From 4630bdfe635ce3f7ca89bbe550f65cb850168b55 Mon Sep 17 00:00:00 2001 From: adrlsx <35432247+adrlsx@users.noreply.github.com> Date: Wed, 6 Nov 2024 23:54:03 +0100 Subject: [PATCH 1/2] feat: configure DVWA via environment variables --- config/config.inc.php.dist | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/config/config.inc.php.dist b/config/config.inc.php.dist index 7c6e2c3f2..4ebeb5b62 100644 --- a/config/config.inc.php.dist +++ b/config/config.inc.php.dist @@ -5,7 +5,7 @@ # Thanks to @digininja for the fix. # Database management system to use -$DBMS = 'MySQL'; +$DBMS = getenv('DBMS') ?: 'MySQL'; #$DBMS = 'PGSQL'; // Currently disabled # Database variables @@ -16,31 +16,31 @@ $DBMS = 'MySQL'; # See README.md for more information on this. $_DVWA = array(); $_DVWA[ 'db_server' ] = getenv('DB_SERVER') ?: '127.0.0.1'; -$_DVWA[ 'db_database' ] = 'dvwa'; -$_DVWA[ 'db_user' ] = 'dvwa'; -$_DVWA[ 'db_password' ] = 'p@ssw0rd'; -$_DVWA[ 'db_port'] = '3306'; +$_DVWA[ 'db_database' ] = getenv('DB_DATABASE') ?: 'dvwa'; +$_DVWA[ 'db_user' ] = getenv('DB_USER') ?: 'dvwa'; +$_DVWA[ 'db_password' ] = getenv('DB_PASSWORD') ?: 'p@ssw0rd'; +$_DVWA[ 'db_port'] = getenv('DB_PORT') ?: '3306'; # ReCAPTCHA settings # Used for the 'Insecure CAPTCHA' module # You'll need to generate your own keys at: https://www.google.com/recaptcha/admin -$_DVWA[ 'recaptcha_public_key' ] = ''; -$_DVWA[ 'recaptcha_private_key' ] = ''; +$_DVWA[ 'recaptcha_public_key' ] = getenv('RECAPTCHA_PUBLIC_KEY') ?: ''; +$_DVWA[ 'recaptcha_private_key' ] = getenv('RECAPTCHA_PRIVATE_KEY') ?: ''; # Default security level # Default value for the security level with each session. # The default is 'impossible'. You may wish to set this to either 'low', 'medium', 'high' or impossible'. -$_DVWA[ 'default_security_level' ] = 'impossible'; +$_DVWA[ 'default_security_level' ] = getenv('DEFAULT_SECURITY_LEVEL') ?: 'impossible'; # Default locale # Default locale for the help page shown with each session. # The default is 'en'. You may wish to set this to either 'en' or 'zh'. -$_DVWA[ 'default_locale' ] = 'en'; +$_DVWA[ 'default_locale' ] = getenv('DEFAULT_LOCALE') ?: 'en'; # Disable authentication # Some tools don't like working with authentication and passing cookies around # so this setting lets you turn off authentication. -$_DVWA[ 'disable_authentication' ] = false; +$_DVWA[ 'disable_authentication' ] = getenv('DISABLE_AUTHENTICATION') ?: false; define ('MYSQL', 'mysql'); define ('SQLITE', 'sqlite'); @@ -49,7 +49,7 @@ define ('SQLITE', 'sqlite'); # Use this to switch the backend database used in the SQLi and Blind SQLi labs. # This does not affect the backend for any other services, just these two labs. # If you do not understand what this means, do not change it. -$_DVWA['SQLI_DB'] = MYSQL; +$_DVWA['SQLI_DB'] = getenv('SQLI_DB') ?: MYSQL; #$_DVWA['SQLI_DB'] = SQLITE; #$_DVWA['SQLITE_DB'] = 'sqli.db'; From 89054fa25d75f8c8e0abf110c0a6c17edd96a8bf Mon Sep 17 00:00:00 2001 From: adrlsx <35432247+adrlsx@users.noreply.github.com> Date: Wed, 6 Nov 2024 23:54:36 +0100 Subject: [PATCH 2/2] docs: configure DVWA via environment variables --- README.md | 95 ++++++++++++++++++++++++++++++++----------------------- 1 file changed, 56 insertions(+), 39 deletions(-) diff --git a/README.md b/README.md index fc1feff6a..4900ab9b6 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ along with Damn Vulnerable Web Application (DVWA). If not, see _Note: This will be different if you installed DVWA into a different directory._ @@ -333,14 +350,14 @@ Logs can also be accessed from the terminal. 1. Open a terminal and change its working directory to DVWA 2. Show the merged logs - ```shell + ```sh docker compose logs ``` In case you want to export the logs to a file, e.g. `dvwa.log` - ```shell - docker compose logs >dvwa.log + ```sh + docker compose logs > dvwa.log ``` #### I want to run DVWA on a different port @@ -388,7 +405,7 @@ On Linux systems Apache generates two log files by default, `access.log` and `er When submitting error reports, problems, anything like that, please include at least the last five lines from each of these files. On Debian based systems you can get these like this: -``` +```sh tail -n 5 /var/log/apache2/access.log /var/log/apache2/error.log ``` @@ -414,7 +431,7 @@ So after setup, if you try to visit the site and get a `404`, think about where If you see the following when running the setup script it means the username