Skip to content

@digininja digininja released this Sep 13, 2020

Pastebin are now adding a nosniff header so moved to Hastebin for the low level CSP lab.

Also fixed some broken links.

1 person reacted
Assets 2
  • 2.0
  • 827fdd0
  • Compare
    Choose a tag to compare
    Search for a tag
  • 2.0
  • 827fdd0
  • Compare
    Choose a tag to compare
    Search for a tag

@digininja digininja released this Aug 5, 2020

There hasn't been a release for a very long time, so this one brings the last 5 years together into a big release.

Assets 2

@ethicalhack3r ethicalhack3r released this Oct 5, 2015

  • Added a dedicated objective (or "flag") for file include. (@g0tmi1k)
  • Added a warning to any module that requires a certain configuration. (@g0tmi1k)
  • Added comments to all source code that would be visible via DVWA modules. (@g0tmi1k)
  • Added CSRF token to pre-auth forms (login/setup/security pages). (@g0tmi1k + @Shinkurt)
  • Added HttpOnly cookie flag on impossible levels. (@g0tmi1k)
  • Added more detail to the documentation. (@g0tmi1k)
  • Added PDO to all impossible levels requiring MySQL. (@g0tmi1k)
  • Added PHPIDS options into the config file. (@g0tmi1k)
  • Added system check to setup. (@g0tmi1k)
  • Added various information to all help pages for every module. (@g0tmi1k)
  • Changed brute force medium to be harder due to sleep. (@g0tmi1k)
  • Changed file include landing page + added 3x example pages. (@g0tmi1k)
  • Changed file include medium to be harder due to more filters. (@g0tmi1k)
  • Changed HTTP REFERER check for medium level CSRF. (@g0tmi1k)
  • Changed input box for medium level with SQLi + SQLi Blind. (@g0tmi1k)
  • Changed SQLi + SQLi Blind to be $_POST rather than $_GET. (@g0tmi1k)
  • Changed SQLi Blind to be a real example of the vulnerability. (@g0tmi1k)
  • Fixed brute force and file upload impossible levels, as they were vulnerable. (@g0tmi1k + @Shinkurt)
  • Fixed bug with file fnclude page not loading. (@g0tmi1k)
  • Fixed CAPTCHA bug to read URL parameters on impossible. (@g0tmi1k)
  • Fixed CAPTCHA bug where the form wouldn't be visible. (@g0tmi1k)
  • Fixed CAPTCHA bug where the URL parameters were not being used for low + medium. (@g0tmi1k)
  • Fixed CSRF medium level bug when not on localhost. (@g0tmi1k)
  • Fixed setup bug with custom URL path. (@g0tmi1k)
  • Removed PostgreSQL DB support. (@g0tmi1k)
  • Renamed 'Command Execution' to 'Command Injection'. (@g0tmi1k)
  • Renamed 'high' level to 'impossible' and created new vectors for 'high'. (@g0tmi1k)
  • Updated README and documentation. (@g0tmi1k)
  • Various code cleanups in the core PHP files+CSS. (@g0tmi1k)
  • Various setup improvements (e.g. redirection + limited menu links). (@g0tmi1k)
Assets 2
May 1, 2013
Version 1.0.8