What you will do
A website asks a database for information with a question written in a language called SQL. If the website pastes what you type straight into that question, you can change the question. This is called SQL injection, and it is one of the most common weaknesses on the web. DVWA lets you do it safely, and then shows you the fix.
The one rule
Warning
This lab runs a website that is insecure on purpose. Attack it, and nothing else. It is your own private copy with no way out to the internet, so nobody else can be affected. Never try these things on a site that is not yours: in the UK that is a crime under the Computer Misuse Act 1990.
Before you start
Note
Press Start the lab on the bar at the top of this lesson and wait until it says it is running. The website opens from the DVWA link on the bar. Each Run button below types its command into your lab's terminal, one after another in the same session. To watch them, or to type your own, press Open terminal on the bar.
1. Check the website is running
The lab bar says the lab is running. Now check the website: this asks for its sign-in page from your terminal, and 200 means it answered.
curl -s -o /dev/null -w "%{http_code}\n" http://dvwa/login.phpShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Sign in
Press the DVWA link on the lab bar and sign in as admin with the password password. In the menu on the left, choose DVWA Security and check it says low.
3. Ask a normal question
In the menu choose SQL Injection. Type 1 in the User ID box and press Submit. The website answers with one user: admin. It built a question like "give me the user whose ID is 1" out of what you typed.
4. Change the question
Now type this in the same box and press Submit:
1' OR '1'='1
The ' ended the website's question early, and OR '1'='1 added a condition that is always true. It now answers with every user: admin, Gordon, Hack, Pablo and Bob. You asked for one and got them all, because the website trusted what you typed.
5. Read the code
Press View Source at the bottom of the page. At low, the code puts your text straight into the question. That is the mistake.
6. See the fix
Choose DVWA Security, set the level to impossible and press Submit. Go back to SQL Injection and type 1: it still answers with admin. Now type the line from step 4: it answers with nothing. Press View Source again. The code checks that the ID is a number. It sends the question and your text separately, so your text can only ever be a value, never part of the question. This is called a parameterised query, and it is how a website stops this attack.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. DVWA has ten more exercises at the same four levels, so the same lab serves a whole unit. Nothing is marked for you: ask for a screenshot of each exercise at low and at impossible and a sentence on what changed. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.