look in that folder we've got a config and a config disk when we run the setup as part of the setup process it will create a backup of the config file this is a deliberate vulnerability in the app and um yeah it lets you find backup files that shouldn't be there but are so again reload okay and there we go so we fixed all of these capture key i will leave to you to sort out if you really want it if you want to play with captures and we've fixed all the rest of it setup's done everything's working let's have a quick look at reflected xss what's your name robin and i've got to find the quote key on this keyboard because it's not set up for the uk and we get some injection there again i'll leave working that one out as uh as an option for you so that's it i hope you found this useful and it gives you a proper working dvwa install if you've had any problems with it let me know but please when you're setting things up run your commands read for error messages if you see an error do some research first don't just paste the error this doesn't work fix it for me do your own research read up on it and treat it as a learning process if you can learn everything there is about how to get this installed when you actually come to test web apps your understanding of the underlying part of the web app will be much better and your testing will be better okay so hope you enjoyed it and uh bye bye

Channel: Robin Wood

Views: 62,990

Keywords:

Id: WkyDxNJkgQ4

Length: 23min 50sec (1430 seconds)

Published: Fri Sep 16 2022