Exploiting Common Web Vulnerabilities
Manually exploit SQL injection and automate it with sqlmap against DVWA, trigger stored XSS and an IDOR/broken-access-control chain in OWASP Juice Shop, and practice turning a scanner alert into a documented, reproducible proof of concept.
Prerequisites: Completion of Web App Vulnerability Scanning; Docker installed; DVWA (vulnerables/web-dvwa) and OWASP Juice Shop (bkimminich/juice-shop) images pulled.
Targeted versions: Verified against sqlmap's PyPI release history (1.10.7 was current as of July 2026, part of the actively maintained 1.10.x line — check sqlmap --version and update with sqlmap --update before starting) and the OWASP Top 10:2025 category set referenced in the previous project. DVWA (Damn Vulnerable Web Application) remains a maintained, standard PHP/MySQL training target distributed as the vulnerables/web-dvwa Docker image, with three selectable difficulty levels (Low/Medium/High) per vulnerability class and a built-in source-code viewer — this project uses Low security throughout so the underlying vulnerable code is visible alongside the exploit.
The previous project ended on a deliberately uncomfortable note: a scanner alert is a hypothesis, not proof. A real pentest finding needs a reproducible proof of concept — specific input, specific request, specific observable result — because that's what turns "the scanner flagged this" into something a development team can actually verify and fix. This project builds four of those proofs of concept by hand: SQL injection (manual, then automated with sqlmap), stored XSS, and an IDOR chain, all against intentionally vulnerable, learner-controlled targets.
Test what you just learned
Self-testing is one of the best ways to retain new skills. Unlock project quizzes to check your understanding.
Log in to unlock0 / 7 complete