A comprehensive penetration testing documentation for DVWA (Damn Vulnerable Web Application), showcasing real-world web application vulnerabilities and their remediation strategies.
This repository contains a detailed penetration testing assessment of DVWA, a deliberately vulnerable web application designed for educational purposes. The report documents the identification, exploitation, and remediation of critical security vulnerabilities commonly found in modern web applications.
Prepared by: Lydia Andenga
Date: August 14, 2026
Classification: Confidential — Educational Lab Report
- Identify and document common web application vulnerabilities
- Demonstrate exploitation techniques for educational purposes
- Provide actionable remediation strategies
- Follow OWASP Testing Guide methodology
- Use CVSS v3.1 scoring for risk assessment
This penetration test identified 8 confirmed vulnerabilities across the DVWA application, ranging from Critical to Medium severity levels. The assessment was conducted in a controlled, isolated lab environment using manual black-box and grey-box testing methodologies.
| # | Vulnerability | Risk Level | CVSS Score |
|---|---|---|---|
| 1 | SQL Injection | Critical | 9.8 |
| 2 | Reflected/Stored Cross-Site Scripting (XSS) | Medium | 6.1 |
| 3 | Cross-Site Request Forgery (CSRF) | High | 8.1 |
| 4 | Unrestricted File Upload | Critical | 9.8 |
| 5 | OS Command Injection | Critical | 9.8 |
| 6 | Broken Authentication (No Lockout/Weak Credentials) | High | 7.5 |
| 7 | Insecure Direct Object Reference (IDOR) | Medium | 6.5 |
| 8 | XML External Entity (XXE) Injection | High | 8.6 |
- Target: DVWA (Damn Vulnerable Web Application) v1.x
- Deployment: Docker container (vulnerables/web-dvwa image)
- Testing Environment: Isolated local network (http://localhost:8080)
- Testing Window: In-progress
- Methodology: Manual testing aligned with OWASP Testing Guide
- Security Levels Tested: Low, Medium, High (as applicable per vulnerability)
- Reconnaissance: Map application functionality and identify potential attack surfaces
- Vulnerability Analysis: Systematically test each OWASP Top 10 vulnerability class
- Exploitation: Confirm vulnerabilities with practical proof-of-concept payloads
- Documentation: Record steps, impacts, and remediation for each finding
- Remediation Guidance: Provide secure coding practices and fixes
- Web Browser (Firefox DevTools)
- Burp Suite Community Edition
- Manual testing and custom payloads
- curl / command-line utilities
- No automated vulnerability scanners used
The detailed report (DVWA_Pentest_Report.md) is organized as follows:
- Executive Summary — High-level overview and risk summary
- Methodology — Testing approach and environment details
- Detailed Findings — In-depth analysis of each vulnerability
- Description & technical background
- Step-by-step reproduction instructions
- Screenshots and proof-of-concept
- Business/security impact
- Remediation strategies
- Risk rating and CVSS v3.1 score
- CWE reference
- Affected component(s)
- Confirmation status
- Payload examples
- Impact assessment
- Remediation recommendations
- SQL Injection — Unauthenticated database access and manipulation
- Unrestricted File Upload — Remote code execution via malicious files
- OS Command Injection — System-level command execution
- CSRF — Unauthorized action execution on behalf of users
- Broken Authentication — Weak credential enforcement and lack of account lockout
- XXE Injection — Server-side request forgery and data exfiltration
- Reflected/Stored XSS — Malicious script execution in user browsers
- IDOR — Unauthorized access to resources via parameter manipulation
Each vulnerability includes:
- Immediate fixes — Quick security patches
- Long-term solutions — Architectural improvements
- Security best practices — Preventive coding patterns
- Validation techniques — Testing to confirm remediation
- OWASP Top 10 2021 — Industry standard web application vulnerabilities
- CVSS v3.1 — Common Vulnerability Scoring System for risk quantification
- CWE — Common Weakness Enumeration classifications
- OWASP Testing Guide — Comprehensive testing methodology
- Review Findings: Start with the Executive Summary for high-level overview
- Deep Dive: Read detailed findings for technical understanding
- Reproduce Vulnerabilities: Follow "Steps to Reproduce" in controlled lab environment
- Implement Fixes: Use remediation guidance to patch vulnerabilities
- Validate: Re-test to confirm vulnerability resolution
- Educational Use Only: This report is intended for learning and authorized security testing
- Isolated Environment: All testing was performed in a disconnected lab environment
- No External Exposure: DVWA was never connected to public networks during testing
- Disclaimer: Unauthorized penetration testing of systems you do not own is illegal
Report Author: Lydia Andenga
Target Application: DVWA (Damn Vulnerable Web Application)
Purpose: Educational penetration testing exercise
Status: In Progress
Last Updated: August 14, 2026
Classification: Confidential — Educational Lab Report