Practical 14 — DVWA Tool

Aim
Explore common web vulnerabilities in Damn Vulnerable Web Application (DVWA) in a local lab.

STEPS
1. Start DVWA locally and set the assigned lab security level.
2. Use the relevant DVWA module to observe SQL Injection, Blind SQL Injection, DOM-based XSS, File Upload and CSRF.
3. Record the input, application response and why the behavior indicates a vulnerability.
4. Reset the lab and restore settings after testing.

Concepts
- SQL injection: untrusted input alters a database query.
- Blind SQL injection: infer results from true/false responses.
- DOM XSS: client-side script inserts untrusted input into the page.
- File upload: weak validation may allow unexpected files.
- CSRF: a user's authenticated browser is tricked into making an unwanted request.

Safety: Run DVWA locally or in an authorized isolated lab only. Do not test real websites or use payloads to access others' data.
