🛡️ Web Application Database Vulnerability Assessment Guide

---

📌 Summary

This project is a hands-on walkthrough demonstrating how to:

• Build a local vulnerable web application lab
• Identify common web security flaws
• Document findings with evidence
• Apply secure coding fixes
• Harden database access controls
• Publish a professional security project to GitHub

🎯 Topics Covered

• 💉 SQL Injection
• ⚠️ Cross-Site Scripting (XSS)
• 🔐 Cross-Site Request Forgery (CSRF)
• 🗄️ Database Security Hardening
• 📸 Documentation and Evidence Collection
• 🚀 Publishing a Security Project to GitHub

By following this guide, you gain exposure to both:

• Offensive vulnerability identification
• Defensive remediation techniques

---

🧰 PART 1 — Required Software

Install These Tools

Tool	Purpose
XAMPP	Apache / PHP / MySQL local environment
DVWA	Vulnerable application for testing
VS Code	Code editing
Microsoft Word	Final report
Chrome or Firefox	Browser testing
Git	Version control
GitHub	Repository publishing

🔗 Download Links

XAMPP

https://www.apachefriends.org/download.html

DVWA

https://github.com/digininja/DVWA

Visual Studio Code

https://code.visualstudio.com/

Git

https://git-scm.com/downloads

---

📁 PART 2 — Create the Project Folder

Create:

Week6_Databases_Lab_Submission

Inside it create:

Final_Report
Screenshots
Code_Snippets
Database_Logs
GitHub_Upload

Final Structure

Week6_Databases_Lab_Submission
│
├── Final_Report
├── Screenshots
├── Code_Snippets
├── Database_Logs
└── GitHub_Upload

---

⚙️ PART 3 — Install and Start XAMPP

Open:

XAMPP Control Panel

Start:

Apache
MySQL

Both should turn green.

📸 Screenshot 1

Capture:

• Apache running
• MySQL running

Save as:

Screenshot_01_XAMPP_Running.png

---

🧪 PART 4 — Install DVWA

Download DVWA.

Extract ZIP.

Rename folder:

dvwa

Move it to:

C:\xampp\htdocs\

Final path:

C:\xampp\htdocs\dvwa

📸 Screenshot 2

Capture DVWA inside:

htdocs

Save:

Screenshot_02_DVWA_In_HTDOCS.png

---

🛠️ PART 5 — Configure DVWA

Open:

C:\xampp\htdocs\dvwa\config\config.inc.php

Set:

$_DVWA['db_user']='root';
$_DVWA['db_password']='';

Save.

📸 Screenshot 3

Capture configuration changes.

---

🗄️ PART 6 — Create Database

Open:

http://localhost/dvwa/setup.php

Click:

Create / Reset Database

📸 Screenshot 4

Capture successful setup.

---

🔑 PART 7 — Log Into DVWA

Open:

http://localhost/dvwa/login.php

Login:

admin
password

Set security:

Low

📸 Screenshot 5

Capture security setting.

---

💉 PART 8 — SQL Injection Testing

Navigate:

DVWA → SQL Injection

Payload:

1' OR '1'='1

Submit.

Observe multiple records returned.

📸 Screenshot 6

Capture exploit result.

---

🔧 SQL Injection Remediation

Before

$query="SELECT * FROM users WHERE id='$id'";

After

$stmt=$pdo->prepare(
"SELECT * FROM users WHERE user_id=?"
);
$stmt->execute([$id]);

Screenshots

• Screenshot 7 — Vulnerable code
• Screenshot 8 — Remediated code

---

⚠️ PART 9 — Cross-Site Scripting Testing

Navigate:

DVWA → XSS Reflected

Input:

<script>alert('XSS')</script>

Submit.

📸 Screenshot 9

Capture XSS result.

---

🔧 XSS Remediation

Before

echo $_GET['name'];

After

echo htmlspecialchars(
$_GET['name'],
ENT_QUOTES,
'UTF-8'
);

Screenshots:

• Screenshot 10 — Vulnerable code
• Screenshot 11 — Fixed code

---

🔐 PART 10 — CSRF Testing

Navigate:

DVWA → CSRF

Change password:

test123

Submit.

📸 Screenshot 12

Capture result.

---

🔧 CSRF Remediation

if(
!hash_equals(
$_SESSION['csrf_token'],
$_POST['csrf_token']
)
){
die('Invalid CSRF token');
}

Include:

<input type="hidden"
name="csrf_token"
value="<?php echo $_SESSION['csrf_token']; ?>">

Screenshots:

• Screenshot 13 — Vulnerable
• Screenshot 14 — Fixed

---

🗄️ PART 11 — Database Hardening

Open:

http://localhost/phpmyadmin

Run:

CREATE USER 'webuser'@'localhost'
IDENTIFIED BY 'StrongPassword123!';

GRANT SELECT,INSERT,UPDATE
ON dvwa.*
TO 'webuser'@'localhost';

FLUSH PRIVILEGES;

SHOW GRANTS FOR 'webuser'@'localhost';

📸 Screenshot 15

Capture grants output.

Security concepts applied:

• ✅ Least privilege
• ✅ Reduced attack surface
• ✅ Separation of duties

---

📝 PART 12 — Build Final Report

Include:

• Vulnerability Report
• Applied Fixes
• Database Configuration Enhancements
• Screenshots and Logs
• Reflection
• Submission Checklist

Save:

Week6_Databases_Lab_Final_Report.docx

---

🚀 PART 13 — Publish to GitHub

Commands used:

git init
git add .
git commit -m "Add database web application vulnerability assessment"
git branch -M main
git push -u origin main

Repository:

https://github.com/ericsledge/WebApp-Database-Vulnerability-Assessment

---

✅ Final Deliverables

Complete package should contain:

• Final report
• 15 screenshots
• Code snippets
• Database hardening commands
• GitHub repository
• ZIP submission folder

---

🔍 Skills Demonstrated

• Web Application Security Testing
• Vulnerability Analysis
• Secure Coding Practices
• Database Hardening
• Technical Documentation
• Git / GitHub Version Control