Introduction
  • Introduction
Installation
  • Install XAMPP
  • Install DVWA and Mutillidae
  • Install Burp Suite and Capture traffic
Information Gathering
  • Website information and technologies used
  • Web application subdomains
  • Finding other web applications installed on server
Injection vulnerability
  • Injection, Real breaches
  • SQL injection - Get database, tables and users credentials
  • SQL injection - ByPass checks on login page at low and medium secure levels
  • Command injection vulnerability
Broken Authentication vulnerability
  • Broken Authentication and Real Breaches
  • Logging as Admin by manipulating cookies
  • Username Harvesting
Sensitive Data Exposure
  • Sensitive Data Exposure - Real Breaches
  • Paths Exposed by Robots file and Accounts Exposed
  • Sensitive Information Disclosure
XML External Entities (XXE) vulnerability
  • XML External Entities (XXE) Flaw and Real Breaches
  • XXE Vulnerability Demonstration
Broken Access Control Vulnerability
  • Broken Access Control and Real Breaches
  • Insecure Direct Object Reference (IDOR)
  • Local File Inclusion Flaw
  • Remote File Inclusion Flaw
Security Misconfiguration
  • Security Misconfiguration - Real Breaches
  • Directory Browsing Issue
  • Unrestricted File Upload Issue
Cross-Site Scripting (XSS) & Cross Site Request Forgery (CSRF)
  • XSS Flaw and Real Breaches
  • Persistent and Reflected XSS Demonstration
  • Cross Site Request Forgery (CSRF) Demonstration
Insecure Deserialization
  • Insecure Deserialization Vulnerability
Using Components with Known Vulnerabilities
  • Using Components with Known Vulnerabilities
Insufficient Logging & Monitoring
  • Insufficient Logging & Monitoring
Bonus Section
  • Unvalidated Redirects and Forwards