I Cant Login to DVWA

[DiegoAll]

Good afternoon,

I am trying to access DVWA through the web but it does not allow me to authenticate with the credentials provided by the repository in the Usage section:

Username: admin Password: password

This is the default password.

Reviewing the manifests (deployment-dvwa.yml) you can see that the container configuration is in dvwa-secrets

         -name: MYSQL_HOSTNAME
           value: dvwa-mysql-service
         -name: MYSQL_DATABASE
           valueFrom:
             secretKeyRef:
               name: dvwa-secrets
               key: DVWA_DATABASE
         -name: MYSQL_USERNAME
           valueFrom:
             secretKeyRef:
               name: dvwa-secrets
               key: DVWA_USERNAME
         -name: MYSQL_PASSWORD
           valueFrom:
             secretKeyRef:
               name: dvwa-secrets
               key: DVWA_PASSWORD

In (secrets.yml) are the credentials for the database.

ROOT_PASSWORD: czNyMDB0cGE1NQ== | s3r00tpa55 DVWA_USERNAME: ZHZ3YQ== | dvwa DVWA_PASSWORD: cEBzc3dvcmQ= | p@ssword DVWA_DATABASE: ZHZ3YQ== | p@ssword

I check in the environment variables of the pod and they are the same:

Gold3nH1nd:PoC1-cytopia dposada$ kubectl exec -it dvwa-mysql-f7979f7d7-gjnhd env |grep MYSQL kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. MYSQL_PASSWORD=p@ssword MYSQL_DATABASE=dvwa MYSQL_ROOT_PASSWORD=s3r00tpa55 MYSQL_USER=dvwa

I tried to use these passwords to access and change the DVWA user and password settings but it says that the database is empty.

MariaDB [(none)]> use dvwa; Database changed MariaDB [dvwa]> show tables; Empty set (0.00 sec)

I tried checking the database configuration as such and found a password.

MariaDB [dvwa]> select Host,User, Password from mysql.user where mysql.user.User = 'dvwa'; +------+------+----------------------------------- --------+ | host | user | Password | +------+------+----------------------------------- --------+ | % | dvwa | *4F477FE814A0E3A4A5FD42BBB87C2DE8C36750DE | +------+------+----------------------------------- --------+ 1 row in set (0.00 sec)

Again listed is the password for the database.

Another query.

MariaDB [dvwa]> select user, Password from mysql.user; +------+-------------------------------------------+ | user | Password | +------+-------------------------------------------+ | root | E5DA0CA0CD44F91DB3043207C23A9705704AD616 | | dvwa | 4F477FE814A0E3A4A5FD42BBB87C2DE8C36750DE | | root | *E5DA0CA0CD44F91DB3043207C23A9705704AD616 | +------+-------------------------------------------+ 3 rows in set (0.00 sec)

Also look for the password in the pod path /var/www/html/config/config.inc.php

and again the passwords for the database appear but not for DVWA.

Finally try reconfiguring the application

http://a383280f0a18b4beb9fdfdf8a0355fba-340159500.us-east-1.elb.amazonaws.com:8081/setup.php

And appears

Database Setup Click on the 'Create / Reset Database' button below to create or reset your database. If you get an error make sure you have the correct user credentials in: /var/www/html/config/config.inc.php

If the database already exists, it will be cleared and the data will be reset. You can also use this to reset the administrator credentials ("admin // password") at any stage.

user: admin password: password

They didn't work either.

Finally, I wanted to know, please, what is the password to access the application? Maybe it would not be with the default but with the root one?

Thank you so much.

[whitehatmiddleman]

What worked for me was admin:admin

[hungry-bogart]

I couldn't login, either. I tried the above methods as well.

[mokshit-giddanti]

there is something wrong with this DVWA k8s

you can use a single deployment file instead

apiVersion: apps/v1 kind: Deployment metadata: name: dvwa spec: replicas: 1 selector: matchLabels: app: dvwa template: metadata: labels: app: dvwa spec: containers:

• name: dvwa image: vulnerables/web-dvwa ports:
  • containerPort: 80

apiVersion: v1 kind: Service metadata: name: dvwa spec: selector: app: dvwa ports:

• protocol: TCP port: 80 targetPort: 80

TXT.txt -> for downloading the code

and deploy it should work fine with username: admin password: password

[n3r0-b1n4ry]

delete or comment line 102 in html/dvwa/includes/DBMS/MySQL.php and delete or comment line 14 to 20 in html/setup.php

all issue will be fixed