Hướng Dẫn Thực Hành - (How to Install DVWA in Fedora : Lesson 1)

DVWA là hệ thống lab dùng cho việc nghiên cứu các lỗi bảo mật thông dụng của ứng dụng web, trong bài hướng dẫn sau đây chúng ta sẽ cài đặt DVWA trên một máy Linux dùng Fedora 14. Ngoài việc cài đặt để hiểu rõ hơn về DVWA các bạn có thể tải về các bản dựng sản để thực hành trên máy ảo mà không cần phải cài đặt, hoặc cài đặt trên máy chạy hệ điều hành Windows (cài thêm bộ ứng dụng AppServer là được).

• What is Damn Vulnerable Web App (DVWA)?
  • Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.
  • Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
• Pre-Requisite Lab
  • Fedora: Lesson 1: Installing Fedora 14
    • Note: Only required if you don't already have a Fedora instance.
• Lab Notes
  • In this lab we will do the following:
    1. Install Apache Webserver
    2. Install Mysql Server
    3. Install PHP
    4. Install and Configure DVWA

• Legal Disclaimer
  
   Bài lab chỉ dùng cho mục đích học tập.

Section 1. Configure Fedora14 Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click on the OK Button.
• 

Section 2. Login to Fedora14

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14
     3. Play virtual machine
   • 
2. Login to Fedora14
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

Section 3. Open Console Terminal and Retrieve IP Address

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 
2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 
3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.116.
     • Please record your IP address.
   • 

Section 4. Install Apache httpd Server

1. Download httpd
   • Instructions:
     1. yum install httpd.i686
     2. y
   • 
2. Start Apache
   • Instructions:
     1. service httpd start
        • This starts up the Apache Listening Daemon
     2. ps -eaf | grep httpd
        • Check to make sure Apache is running.
     3. chkconfig --level 2345 httpd on
        • Create Start up script for run levels 2, 3, 4 and 5.
   • 
3. Configure Firewall
   • Instructions:
     1. System --> Administration --> Firewall
   • 
4. Firewall Configuration Startup
   • Instructions:
     1. Click the Close button
   • 
5. Authenticate
   • Instructions:
     1. Supply the root password
     2. Click Authenticate
   • 
6. Turn On WWW
   • Instructions:
     1. Click the WWW Check Box
     2. Click the Apply Button
   • 
7. Override Settings
   • Instructions:
     1. Click Yes
   • 

Section 5. Install mysql and mysql-server

1. Install mysql
   • Instructions:
     1. yum install mysql.i686
     2. Continue to next step
   • 
2. Install mysql
   • Instructions:
     1. y
   • 
3. Install mysql-server
   • Instructions:
     1. yum install mysql-server
     2. y
   • 
4. Start Up mysqld
   • Instructions:
     1. service mysqld start
   • 
5. Start Up mysqld
   • Instructions:
     1. chkconfig --level 2345 mysqld on
        • Creates the start up scripts for run level 2, 3, 4 and 5.
     2. mysqladmin -u root password dvwaPASSWORD
        • Sets the mysql root password to "dvwaPASSWORD"
   • 
6. Login to mysql and create dvwa database
   • Instructions:
     1. mysql -uroot -p
     2. dvwaPASSWORD
     3. create database dvwa;
     4. quit
   • 

Section 6. Install PHP

1. Install PHP
   • Instructions:
     1. yum install php.i686
     2. y
   • 
2. Install php-mysql
   • Instructions:
     1. yum install php-mysql
     2. y
   • 
3. Install php-pear
   • Instructions:
     1. yum install php-pear php-pear-DB
     2. y
   • 

Section 7. Install wget

1. Install wget
   • Instructions:
     1. yum install wget
     2. y
   • 

Section 8. Install Damn Vulnerable Web App (DVWA)

1. Download DVWA
   • Note(FYI):
     • DVWA-1.0.7.zip is an older version.  ComputerSecurityStudent provides this zip file, since it is no longer available at google source.
     • The most recent version can be found at http://www.dvwa.co.uk/
   • Instructions:
     1. cd /var/www/html
     2. wget http://www.computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson1/DVWA-1.0.7.zip
        • Grab the DVWA-1.0.7 application.
        • Remember to down the zip file from computersecuritystudent and not googlecode.
     3. ls -l | grep DVWA
        • Confirm DVWA-1.0.7.zip was downloaded
   • 
2. Unzip Package
   • Instructions:
     1. unzip DVWA-1.0.7.zip
   • 
    
3. Remove Zip File
   • Instructions:
     1. ls -lrta
     2. rm DVWA-1.0.7.zip
     3. y
   • 
4. Configure config.inc.php  
   • Instructions:
     1. cd /var/www/html/dvwa/config
        • This is the configuration directory for DVWA.
     2. cp config.inc.php config.inc.php.BKP
        • Make Backup copy
     3. chmod 000 config.inc.php.BKP
        • Remove Permissions to the Backup Copy
     4. vi config.inc.php
        • This is the configuration file for DVWA that handles the database communication from the Web App.
   • 
5. Configure config.inc.php  
   • Instructions:
     1. Arrow down to the line that contains db_password
     2. Arrow right and place your cursor on the second single quote
     3. Press "i"
        • This puts the vi editor into INSERT mode.
     4. Type "dvwaPASSWORD"
     5. Press <Esc>
        • This takes the vi editor out of INSERT mode.
     6. Type ":wq!"
        • This save the config.inc.php file.
   • 
6. Restart Apache
   • Instructions:
     1. service httpd restart
        • Restart Apache
     2. ps -eaf | grep -v grep | grep httpd
        • Make sure Apache is running.
   • 
7. Start up a Web Browser  
   • Instructions:
     1. Applications --> Internet --> Firefox
   • Notes:
     • At this point, you can start up a web browser on any computer on your network (Windows, Mac, Whatever you want).
   • 
8. DVWA Database setup  
   • Instructions:
     1. http://192.168.1.116/dvwa/setup.php
        • Replace 192.168.1.116 with the IP Address obtained from Section 3, Step 3.
     2. Click the Create / Reset Database button
   • 
9. DVWA Creation Messages  
   • Instructions:
     1. You should see the below database created, data inserted, and setup successful messages.
     2. Click on Logout
   • 
10. Login to DVWA  
    • Instructions:
      1. Username: admin
      2. Password: password
    • 
11. Welcome to DVWA  
    • Informational (FYI):
      1. Click Here for subsequent lessons.
    • 

Section 9. Proof of Lab

1. Proof of Lab
   • Instructions:
     1. echo "select user,password from dvwa.users;" | mysql -uroot -pdvwaPASSWORD
     2. date
     3. echo "An Toàn Thông Tin"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "EDU VN"
   • Proof of Lab Instructions:
     1. Do a PrtScn
     2. Paste into a word document
     3. Email to AnToanThongTin.Edu.VN@Gmail.Com
   •