My First Vulnerability Assessment: Exploring DVWA, SQL Injection and Vulnerability Management in a…

When I started learning cybersecurity, I quickly realised that understanding how attacks work is just as important as understanding how to prevent them.

Reading about vulnerabilities, exploitation and security weaknesses is one thing. Actually setting up a vulnerable application, interacting with it, examining its weaknesses and understanding how those weaknesses can be addressed is an entirely different experience.

As part of my cybersecurity training at Bincom Academy, I worked on a practical assignment titled Vulnerability Scan and Exploit Simulation.

The objective was to understand how security professionals identify vulnerabilities, assess their potential impact, validate weaknesses in a controlled environment and recommend appropriate remediation measures.

This was one of my first opportunities to explore vulnerability management from a practical perspective.

Setting Up My Lab Environment

For this exercise, I worked with Kali Linux and Damn Vulnerable Web Application (DVWA).

DVWA is an intentionally vulnerable web application designed to help cybersecurity learners understand common web application vulnerabilities and practise security testing in a controlled environment.

My lab consisted of two virtual machines connected through an isolated host-only network.

• Attacking and testing machine: Kali Linux — 192.168.131.131
• • Target machine: Ubuntu running DVWA — 192.168.131.132

Using an isolated network ensured that the practical exercises remained within my authorised laboratory environment.

This setup allowed me to explore vulnerability assessment without exposing external systems to testing activities.

Understanding Vulnerability Assessment

Before conducting the practical exercises, I explored the concept of vulnerability assessment.

A vulnerability is a weakness in a system, application or network that could potentially be exploited to compromise its security.

Vulnerability assessment involves identifying, analysing and prioritising these weaknesses so that appropriate security measures can be implemented.

I also explored two important concepts:

Common Vulnerabilities and Exposures (CVE): A publicly recognised identification system for known cybersecurity vulnerabilities.

Common Vulnerability Scoring System (CVSS): A framework used to communicate the severity of vulnerabilities based on factors such as exploitability and potential impact.

Understanding these concepts helped me appreciate why identifying a vulnerability is not enough. Security professionals must also understand its severity and potential consequences.

Exploring DVWA and SQL Injection

One of the practical exercises involved interacting with DVWA and examining SQL injection.

SQL injection occurs when an application handles untrusted user input insecurely, allowing an attacker to interfere with database queries.

During my testing, I navigated to the SQL Injection section of DVWA and examined how the application processed user-supplied input.

I successfully demonstrated the vulnerability and retrieved multiple database records through the testing interface.

This exercise helped me understand how inadequate input handling can expose information stored in a database.

More importantly, it demonstrated why web applications must validate user input and use secure database query practices.

Exploring Vulnerability Scanning with OpenVAS

Another important part of the assignment involved OpenVAS, now part of the Greenbone Vulnerability Management ecosystem.

OpenVAS is used to identify known vulnerabilities and security weaknesses across systems.

The objective of incorporating vulnerability scanning into my lab was to understand how automated security assessment tools help organisations identify potential weaknesses.

I worked through the Greenbone setup process, including database configuration and the management services required to operate the platform.

This introduced me to the infrastructure behind vulnerability scanning and the importance of maintaining vulnerability feeds and scan configurations.

Exploring Metasploit

I also worked with Metasploit, a widely used penetration testing framework.

Metasploit provides security professionals with tools for researching, validating and demonstrating vulnerabilities in authorised environments.

During the exercise, I explored the framework and conducted reconnaissance against the target environment, including identifying information about the Apache web server.

This helped me understand the relationship between reconnaissance, vulnerability identification and controlled exploitation.

An important lesson from this exercise was that identifying a service or software version does not automatically establish that the system is vulnerable. Further validation is necessary before drawing conclusions.

Why Remediation Matters

Finding vulnerabilities is only one part of cybersecurity.

The next responsibility is understanding how to reduce the associated risks.

Some important remediation principles I explored include:

1. Keeping operating systems and applications updated.
2. 2. Applying security patches as soon as appropriate.
3. 3. Using prepared SQL statements to prevent SQL injection.
4. 4. Validating and sanitising user input.
5. 5. Restricting unnecessary services and privileges.
6. 6. Conducting regular vulnerability assessments.
7. 7. Monitoring systems for suspicious activities.

Effective vulnerability management requires organisations to move beyond identifying security weaknesses and take measurable steps towards reducing their exposure.

What I Learned

This practical exercise helped me connect several cybersecurity concepts that I had previously encountered mainly through theoretical lessons.

I gained a better understanding of:

• Vulnerability assessment and management.
• • The purpose of CVE and CVSS.
• • Working with intentionally vulnerable web applications.
• • SQL injection and database security.
• • Greenbone/OpenVAS vulnerability management.
• • Metasploit reconnaissance.
• • The importance of vulnerability remediation.
• • Conducting security testing within an authorised environment.

One lesson that stood out to me was that cybersecurity is not simply about discovering ways to exploit systems. It is also about understanding why weaknesses exist, evaluating their impact and developing appropriate security controls.

Final Thoughts

My cybersecurity learning journey is teaching me to approach security from both offensive and defensive perspectives.

Every practical assignment gives me an opportunity to become more familiar with industry tools, understand real-world security challenges and develop the analytical skills required in the field.

I am documenting these experiences because I believe that learning should not happen entirely behind the scenes.

I want to be able to look back at my progress, understand how far I have come and share useful lessons with other people beginning their cybersecurity journeys.

This is one more step in that process.

I am still learning, still experimenting and steadily building my foundation in cybersecurity.

About this journey: I am currently developing my cybersecurity skills through practical training at Bincom Academy, exploring network security, vulnerability assessment, web application security, incident response and cloud security.