[Day 4] 1. Web App Security Vulnerabilities and Attacks

Vulnerability

A weakness in a system, application, or network that can be exploited by attackers.
Examples: Software bugs, misconfigurations.
Types: Issues in design or code that attackers can exploit to gain access to the system.

Web Application: DVWA

Damn Vulnerable Web Application (DVWA)

Open Source
Developed in PHP
Used for practicing penetration testing.

Setting up DVWA in Kali Linux

Use Bridge Mode (IP: 192.168.100.x)
Accessible from Windows machine
Automatically runs on port 42001

OWASP Top 10

The OWASP Top 10 is a list of the most critical security risks in web applications.

Its goal is to help developers build secure applications by avoiding these vulnerabilities.
Note: While following OWASP guidelines helps, it doesn’t guarantee full security, as hackers continuously find new ways to exploit systems.
Importance: Companies hiring for security roles typically expect knowledge of the OWASP Top 10.

Brute Force Attack

A brute force attack involves trying all possible combinations to guess a password.
Example:

Numbers: 0-9 (10 possibilities)
Alphabets: a-z (26) + A-Z (26) = 52 possibilities
Special Characters: 10 possibilities

Password Strength Calculation

1 character password: 70^1 (70 attempts)
2 character password: 70^2 (4,900 attempts)
3 character password: 70^3 (343,000 attempts)
For a password with 8 characters, the number of attempts would be around 70^8, which is practically impossible to break using brute force.

Prevention

Increase password complexity (e.g., use a mix of characters, numbers, symbols).

Dictionary Attack

A dictionary attack tries a list of common passwords instead of all combinations.
Common types of passwords targeted in dictionary attacks include:

Same digits: 000, 111, 222, etc.
Sequential digits: 123, 234, 345, etc.
Reversed sequences: 098, 987, 876, etc.

These common password lists are widely available on the internet.

Burp Suite

Burp Suite is a man-in-the-middle tool used to intercept, analyze, and manipulate traffic between the client and server.

Used for penetration testing and traffic analysis.
Automated Brute Force Attack: Burp Suite can be used to automate brute force attacks.