Your First Pentest: A Practical Intro Using Free Tools

The Lab — DVWA on Docker

DVWA (Damn Vulnerable Web Application) is a PHP/MySQL app deliberately riddled with common vulnerabilities. It is the closest thing to a standardized training ground the web security community has.

docker pull vulnerables/web-dvwa
docker run -d -p 80:80 vulnerables/web-dvwa

# Open http://localhost, log in with: admin / password
# Click "Setup / Reset DB" — you now have a legal target.

Spotlight — The TOCTOU Race

TOCTOU (Time-Of-Check vs Time-Of-Use) is subtle and worth understanding deeply. The code looks correct in review:

// Looks safe. Isn't.
async function transfer(userId, amount) {
  const balance = await db.getBalance(userId);
  if (balance < amount) throw new Error("Insufficient funds");
  await db.deductBalance(userId, amount);   // race window lives here
  await db.creditRecipient(amount);
}

Send two concurrent requests before deductBalance completes on either, and the check passes twice. A pentester would catch this with a parallel-request harness. A code reviewer often will not.

Recon — Nmap

Nmap is the first tool most pentesters reach for. It maps open ports and running services on a target. Output tells you exactly what versions are exposed — your attack surface map.

nmap -sV -sC localhost

# -sV  →  probe ports for service/version info
# -sC  →  run default safe scripts

Intercept — Burp Suite Community

Burp Suite Community Edition is free and is the industry-standard HTTP proxy for web pentesting. It sits between your browser and the server and lets you inspect, modify, and replay every request.

• 1. Start Burp → Proxy → Intercept tab
• 2. Configure your browser to use 127.0.0.1:8080 as its proxy
• 3. Browse to DVWA — every request appears in Burp
• 4. Right-click any request → Send to Repeater → modify → resend

Exploit — SQLMap

Once Burp shows you a parameter that might be injectable, SQLMap automates the proof. This is how you move from “possible injection point” to “I have the data.”

sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \
  --cookie="security=low; PHPSESSID=<your_session_id>" \
  --dbs