[Day 5] 2. HTTP Redirection and Server Configuration

HTTP Redirect

Steps to Perform an HTTP Redirect in DVWA

Set Security Level to Low
- In DVWA (Damn Vulnerable Web Application), set the security level to low.
Navigate to HTTP Redirect Section
- In DVWA, go to the HTTP Redirect feature.
Manipulate the URL for Redirection
- Edit the URL and append a query string to redirect to another location.
- Example:
```
html
?redirect=https://www.google.com
```
- Replace
```
https://www.google.com
```
  with any target URL to test the redirection behavior.

Managing nginx.conf File

Locate the php.ini file

Use the

locate

command to find all the instances of the

php.ini

file: then make the following changes to make the URL work:

In every file you find using the locate command, change the
```
allow_url_include
```
to
```
On
```
This will allow you to perform the
```
http redirection
```
.

Locate the nginx.conf File

Use the

locate

command to find all instances of the

nginx.conf

file:

bash
locate nginx.conf

Modify the Configuration

Add Lines for Directory Listing
Inside the

location /{}

block in the

nginx.conf

file, add the following lines:

nginx
autoindex on;
allow all;

Update Access Permissions
- Change all instances of
```
deny all
```
  to
```
allow all
```
  within the
```
nginx.conf
```
  files.

Restart Necessary Services

After making the changes, restart the following services to apply the configuration:

bash
sudo service apache2 restart
sudo service php7.x restart  # Replace '7.x' with your PHP version
sudo service nginx restart
sudo service mysql restart   # Or your database service

WebGoat

WebGoat is an intentionally insecure web application designed for learning and practicing web application security. It provides a hands-on environment to test vulnerabilities like SQL Injection, XSS, and more.

Backdoor

A backdoor is a hidden method or vulnerability used by attackers to gain unauthorized access to a system or application. It bypasses normal authentication processes, allowing persistent control over the compromised system.