Skip to content

Add files via upload #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
esecdj merged 1 commit into from
Aug 26, 2025
Merged

Add files via upload #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
138 changes: 138 additions & 0 deletions exploits/login.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,138 @@
<?php

define( 'DVWA_WEB_PAGE_TO_ROOT', '' );
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';

dvwaPageStartup( array( ) );

dvwaDatabaseConnect();

if( isset( $_POST[ 'Login' ] ) ) {
// Anti-CSRF
if (array_key_exists ("session_token", $_SESSION)) {
$session_token = $_SESSION[ 'session_token' ];
} else {
$session_token = "";
}

checkToken( $_REQUEST[ 'user_token' ], $session_token, 'login.php' );

$user = $_POST[ 'username' ];
$user = stripslashes( $user );
$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

$pass = $_POST[ 'password' ];
$pass = stripslashes( $pass );
$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass = md5( $pass );

Check notice

Code scanning / SnykCode

Use of Password Hash With Insufficient Computational Effort Note

MD5 hash (used in {0}) is insecure. Consider changing it to a secure hashing algorithm.

$query = ("SELECT table_schema, table_name, create_time
FROM information_schema.tables
WHERE table_schema='{$_DVWA['db_database']}' AND table_name='users'
LIMIT 1");
$result = @mysqli_query($GLOBALS["___mysqli_ston"], $query );
if( mysqli_num_rows( $result ) != 1 ) {
dvwaMessagePush( "First time using DVWA.<br />Need to run 'setup.php'." );
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'setup.php' );
}

$query = "SELECT * FROM `users` WHERE user='$user' AND password='$pass';";
$result = @mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '.<br />Try <a href="setup.php">installing again</a>.</pre>' );

Check warning

Code scanning / SnykCode

Information Exposure Warning

{0} {1} to {2} and is leaked to the attacker. This may disclose important information about the application to an attacker.
if( $result && mysqli_num_rows( $result ) == 1 ) { // Login Successful...
dvwaMessagePush( "You have logged in as '{$user}'" );
dvwaLogin( $user );
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'index.php' );
}

// Login failed
dvwaMessagePush( 'Login failed' );
dvwaRedirect( 'login.php' );
}

$messagesHtml = messagesPopAllToHtml();

Header( 'Cache-Control: no-cache, must-revalidate'); // HTTP/1.1
Header( 'Content-Type: text/html;charset=utf-8' ); // TODO- proper XHTML headers...
Header( 'Expires: Tue, 23 Jun 2009 12:00:00 GMT' ); // Date in the past

// Anti-CSRF
generateSessionToken();

echo "<!DOCTYPE html>

<html lang=\"en-GB\">

<head>

<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" />

<title>Login :: Damn Vulnerable Web Application (DVWA)</title>

<link rel=\"stylesheet\" type=\"text/css\" href=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/css/login.css\" />

</head>

<body>

<div id=\"wrapper\">

<div id=\"header\">

<br />

<p><img src=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/images/login_logo.png\" /></p>

<br />

</div> <!--<div id=\"header\">-->

<div id=\"content\">

<form action=\"login.php\" method=\"post\">

<fieldset>

<label for=\"user\">Username</label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"username\"><br />


<label for=\"pass\">Password</label> <input type=\"password\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"password\"><br />

<br />

<p class=\"submit\"><input type=\"submit\" value=\"Login\" name=\"Login\"></p>

</fieldset>

" . tokenField() . "

</form>

<br />

{$messagesHtml}

<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<!-- <img src=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/images/RandomStorm.png\" /> -->
</div > <!--<div id=\"content\">-->

<div id=\"footer\">

<p>" . dvwaExternalLinkUrlGet( 'https://github.com/digininja/DVWA/', 'Damn Vulnerable Web Application (DVWA)' ) . "</p>

</div> <!--<div id=\"footer\"> -->

</div> <!--<div id=\"wrapper\"> -->

</body>

</html>";

?>
17 changes: 17 additions & 0 deletions exploits/logout.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<?php

define( 'DVWA_WEB_PAGE_TO_ROOT', '' );
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';

dvwaPageStartup( array( ) );

if( !dvwaIsLoggedIn() ) { // The user shouldn't even be on this page
// dvwaMessagePush( "You were not logged in" );
dvwaRedirect( 'login.php' );
}

dvwaLogout();
dvwaMessagePush( "You have logged out" );
dvwaRedirect( 'login.php' );

?>
5 changes: 5 additions & 0 deletions exploits/php.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
; This file attempts to overwrite the original php.ini file. Doesnt always work.

magic_quotes_gpc = Off
allow_url_fopen = on
allow_url_include = on
10 changes: 10 additions & 0 deletions exploits/phpinfo.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
<?php

define( 'DVWA_WEB_PAGE_TO_ROOT', '' );
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';

dvwaPageStartup( array( 'authenticated') );

phpinfo();

?>
Loading