Cyber Security Internship Report
Task 1 : Web Application Security Testing
INTERNSHIP: Future Interns
REPORT BY: Mihir Rathod
Web Application Security Testing Task 1
1 Introduction
This report outlines the activities completed during Task 1 of the SOC Internship, fo-
cused on testing web application security using the Damn Vulnerable Web Application
(DVWA). The goal was to simulate attacks like SQL Injection, XSS, and IDOR in a
controlled environment, identify vulnerabilities, and recommend mitigation strategies.
Testing was conducted on a local DVWA setup installed on Kali Linux. Tools used
included the browser, Burp Suite (for intercepting/modifying requests), and manual pay-
loads.
2 Environment Setup
Operating System: Kali Linux
Steps to Install DVWA
cd /var/www/html
sudo git clone https://github.com/digininja/DVWA.git DVWA
sudo chown -R www-data:www-data /var/www/html/DVWA
sudo chmod -R 755 /var/www/html/DVWA
Database Configuration
sudo mysql -u root
CREATE DATABASE dvwa;
CREATE USER ’dvwa’@’localhost’ IDENTIFIED BY ’dvwa’;
GRANT ALL PRIVILEGES ON dvwa.* TO ’dvwa’@’localhost’;
FLUSH PRIVILEGES;
EXIT;
cd /var/www/html/DVWA/config
sudo cp config.inc.php.dist config.inc.php
Start Services and Access DVWA
sudo service apache2 start
sudo service mysql start
Open browser:
• http://localhost/DVWA/login.php
• Username: admin
• Password: password
Page 1
Web Application Security Testing Task 1
Figure 1: DVWA login page
3 Testing Methodology
1. Recon: Identify input points (ID, forms, comments).
2. Use Burp Suite to intercept and modify requests.
3. Test for SQLi, XSS, and IDOR manually.
4. Capture screenshots and analyze results.
4 Findings
1. IDOR (Insecure Direct Object Reference)
Steps:
• Logged into DVWA.
• Intercepted request with Burp Suite.
• Modified id=1 to id=4.
Page 2
Web Application Security Testing Task 1
Figure 2: Accessing other user’s data using IDOR
Figure 3: Burp Suite Intercept showing modified ID
Page 3
Web Application Security Testing Task 1
Figure 4: Credentials disclosed for different ID
Impact: Unauthorized access to user data due to missing access control checks.
2. SQL Injection (SQLi)
Steps:
• Navigated to SQLi page in DVWA.
• Input: 1 OR 1=1 in User ID field.
• Captured and modified request in Burp Suite.
Figure 5: SQLi Payload Result
Page 4
Web Application Security Testing Task 1
Figure 6: Burp Suite Request with SQL Injection
Result:
ID: 1 OR 1=1
First name: admin
Surname: admin
3. Reflected Cross-Site Scripting (XSS)
Steps:
• Visited vulnerabilities/xss r.
• Injected:
<script>alert(’XSS’)</script>
• Observed JavaScript execution.
Figure 7: Reflected XSS Alert Executed
Page 5
Web Application Security Testing Task 1
4. Stored Cross-Site Scripting (XSS)
Steps:
• Entered same payload in comment field:
<script>alert(’XSS stored’)</script>
• Reloaded the page.
Figure 8: Comment Submission with Stored XSS Payload
Figure 9: Stored XSS Alert on Page Load
5 Mitigations
• Use parameterized queries to prevent SQLi.
• Validate and sanitize all user inputs.
Page 6
Web Application Security Testing Task 1
• Apply proper access control checks for user data.
• Use templating engines that auto-escape HTML.
• Employ Content Security Policy (CSP) to block script execution.
6 Conclusion
The DVWA testing exercise revealed critical vulnerabilities such as SQL Injection, XSS,
and IDOR. These findings represent real-world attack vectors that can lead to serious se-
curity breaches. This task emphasized the need for secure coding, proper input validation,
and layered security controls in web applications.
Page 7
