Тёмная
PENETRATION TEST REPORT

DVWA v1.10 — Internal Network Segment

Target: 5.42.109.211:8000 (Docker / DVWA) Date: 2026-06-27 Engineer: NeuroPentest AI Scanner Classification: CONFIDENTIAL
6
High Risk
2
Medium Risk
3
Low Risk
85
Informational

Executive Summary

A comprehensive penetration test was conducted against the Damn Vulnerable Web Application (DVWA) v1.10 deployed at http://5.42.109.211:8000. The assessment combined automated scanning using OWASP ZAP 2.17.0 with manual vulnerability verification techniques.

Critical Findings

6 HIGH severity vulnerabilities were identified, including SQL Injection, Cross-Site Scripting (Reflected & Stored), OS Command Injection, and Unrestricted File Upload. These vulnerabilities allow complete compromise of the application and potentially the underlying host. Immediate remediation is strongly recommended.

Remediation Support

Each finding below includes step-by-step remediation instructions. The Remediation Intelligence feature on neuro-pentest.ru provides interactive fix recommendations and code examples for all vulnerability types.

Assessment Methodology

1. Reconnaissance

nginx proxy deployment for session injection; ZAP spider crawling of authenticated paths

2. Scanning

OWASP ZAP 2.17.0 active scanning with context-aware authenticated scanning

3. Manual Verification

Python/curl-based exploitation testing confirming all HIGH findings

4. Documentation

Evidence-based finding documentation with CWE, CVSS, and remediation

Tools used: OWASP ZAP 2.17.0 (active + passive scan, spider) · Python 3 requests (manual verification) · curl/bash · nginx reverse proxy · Docker container networking

High Risk Findings (6)

VULN-001  ·  CWE-89 CVSS 9.8

SQL Injection

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/sqli/
VectorGET parameter 'id'
ConfidenceConfirmed
EvidencePayload: id=1' OR '1'='1 — Returns First name: admin, Surname: admin
ReferenceOWASP T1:2021 A03:2021, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The 'id' parameter on the SQL Injection page is vulnerable to UNION-based and boolean-based SQL injection. User input is concatenated directly into an SQL query without sanitization or parameterization. An attacker can extract the entire database contents, including user credentials, session tokens, and application data.

Impact

• Complete authentication bypass
• Database enumeration (users, passwords, tables)
• Potential server compromise via INTO OUTFILE
• Data exfiltration of all application data
Remediation Steps
Primary: Use PHP PDO with prepared statements:
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$id]);

Additional: Apply input validation (whitelist numeric IDs only), use least-privilege DB accounts, enable DB firewall rules.
VULN-002  ·  CWE-89 CVSS 8.5

SQL Injection (Blind)

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/sqli_blind/
VectorGET parameter 'id'
ConfidenceConfirmed
EvidenceDifferential responses to true/false conditions confirm injectable parameter
ReferenceOWASP T1:2021 A03:2021, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

The 'id' parameter on the Blind SQL Injection page does not return query results but can be exploited using boolean-based or time-based blind injection techniques. An attacker infers data by observing conditional differences in application responses.

Impact

• Sequential data extraction byte-by-byte
• Database user/privilege enumeration
• Potential command execution via INTO OUTFILE
Remediation Steps
Same as SQL Injection: use prepared statements. Additionally, implement anomaly detection on response timing and error frequency.
VULN-003  ·  CWE-79 CVSS 7.1

Cross-Site Scripting (Reflected)

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/xss_r/
VectorGET parameter 'name'
ConfidenceConfirmed
EvidencePayload: name= — reflected without encoding
ReferenceOWASP T1:2021 A03:2021, CWE-79, CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The 'name' parameter reflects user-supplied input in the HTTP response without HTML encoding. No XSS filters or Content Security Policy are active. An attacker can inject arbitrary JavaScript code into the page.

Impact

• Session cookie theft (alert(document.cookie))
• Page content modification / defacement
• Redirection to phishing pages
• Keylogger installation via injected scripts
Remediation Steps
Primary: Apply context-sensitive output encoding:
htmlspecialchars($name, ENT_QUOTES, 'UTF-8')

Additional: Implement Content-Security-Policy: script-src 'self'; include HttpOnly flag on session cookies.
VULN-004  ·  CWE-79 CVSS 8.8

Cross-Site Scripting (Stored)

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/xss_s/
VectorPOST parameter 'mtxMessage' (guestbook)
ConfidenceConfirmed
EvidenceGuestbook entry with