PENETRATION TEST REPORT

DVWA v1.10 — Internal Network Segment

Target: 5.42.109.211:8000 (Docker / DVWA) Date: 2026-06-27 Engineer: NeuroPentest AI Scanner Classification: CONFIDENTIAL
6
High Risk
2
Medium Risk
3
Low Risk
85
Informational

Executive Summary

A comprehensive penetration test was conducted against the Damn Vulnerable Web Application (DVWA) v1.10 deployed at http://5.42.109.211:8000. The assessment combined automated scanning using OWASP ZAP 2.17.0 with manual vulnerability verification techniques.

Critical Findings

6 HIGH severity vulnerabilities were identified, including SQL Injection, Cross-Site Scripting (Reflected & Stored), OS Command Injection, and Unrestricted File Upload. These vulnerabilities allow complete compromise of the application and potentially the underlying host. Immediate remediation is strongly recommended.

Remediation Support

Each finding below includes step-by-step remediation instructions. The Remediation Intelligence feature on neuro-pentest.ru provides interactive fix recommendations and code examples for all vulnerability types.

Assessment Methodology

1. Reconnaissance

nginx proxy deployment for session injection; ZAP spider crawling of authenticated paths

2. Scanning

OWASP ZAP 2.17.0 active scanning with context-aware authenticated scanning

3. Manual Verification

Python/curl-based exploitation testing confirming all HIGH findings

4. Documentation

Evidence-based finding documentation with CWE, CVSS, and remediation

Tools used: OWASP ZAP 2.17.0 (active + passive scan, spider) · Python 3 requests (manual verification) · curl/bash · nginx reverse proxy · Docker container networking

High Risk Findings (6)

VULN-001  ·  CWE-89 CVSS 9.8

SQL Injection

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/sqli/
VectorGET parameter 'id'
ConfidenceConfirmed
EvidencePayload: id=1' OR '1'='1 — Returns First name: admin, Surname: admin
ReferenceOWASP T1:2021 A03:2021, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The 'id' parameter on the SQL Injection page is vulnerable to UNION-based and boolean-based SQL injection. User input is concatenated directly into an SQL query without sanitization or parameterization. An attacker can extract the entire database contents, including user credentials, session tokens, and application data.

Impact

• Complete authentication bypass
• Database enumeration (users, passwords, tables)
• Potential server compromise via INTO OUTFILE
• Data exfiltration of all application data
Remediation Steps
Primary: Use PHP PDO with prepared statements:
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$id]);

Additional: Apply input validation (whitelist numeric IDs only), use least-privilege DB accounts, enable DB firewall rules.
VULN-002  ·  CWE-89 CVSS 8.5

SQL Injection (Blind)

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/sqli_blind/
VectorGET parameter 'id'
ConfidenceConfirmed
EvidenceDifferential responses to true/false conditions confirm injectable parameter
ReferenceOWASP T1:2021 A03:2021, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Description

The 'id' parameter on the Blind SQL Injection page does not return query results but can be exploited using boolean-based or time-based blind injection techniques. An attacker infers data by observing conditional differences in application responses.

Impact

• Sequential data extraction byte-by-byte
• Database user/privilege enumeration
• Potential command execution via INTO OUTFILE
Remediation Steps
Same as SQL Injection: use prepared statements. Additionally, implement anomaly detection on response timing and error frequency.
VULN-003  ·  CWE-79 CVSS 7.1

Cross-Site Scripting (Reflected)

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/xss_r/
VectorGET parameter 'name'
ConfidenceConfirmed
EvidencePayload: name= — reflected without encoding
ReferenceOWASP T1:2021 A03:2021, CWE-79, CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The 'name' parameter reflects user-supplied input in the HTTP response without HTML encoding. No XSS filters or Content Security Policy are active. An attacker can inject arbitrary JavaScript code into the page.

Impact

• Session cookie theft (alert(document.cookie))
• Page content modification / defacement
• Redirection to phishing pages
• Keylogger installation via injected scripts
Remediation Steps
Primary: Apply context-sensitive output encoding:
htmlspecialchars($name, ENT_QUOTES, 'UTF-8')

Additional: Implement Content-Security-Policy: script-src 'self'; include HttpOnly flag on session cookies.
VULN-004  ·  CWE-79 CVSS 8.8

Cross-Site Scripting (Stored)

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/xss_s/
VectorPOST parameter 'mtxMessage' (guestbook)
ConfidenceConfirmed
EvidenceGuestbook entry with stored and executed on page load
ReferenceOWASP T1:2021 A03:2021, CWE-79, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

The guestbook does not sanitize or encode user input before storing it in the database and rendering it to other users. Every visitor to the page executes the attacker's JavaScript payload automatically.

