Kali Linux Web Penetration Testing Cookbook - Second Edition

How to do it...

Let's raise the bar a little bit by adding some protections to the vulnerable page: log into DVWA, go to DVWA Security, and set the security level to Medium. Now we can start testing:

1. First, let's try to upload our file. In DVWA, go to Upload and try to upload webshell.php:

So, there is a validation of what we can upload, and the file needs to be an image; we will need to bypass this protection in order to upload our webshell.

2. An easy way to avoid the validation is to rename our PHP file with a valid extension. But this would cause the server and browser to treat it like an image, and the code wouldn't execute. Instead, ...