This is a demonstration report, not a client engagement. All testing was performed against DVWA (Damn Vulnerable Web Application) — a deliberately-vulnerable app hosted locally for training. No third-party systems were tested. Content shows our reporting format and depth.
DVWA — findings & remediation
A scoped assessment of an intentionally-vulnerable PHP practice target, demonstrating Verfend’s verify → explain → retest methodology.
Scope & authorisation
Target. A single instance of DVWA deployed on an isolated local host under our control, with the security level set to “low” for demonstration. DVWA is distributed expressly as a learning environment.
Authorisation. Testing was performed against our own instance only. No production system, customer data or third-party asset was in scope or accessed.
Method. Grey-box testing aligned to OWASP ASVS and the OWASP Web Security Testing Guide; findings verified manually and retested after remediation.
Executive summary
The assessment confirmed six issues. A union-based SQL injection permits extraction of the entire user database, while OS command injection and an unrestricted file upload each lead to remote code execution on the host. Input-handling and session issues follow. All findings were reproduced manually, prioritised by real impact, and retested after the fixes below.
| ID | Finding | OWASP | Severity | Retest |
|---|---|---|---|---|
| DV-01 | SQL injection (union) → database disclosure | A03 | CRIT 9.8 | ✓ resolved |
| DV-02 | OS command injection → RCE | A03 | HIGH 8.6 | ✓ resolved |
| DV-03 | Unrestricted file upload → web shell | A05 | HIGH 8.8 | ✓ resolved |
| DV-04 | Stored & reflected cross-site scripting | A03 | MED 6.1 | ✓ resolved |
| DV-05 | CSRF on password change | A01 | MED 6.5 | ✓ resolved |
| DV-06 | Weak session cookie flags | A05 | LOW 3.1 | ↻ accepted |
Findings in detail
SQL injection → database disclosure
# payload ?id=1' UNION SELECT user, password FROM users-- - # response (excerpt) admin : 5f4dcc3b5aa765d61d8327deb882cf99 gordonb : e99a18c428cb38d5f260853678922e03
- $q = "SELECT first_name,last_name FROM users WHERE id='$id'"; + $stmt = $db->prepare("SELECT first_name,last_name FROM users WHERE id = ?"); + $stmt->execute([$id]);
OS command injection → RCE
# ip field 127.0.0.1 ; cat /etc/passwd # response (excerpt) root:x:0:0:root:/root:/bin/bash www-data:x:33:33:...
Unrestricted file upload → web shell
# uploaded shell.php → 200 OK stored at /hackable/uploads/shell.php # executed GET /hackable/uploads/shell.php?c=id → uid=33(www-data)
DV-04 (XSS), DV-05 (CSRF on password change) and DV-06 (weak cookie flags) are abridged in this public sample, each with evidence, remediation and retest status.
Methodology & standards
Disclaimer. Illustrative sample for demonstration only. DVWA is an open-source project used here as a public training target; Verfend is not affiliated with its authors. “Verfend” is a working brand for a local concept. No third-party systems were tested and no real client data appears in this document. A security assessment reflects a defined scope and point in time and does not guarantee the absence of other issues.