DVWA ( Dam Vulnerable Web Application ) DVWA 是用 PHP + Mysql 編寫的一套用於常規
WEB 漏洞教學和檢測的WEB脆弱性測試程序。包含了 SQL 注入、 XSS 、盲注等常見的一些安全漏洞。Kali
已自帶了平臺所需的環境，所以搭建非常簡單。
配置環境
開啓 MySQL
service mysql start關閉Apache
service apache2 stop運行 mysql -u root 連接 MySQL 並設置 MySQL root 密碼
MariaDB [(none)]> use mysql \\使用數據庫 mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [mysql]> update user set password=PASSWORD('xxxxxx') where User='root'; \\更改 root 密碼爲 xxxxxx
Query OK, 4 rows affected (0.00 sec)
Rows matched: 4 Changed: 4 Warnings: 0
MariaDB [mysql]> flush privileges; \\刷新 MySQL 的系統權限相關表
Query OK, 0 rows affected (0.00 sec)
MariaDB [mysql]> create database dvwa; \\創建數據庫 dvwa
Query OK, 1 row affected (0.00 sec)
由於 Kali Linux 下 MySQL 默認是使用 MariaDB, 所以無法使用 root 用戶連接 mysql 必須創建一個新的用戶用於連接使用, 根據需要可以賦予 root 權限.
MariaDB [mysql]> grant all on dvwa.* to dvwa@localhost identified by 'password';注意: 新用戶(dvwa)的密碼(password)最好不要爲空!
配置 PHP
1.更新源
執行命令：sudo gedit /etc/apt/source.list，然後把下面的內容複製到source.list
#aliyun 阿里雲
deb http://mirrors.aliyun.com/kali kali-rolling main non-free contrib
deb-src http://mirrors.aliyun.com/kali kali-rolling main non-free contrib
# ustc 中科大
deb http://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib
deb-src http://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib
#deb http://mirrors.ustc.edu.cn/kali-security kali-current/updates main contrib non-free
#deb-src http://mirrors.ustc.edu.cn/kali-security kali-current/updates main contrib non-free
# kali 官方源
deb http://http.kali.org/kali kali-rolling main non-free contrib
deb-src http://http.kali.org/kali kali-rolling main non-free contrib執行命令：sudo apt-get update
GD 支持
apt-get install php7.0-gd --fix-missing編輯 /etc/php/7.0/apache2/php.ini 修改 824 行 allow_url_include = Off 爲 allow_url_include = On;然後Ctrl+F找到extension=，將extension=gd2前的分號去掉，讓php開啓gd2庫
vim /etc/php/7.0/apache2/php.ini修改網站配置文件
mv config.inc.php.dist config.inc.php編緝dvwa/config/config.inc.php
$_DVWA[ 'db_user' ] = 'dvwa';
$_DVWA[ 'db_password' ] = 'password';
$_DVWA[ 'recaptcha_public_key' ] = '6LdK7xITAAzzAAJQTfL7fu6I-0aPl8KHHieAT_yJg';
$_DVWA[ 'recaptcha_private_key' ] = '6LdK7xITAzzAAL_uw9YXVUOPoIHPZLfw2K1n5NVQ';
$_DVWA[ 'default_security_level' ] = 'low';開啓 Apache
service apache2 start下載 配置 DVWA
下載
wget https://github.com/ethicalhack3r/DVWA/archive/master.zip配置
mv master.zip /var/www/html
cd /var/www/html
unzip master.zip
mv DVWA-master dvwa
chown www-data:www-data /var/www/html/dvwa/hackable/uploads
chown www-data:www-data /var/www/html/dvwa/external/phpids/0.6/lib/IDS/tmp/phpids_log.txt
dvwa文件夾提權
chmod -R 777 /var/www/html/dvwa打開瀏覽器輸入 ip/dvwa/setup.php 如本機 127.0.0.1/dvwa/setup.php
點擊 Create/Reset Database
輸入Username admin Password password 登錄
