
Explore ethical hacking by pitting Python against DVWA in a penetration test using only Python code, an ID, and a web browser to identify vulnerabilities.
Learn ethical hacking with Python by replicating common security tools, exploiting web vulnerabilities, and defending applications, while exploring OWASP top ten through hands-on labs and practical demonstrations.
Set up a lab with a Windows 10 host attacker and VirtualBox Linux VM victim to practice scripting and automated pen testing in a disconnected environment using Web Security Dojo.
Note: Web Security Dojo image for Virtual Box (Dojo V0.4) was used for this course. It comes with DVWA v1.0.6 pre-installed. If you want to follow along exactly with the course, please consider using this configuration. Other configurations may also work, but know that "your mileage may vary". Docker-based configurations are not recommended as issues have been reported.
Learn a lab structure for ethical hacking that defines test objectives and approaches, replaces tools with Python equivalents, covers the OWASP top ten, and includes a live demonstration.
Analyze http as a request-response model between client and server, covering get and post methods, headers, status codes like 200 and 302, and the roles of cookies, sessions, and https.
Master HTTP GET operations in Python by using the requests library to fetch a target URL, capture the response, and inspect HTML content, headers, and cookies in vulnerable web apps.
Learn to perform a TCP connect port scan with Python sockets to identify open and closed ports, assess the attack surface, and gather reconnaissance data.
Run and compare scripts to collect get headers, options, and cookies, reveal Apache and Ubuntu details, study http status and verbs, and assess disclosure's impact on reconnaissance and pen testing.
Brute force the main DVWA login using username and password lists to assess authentication on a vulnerable PHP web app, highlighting risks when multifactor or captcha is absent.
Develop a Python brute force workflow against Dan Vulnerable Web application by reading usernames and passwords from files, posting to the login PHP page, and validating success via response content.
Programmatically adjust the DVWA security level from high to low with a Python script that authenticates, maintains a session via cookies, and demonstrates session management and potential insecure design risks.
Learn how to use a Python session to log into a vulnerable web app and adjust its security level from high to low, tracking cookies and requests.
Demonstrate how a Python script logs into the Dan Vulnerable Web application and downgrades the security level from high to low within the same session, observing cookie changes.
Python goes up against Damn Vulnerable Web Application - who would win this battle???
What if you had to pentest DVWA - and all your tools were taken away? The only thing you have is Python, and IDE, and browser. How effective could you be?
This course answers those questions as we work through over a dozen different objectives - all designed to pentest DVWA.
Over the next few hours, we're going to have some fun and learn a few things as we approach conducting a penetration test against Damn Vulnerable Web Application. The catch is that we'll be using nothing but Python code we write. No other tools allowed...
After taking this course you'll be able to write console and desktop GUI applications to assist with penetration testing activities.
Best of all - you'll be writing your own scripts that duplicate the functionality of well-known testing tools like:
Nmap
Wireshark
Burp Suite
OWASP ZAP
Metasploit
And more!
Learn to detect and exploit OWASP Top Ten vulnerabilities using only Python!
Insecure Design
Broken Authorization
Injection
Security Misconfiguration
Cryptographic Failures
And more!
Each lesson is designed around a specific test scenario. We describe the approach that will used and walk through the Python code we develop to meet the test objective. Then we put our script into action against DVWA and see the results!
This is a fun exercise to build ethical hacking and Python coding skills:
Excellent for security professionals interested in Python
Equally good for Python professionals interested in security and ethical hacking
Let's answer the age old question - just how vulnerable is Damn Vulnerable Web Application?
DVWA sounds kind of weak. Python sounds strong and scary...like a dangerous animal.
Place your bets on the winner now....