mehedi-hasan-sami98/dvwa-zap-pentestWeb application security assessment of DVWA using OWASP ZAP — vulnerability scanning, RCE (CVE-2012-1823) analysis, and remediation report.
A hands-on web application security assessment of DVWA (Damn Vulnerable Web App), performed using OWASP ZAP (Zed Attack Proxy) 2.17.0. This project documents the full workflow: reconnaissance (spidering), automated vulnerability scanning, and analysis of the alerts raised — including a Remote Code Execution (CVE-2012-1823) finding.
⚠️ Disclaimer: This assessment was performed in an isolated lab environment against DVWA, an application intentionally built to be vulnerable for training purposes. Never scan or attack systems you do not own or do not have explicit written permission to test.
To identify and document common web application vulnerabilities in DVWA using OWASP ZAP's spidering and active scanning capabilities, and to practice reading, interpreting, and reporting on automated security scan results.
http://192.168.109.115/dvwa/index.phpadminThe active scan completed with 1,157 requests sent and 72 new alerts raised, which ZAP grouped into 17 distinct alert types:
| # | Alert | Instances | Risk |
|---|---|---|---|
| 1 | Remote Code Execution — CVE-2012-1823 | 2 | 🔴 High |
| 2 | Source Code Disclosure — CVE-2012-1823 | 2 | 🔴 High |
| 3 | Absence of Anti-CSRF Tokens | 2 | 🟠 Medium |
| 4 | Content Security Policy (CSP) Header Not Set | 4 | 🟠 Medium |
| 5 | Directory Browsing | 3 | 🟠 Medium |
| 6 | HTTP Only Site | 1 | 🟠 Medium |
| 7 | Hidden File Found | 1 | 🟠 Medium |
| 8 | Missing Anti-clickjacking Header | 2 | 🟠 Medium |
| 9 | Cookie No HttpOnly Flag | 2 | 🟡 Low |
| 10 | Cookie without SameSite Attribute | 2 | 🟡 Low |
| ... | (7 more informational/low alerts — see full ZAP export) | ⚪ Info |
Full per-alert detail is in
docs/findings.md.
The most severe issue identified was a High-risk Remote Code Execution vulnerability, tracked under CVE-2012-1823 (a well-known PHP-CGI query-string parsing flaw).
http://192.168.109.115/dvwa/login.php?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input= character. This lets an attacker pass raw command-line-style flags (-d allow_url_include=1 -d auto_prepend_file=php://input) to the PHP interpreter, enabling arbitrary PHP code execution and source code disclosure.mod_rewrite with RewriteCond/RewriteRule directives to block malformed query strings before they reach PHP-CGI.| Screenshot | Description |
|---|---|
 | DVWA home page after login |
 | OWASP ZAP 2.17.0 welcome screen |
 | Automated Scan tab before target is entered |
 | Target URL set to DVWA before launching the attack |
 | 17 alert types discovered (grouped, by risk) |
 | RCE (CVE-2012-1823) alert — URL, risk, attack payload, evidence |
 | RCE (CVE-2012-1823) — description, other info, and solution |
 | Active scan at 100% — 1,157 requests, 72 new alerts |
 | Spider results — 9 URLs found, 7 nodes added |
X-Frame-Options / frame-ancestors).HttpOnly and SameSite attributes on all cookies to reduce session-hijacking and CSRF risk.dvwa-zap-pentest/
├── README.md # This file — project overview & summary
├── docs/
│ └── findings.md # Full detailed write-up of each alert
├── screenshots/ # Numbered screenshots referenced above
└── LICENSE
admin.This project was created for educational purposes as part of a web application security learning exercise.