Skip to content
hands-on lab

OWASP Exercises: Command Execution

Difficulty: Intermediate
Duration: Up to 1 hour
Students: 795
Rating: 3.9/5
Start lab
On average, students complete this lab in10m
Get guided in a real environmentPractice with a step-by-step scenario in a real, provisioned environment.
Learn and validateUse validations to check your solutions every step of the way.
See resultsTrack your knowledge and monitor your progress.
About
Author

Description

Operating system commands shouldn't be allowed using a web application that resides on a server. Sometimes, web applications are not as safe as they should be, and let users perform disallowed commands in an unexpected way.

In this lab, you will attempt a command execution attack through the DVWA (Damn Vulnerable Web Application) website to force the web server to execute operating system commands to read and display the contents of files and documents that reside outside of the web server's root hosting directory, and which normally should not be accessible from the web.

Learning Objectives

Upon completion of this lab you will be able to:

  • Manage the security level of a DVWA application in order to set it up to your requirements
  • Perform a Command Execution attack from a DVWA application

Intended Audience

This lab is intended for:

  • Individuals who want to learn how to execute command execution attacks
  • Security engineers who want to understand how to better protect their applications from command execution attacks
  • People who want to know how a command execution attack can be performed

Prerequisites

This lab has no prerequisites.

Updates

September 21st, 2021 - Updated HyperV VMs to not used save state to avoid an issue with Azure VMs in the same SKU not all having the same processor features

September 7th, 2021 - Upgraded underlying disk, and Kali Hyper-V VM configuration for improved performance

August 30th, 2021 - Include Remote Desktop connection details for those preferring to use their local Remote Desktop client to connect

July 9th, 2020 - Enabled direct browser RDP connection for a streamlined experience

Environment before

Environment after

Covered topics

Security attacks
Security
Hands-on Lab UUID

Lab steps

0 of 3 steps completed.Use arrow keys to navigate between steps. Press Enter to go to a step if available.
  1. Load the Virtual Machines (Kali & Metasploitable)
  2. Navigate to the DVWA website
  3. Conduct the Command Execution attack

Lab Rules