DVWA Medium Security Attack part 1 : XSS & SQLMap

1. Prepare your lab using metasploitable run from your virtual box, and then try to access dvwa via port 80 at your browser. Use user as admin and password as password

don't forget to set security level to medium scale

 2. Pick XSS reflected for first way.

and try to write <script language="javascript">alert("Dodol")</script> to the box, and submit it.

 ok we succeed...now we try different way..

3. Pick XSS stored for 2nd way

and try to fill <script language="javascript">alert("Dodol")</script> to message box, but due to lack of space permitted we can use firebug (firefox add on) to edit it.

and change value of maxlength="250", now we can write the script into msg box, see how the result

Ooops...we failed right now ;( ...don't worry we try another trick. Now we try to pick the script into name box (not msg box), and for sure edit form script using firebug again.

and then submit it...see the result right now.

allright...bro ^^.

4. Now we can try to get cookie of web, fisrt try to xss reflected. Write this script <script language="javascript">alert(document.cookie)</script>.

and now with same way try to paste script into xss stored (name box).

don't forget to copy the cookie into text editor(geany,kate,kwrite or notepad).

5. Now we want to use SQL injection url path using for sqlmap run.

and run sqlmap

 ok, now we have access for mysql root...and connect to it

to be continued...part 2 ^^