Web Attack Simulation Lab Using Kali Linux, DVWA, Wireshark, and Burp Suite

Lab Focus:

Penetration Testing & Traffic Analysis

Target Application:

Damn Vulnerable Web Application (DVWA)

Tools Used:

Wireshark, Burp Suite Community Edition

Environment:

Kali Linux

1. Introduction

This lab report documents the practical execution of a local vulnerability assessment and penetration test against the Damn Vulnerable Web Application (DVWA). The objectives were twofold: first, to execute a SQL Injection (SQLi) attack and analyze its network-level signatures using Wireshark; second, to perform an automated brute-force attack against an authentication portal using Burp Suite.

2. Lab Environment Setup

• Operating System (Attacker & Host): Kali Linux

• Target Application: DVWA (running locally on Apache, PHP, and MariaDB)

• Target IP Address: 10.0.2.15

• Network Interface used for Wireshark: Loopback (lo)

• Note on Network Architecture: Because both the web browser and the web application server resided on the same Kali host, traffic remained internal to the local network stack. Capturing on standard interfaces like eth0 misses this data; hence, the virtual loopback (lo) interface was required to capture the internal packets.

DVWA Environmental Configuration

Figure 1:_ DVWA administration panel confirming the global security context is dropped down to "low" state before running test scripts._

3. SQL Injection using Wireshark

• Target Module: http://10.0.2.15/DVWA/vulnerabilities/sqli/

• DVWA Security Level: LOW

Execution Steps

• Wireshark was launched and configured to actively capture on the Loopback (lo) interface.

• The DVWA SQL Injection page was opened in the local browser.

• A baseline normal query (1) was submitted to record expected behavior.

Normal Baseline Input Behavior

Figure 2:_ DVWA SQL Injection module displaying standard application response output when querying a legitimate single user ID._

The malicious logical payload was injected into the User ID input field:

1' OR '1'='1

Malicious Injection Exploitation

Application response panel rendering multiple accounts simultaneously after logic validation is overridden by the input sequence.

The application's authentication logic was bypassed, causing the backend database query to evaluate as universally true (TRUE) and print all user records to the screen.

Network Traffic Breakdown & Analysis

Upon stopping the Wireshark capture and filtering for HTTP requests, the exact malicious exploit packet was isolated in Frame 86.

Isolated Malicious Frame Overview

Figure 4:_ Wireshark HTTP transmission log highlighting Frame 86 over loopback routing matching target parameter paths._

SQL Injection Network Evidence

Figure 5:_ Expanded layer details window tracking internal communication flags for the active loopback sequence._

Raw Packet Bytes Dump

Figure 6:_ Hexadecimal field breakdown panel showing cleartext URL string encoding parameters mapping the injection vectors._

• Source & Destination Verification: Both the source IP and destination IP are logged as 10.0.2.15, proving internal loopback routing.

• Protocol & Target Port: The payload was sent via standard HTTP over TCP Port 80.

• Hex and Text Data Analysis: Lines 0040 through 0080 of the hex dump showcase the raw HTTP GET request. The parameter string is clearly visible as URL-encoded data: id=1%27+OR+%271%27%3D%271&Submit=Submit.

• %27 represents the injected single quote (') used to break the SQL syntax structure.

• %3D represents the equals sign (=).

• + represents the space character.

4. Brute Force using Burp Suite

• Target Module: http://10.0.2.15/DVWA/vulnerabilities/brute/

• Tooling Used: Burp Suite Community Edition (Proxy + Intruder)

Execution Steps

• The built-in Burp Browser was launched via the Proxy → Intercept tab.

• Intercept was briefly turned off to log into DVWA and navigate to the Brute Force page.

• Intercept was turned ON, and dummy credentials (username: admin, password: password123) were submitted to capture the initial raw HTTP request structure.

Intruder Configuration

• The trapped request was sent to the Intruder module (Ctrl + I), and the proxy intercept was turned off to restore browser connectivity.

• In Intruder → Positions, the attack type was set to Cluster Bomb to ensure every username combination would be tested against every single password combination systematically.

• The default variable configurations were cleared, and custom position markers (§) were wrapped manually around the target username and password strings.

• In Intruder → Payloads, lists were configured for both positions:

• Payload Position 1 (Usernames): Admin, root

• Payload Position 2 (Passwords): 123456, password, xyzswm, poiu

Burp Suite Intruder Configuration

Figure 7:_ Burp Suite Intruder workspace staging the custom payload list dictionary rules against variable dictionary markers._

Attack Execution & Anomaly Detection

The attack was launched, cycling through 8 total request permutations.

Burp Suite Intruder Matrix Results

The completed Intruder brute force index mapping response lengths and server processing times for each string pair iteration.

Anomaly Identification & Request View

Figure 9:_ Split-screen analysis tracking anomalous single-byte compression delta flags inside Request 3's backend response structure._

By analyzing the completed results matrix, a structural anomaly was spotted on Request 3:

• Successful Combination: Payload 1 = Admin | Payload 2 = password

• Data Length Proof: Every single failed attack returned an HTTP response length of exactly 5242 bytes. Request 3 returned a response length of 5241 bytes. This 1-byte deviation is technical proof of an altered application state.

• Session State Verification: Inspecting the raw Response tab for Request 3 reveals that the application server issued a Set-Cookie: PHPSESSID=… header. This indicates that the server successfully validated the credentials, generated a stateful tracking cookie, and logged the attacker in.

• Rendered Output: The browser response reflected this success state by rendering the secure landing screen displaying: "Welcome to the password protected area admin."

Bypassed Authentication Dashboard

Rendered login screen showing the admin panel dashboard loaded after accepting the verified injection credentials.

5. Key Learning Outcomes & Conclusion

• Loopback vs. Network Traffic: Running a full lab environment on a single machine requires an understanding of the loopback interface (lo). Traditional physical network sniffing (eth0) cannot see traffic that never crosses a physical network interface card.

• Payload Visibility: Unencrypted HTTP traffic exposes sensitive injection strings and plaintext parameters completely to network sniffers, underscoring the absolute necessity of transport layer encryption (HTTPS).

• Response Length Behavior: Automated attacks rely heavily on identifying structural anomalies in server responses. A difference of even a single byte or status code can safely pinpoint a successful exploit or valid authentication bypass amidst thousands of failed requests.

Final Summary: This lab successfully simulated the practical exploitation of raw SQL query manipulation tracked via Wireshark and automated credential enumeration via a Burp Suite brute-force attack, using local packet inspection tools to track and verify the resulting system behavior.