or password in the config file do not match those configured on the database: -``` +```mariadb Database Error #1045: Access denied for user 'notdvwa'@'localhost' (using password: YES). ``` @@ -422,7 +439,7 @@ The error is telling you that you are using the username `notdvwa`. The following error says you have pointed the config file at the wrong database. -``` +```mariadb SQL: Access denied for user 'dvwa'@'localhost' to database 'notdvwa' ``` @@ -432,15 +449,15 @@ The first thing to do is to double check what you think you put in the config fi If it matches what you expect, the next thing to do is to check you can log in as the user on the command line. Assuming you have a database user of `dvwa` and a password of `p@ssw0rd`, run the following command: -``` +```sh mysql -u dvwa -pp@ssw0rd -D dvwa ``` -*Note: There is no space after the -p* +_Note: There is no space after the -p_ If you see the following, the password is correct: -``` +```mariadb Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 14 Server version: 10.3.22-MariaDB-0ubuntu0.19.10.1 Ubuntu 19.10 @@ -456,19 +473,19 @@ As you can connect on the command line, it is likely something wrong in the conf If you see the following, the username or password you are using is wrong. Repeat the [Database Setup](#database-setup) steps and make sure you use the same username and password throughout the process. -``` +```mariadb ERROR 1045 (28000): Access denied for user 'dvwa'@'localhost' (using password: YES) ``` If you get the following, the user credentials are correct but the user does not have access to the database. Again, repeat the setup steps and check the database name you are using. -``` +```mariadb ERROR 1044 (42000): Access denied for user 'dvwa'@'localhost' to database 'dvwa' ``` The final error you could get is this: -``` +```mariadb ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2) ``` @@ -482,7 +499,7 @@ sudo service mysql start An error similar to this one: -``` +```mariadb Fatal error: Uncaught mysqli_sql_exception: Connection refused in /var/sites/dvwa/non-secure/htdocs/dvwa/includes/dvwaPage.inc.php:535 ``` @@ -490,19 +507,19 @@ Means your database server is not running or you've got the wrong IP address in Check this line in the config file to see where the database server is expected to be: -``` +```php $_DVWA[ 'db_server' ] = '127.0.0.1'; ``` Then go to this server and check that it is running. In Linux this can be done with: -``` +```sh systemctl status mariadb.service ``` And you are looking for something like this, the important bit is that it says `active (running)`. -``` +```sh ● mariadb.service - MariaDB 10.5.19 database server Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; preset: enabled) Active: active (running) since Thu 2024-03-14 16:04:25 GMT; 1 week 5 days ago @@ -510,7 +527,7 @@ And you are looking for something like this, the important bit is that it says ` If it is not running, you can start it with: -``` +```sh sudo systemctl stop mariadb.service ``` @@ -522,7 +539,7 @@ In Windows, check the status in the XAMPP console. With the most recent versions of MySQL, PHP can no longer talk to the database in its default configuration. If you try to run the setup script and get the following message it means you have configuration. -``` +```mariadb Database Error #2054: The server requested authentication method unknown to the client. ``` @@ -570,7 +587,7 @@ After all that, the setup process should now work as normal. If you want more information see the following page: . -### Database Error #2002: No such file or directory. +### Database Error #2002: No such file or directory The database server is not running. In a Debian based distro this can be done with: @@ -596,7 +613,7 @@ Apache may not have high enough privileges to run commands on the web server. If You may be running into problems with SELinux. Either disable SELinux or run this command to allow the web server to talk to the database: -``` +```sh setsebool -P httpd_can_network_connect_db 1 ``` @@ -635,7 +652,7 @@ I am not going to cover how to get SQLite3 working with PHP, but it should be a To make the switch, simply edit the config file and add or edit these lines: -``` +```php $_DVWA["SQLI_DB"] = "sqlite"; $_DVWA["SQLITE_DB"] = "sqli.db"; ``` @@ -675,4 +692,4 @@ The app has vulnerabilities, it is deliberate. Most are the well documented ones Project Home: -*Created by the DVWA team* +_Created by the DVWA team_