Impact

• Mass session hijacking (all page visitors)
• Credential theft from all visitors
• Malware distribution via injected scripts
• Persistent defacement
Remediation Steps
Primary: Sanitize input with HTML Purifier library. Use allowlist on permitted HTML tags, remove all script-related tags.

Output: htmlspecialchars() on all echoed user data.

CSP: Content-Security-Policy: default-src 'self'; object-src 'none';
VULN-005  ·  CWE-78 CVSS 9.1

OS Command Injection

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/exec/
VectorGET parameter 'ip'
ConfidenceConfirmed (low confidence in CMDi extent — limited testing)
Evidenceping command accepts shell metacharacters; semicolon-injected commands execute
ReferenceOWASP T1:2021 A03:2021, CWE-78, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

The 'ip' parameter is passed to PHP shell_exec() without sanitization. Shell metacharacters (; | & $ `) are not filtered. Arbitrary OS commands execute with the privileges of the web server user (www-data).

Impact

• Reading arbitrary system files (cat /etc/passwd)
• Reverse shell connection to attacker
• Lateral movement within the network
• Full server compromise
Remediation Steps
Primary: Never pass user input to shell functions. Use PHP proc_open() with argument array (no shell interpretation):
proc_open(['ping', '-c', '1', $ip], ...)

Validate: Regex whitelist for IP addresses: preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $ip)
VULN-006  ·  CWE-434 CVSS 8.8

Unrestricted File Upload

HIGH
URLhttp://5.42.109.211:8000/vulnerabilities/upload/
VectorMultipart POST file upload
ConfidenceConfirmed
EvidencePHP webshell uploaded successfully; returns 'successfully uploaded' message
ReferenceOWASP T1:2021 A04:2021, CWE-434, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

The file upload functionality accepts any file type including executable scripts (.php, .phtml, .phar). Uploaded files are stored in a web-accessible directory without renaming or validation. An attacker can upload and execute a webshell.

Impact

• Remote code execution on server
• Full server compromise (www-data user)
• Access to application database credentials
• Pivot to internal network
Remediation Steps
Primary: Validate file type by checking magic bytes (file signature), not just extension. Store uploads outside the webroot in a non-executable directory.

Rename: Assign random UUID filenames to prevent directory traversal and extension spoofing.

$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $tmpfile);
$allowed = ['image/jpeg', 'image/png', 'image/gif'];

Medium Risk Findings (2)

The following security misconfigurations were identified by OWASP ZAP's passive and active scanners. While not directly exploitable for code execution, they reduce the application's defense-in-depth posture.

PluginID 10038

Content Security Policy (CSP) Header Not Set

MEDIUM
Affected URLs/sitemap.xml
/login.php

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a

Remediation

Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.

PluginID 10020

Missing Anti-clickjacking Header

MEDIUM
Affected URLs/login.php

The response does not protect against 'ClickJacking' attacks. It should include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.

Remediation

Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app. If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementin

Low & Informational Findings (3 Low / 85 Info)

RiskFindingPluginIDAffected Pages
Low Server Leaks Version Information via "Server" HTTP Response Header Field 10036 8 pages
Low In Page Banner Information Leak 10009 1 page
Low X-Content-Type-Options Header Missing 10021 5 pages
Info Authentication Request Identified 10111 /login.php
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/
Info User Agent Fuzzer 10104 /vulnerabilities/sqli/

+ 75 additional informational alerts in full report.

Scope & Tools

Targethttp://5.42.109.211:8000 — DVWA v1.10 (Docker)
ScannerOWASP ZAP 2.17.0 (daemon mode)
Manual ToolsPython 3 + requests library, curl, bash
Authenticationnginx reverse proxy with session cookie injection (PHPSESSID)
Scan Date2026-06-27
Remediationneuro-pentest.ru/remediation
CONFIDENTIALITY NOTICE: This report contains confidential security findings intended solely for the use of the named client. Unauthorized disclosure, copying, or distribution of this report or its contents is strictly prohibited. Generated by the NeuroPentest AI Scanner (neuro-pentest.ru) powered by OWASP ZAP 2.17.0.
NeuroPentest AI Scanner · neuro-pentest.ru · OWASP ZAP 2.17.0 · Report generated: 2026-06-27 19:14 UTC