> For the complete documentation index, see [llms.txt](https://kchuene.gitbook.io/data-communication-project/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kchuene.gitbook.io/data-communication-project/detection-and-response/dvwa.md).

# DVWA

Detecting attacks against your DVWA instance.

## Attack Testing

Sample commands that can be ran from the **Kali Linux** container (recommended) or separate installations of the tools, to trigger **Wazuh Rules**. These will still trigger even with **DVWA** security level set to `impossible`.

**SQL Injection (SQLi)**

{% code overflow="wrap" lineNumbers="true" %}

```
sqlmap -u "https://www.dvwa.vm/vulnerabilities/sqli/?id=2&Submit=Submit&user_token=fd8e158e1afddead5fd6cfc28ffbdcb9" --dbs --batch --level=5 --delay=1 --random-agent
```

{% endcode %}

Rules IDSs `31152` and `31103` should trigger.

**Cross-Site Scripting (XSS)**

{% code overflow="wrap" lineNumbers="true" %}

```
sudo apt install xsser
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```
xsser -u "https://www.dvwa.vm" -g "/vulnerabilities/xss_r/?name=XSS&user_token=b923ee8640f11a994fa03a52bb930bf4" --auto --delay 1
```

{% endcode %}

Rule IDS `31154` and `31105` should trigger.

## Response

For IDSs like `31152` and `31154` indicating *"Multiple attempts from the same Source IP"* the following active response can be configured via the **Wazuh Dashboard** or `/var/ossec/etc/ossec.conf` file.

**Server Management > Settings > Edit configuration**

{% code overflow="wrap" lineNumbers="true" %}

```xml
<ossec_config>
   <active-response>
     <disabled>no</disabled>
     <command>firewall-drop</command>
     <location>local</location>
     <rules_id>31152, 31154</rules_id>
     <timeout>60</timeout>
   </active-response>
</ossec_config>
```

{% endcode %}

Which instructs the endpoint (`local`) agent to add the IP to **iptables** deny list (`firewall-drop`) effective for `timeout` seconds.

{% hint style="info" %}
The `command` tag references the name of a command, i.e. `<command></command>` section defined within the same `<ossec_config>` section.
{% endhint %}

**Confirm IP block**

Run the following command on the target node (node under attack) to confirm that the attack IP has been blocked, i.e. target set to `DROP`

{% code overflow="wrap" lineNumbers="true" %}

```
sudo iptables -L -n | grep 192.168.56.1
```

{% endcode %}

{% hint style="info" %}
Option `-n` prevents resolving host to names.
{% endhint %}

{% embed url="<https://documentation.wazuh.com/current/user-manual/capabilities/active-response/how-to-configure.html>" %}

{% embed url="<https://documentation.wazuh.com/current/user-manual/capabilities/active-response/default-active-response-scripts.html>" %}

{% embed url="<https://documentation.wazuh.com/current/user-manual/ruleset/rules/rules-classification.html>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://kchuene.gitbook.io/data-communication-project/detection-and-response/dvwa.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.