###Project Introduction DVPWA (Damn Vulnerable Python Web Application) was inspired by the famous DVWA project and bobby-tables 'xkcd comics. The project aims to implement a Python Web application with real-world scenarios and ** deliberately contains as many security vulnerabilities as possible ** while maintaining good design and development intentions. DVPWA is mainly used to demonstrate and teach Web security vulnerabilities and was used as a sample project in the EVO Summer Python Lab'17 Web vulnerability presentation. ###Main vulnerability demonstration - **Session Fixation attack ** The session id does not change before and after login, which can be used by attackers to hijack user sessions. - **SQL Injection ** User input is not parameterized, and attackers can perform arbitrary database operations by constructing malicious SQL statements. - ** Stored XSS ** Content submitted by users is not filtered or escaped, and malicious scripts can be stored and executed when the page is displayed. - ** Password storage is not secure ** Passwords are stored directly in MD5 hash, which is easy to be collided with and cracked. It is recommended to use more secure hashing algorithms such as bcrypt, argon2, etc. - **CSRF (Cross-Site Request Forge)** (To be added) Currently, CSRF protection is not implemented and is vulnerable to forged request attacks. ###Application scenarios - Web security teaching and demonstration - Security tool testing and practice - Research on vulnerability recurrence and security The default account password is: superadmin:superadmin > ** Warning: This project is for teaching and safety research purposes. ** Please do not deploy it in the production environment or use it for illegal purposes!
