CyberSpace7777 commented 7 months ago

Subject: DVWA Post Installation Issue dvwa error

Attention: Robin Wood

Background: After having completed DVWA installation successfully on Ubuntu Linux, via instructions at https://github.com/digininja/DVWA?tab=readme-ov-file. However, I am having issues with accessing any of Menus on the left pane, which results in errors. Please see below on a Post, posted on Robin Wood's youtube channel https://www.youtube.com/watch?v=Yzksa_WjnY0:

Me: great tutorial. thank you.

Can you please advise how to fix the error below: Fatal error: Uncaught mysqli_sql_exception: Connection refused in /var/www/html/DVWA/dvwa/includes/dvwaPage.inc.php:535 Stack trace: #0 /var/www/html/DVWA/dvwa/includes/dvwaPage.inc.php(535): mysqli_connect() https://github.com/orgs/community/discussions/1 /var/www/html/DVWA/vulnerabilities/xss_r/index.php(14): dvwaDatabaseConnect() https://github.com/orgs/community/discussions/2 {main} thrown in /var/www/html/DVWA/dvwa/includes/dvwaPage.inc.php on line 535

Robin: Your database credentials are wrong. Raise a ticket in GitHub giving all the details it requests and I'll try to help.

digininja commented 7 months ago

It looks like your database server is not running, follow these instructions:

https://github.com/digininja/DVWA/blob/master/README.md#connection-refused

CyberSpace7777 commented 7 months ago

Hi Robin,

My apologies for a delayed response. Thanks very much for your assistance.

I am certain the "mariadb" database was always running at the time of this issue occurrence. Today, I checked it again as detailed below, however, I am still encountering the same issue:

Output 1: cyber@dvma:~$ systemctl status mysql ● mariadb.service - MariaDB 10.6.16 database server Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2024-04-24 02:02:33 UTC; 2min 44s ago Docs: man:mariadbd(8) https://mariadb.com/kb/en/library/systemd/ Main PID: 1249 (mariadbd) Status: "Taking your SQL requests now..." Tasks: 8 (limit: 4515) Memory: 89.4M CPU: 936ms CGroup: /system.slice/mariadb.service └─1249 /usr/sbin/mariadbd

Apr 24 02:02:33 dvma.cyb mariadbd[1249]: 2024-04-24 2:02:33 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-second> Apr 24 02:02:33 dvma.cyb mariadbd[1249]: 2024-04-24 2:02:33 0 [Note] InnoDB: Buffer pool(s) load completed at 240424 2:02:33 Apr 24 02:02:33 dvma.cyb mariadbd[1249]: 2024-04-24 2:02:33 0 [Note] Server socket created on IP: '127.0.0.1'. Apr 24 02:02:33 dvma.cyb mariadbd[1249]: 2024-04-24 2:02:33 0 [Note] /usr/sbin/mariadbd: ready for connections. Apr 24 02:02:33 dvma.cyb mariadbd[1249]: Version: '10.6.16-MariaDB-0ubuntu0.22.04.1' socket: '/run/mysqld/mysqld.sock' port: 3306 Ubuntu 22.04 Apr 24 02:02:33 dvma.cyb systemd[1]: Started MariaDB 10.6.16 database server. Apr 24 02:02:33 dvma.cyb /etc/mysql/debian-start[1657]: Upgrading MySQL tables if necessary. Apr 24 02:02:34 dvma.cyb /etc/mysql/debian-start[1668]: Checking for insecure root accounts. Apr 24 02:02:34 dvma.cyb /etc/mysql/debian-start[1673]: WARNING: mysql.user contains 2 root accounts without password! Apr 24 02:02:34 dvma.cyb /etc/mysql/debian-start[1674]: Triggering myisam-recover for all MyISAM tables and aria-recover for all Aria tables cyber@dvma:~$ systemctl status apache2 ● apache2.service - The Apache HTTP Server Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2024-04-24 02:02:33 UTC; 3min 21s ago Docs: https://httpd.apache.org/docs/2.4/ Main PID: 1640 (apache2) Tasks: 6 (limit: 4515) Memory: 17.8M CPU: 153ms CGroup: /system.slice/apache2.service ├─1640 /usr/sbin/apache2 -k start ├─1643 /usr/sbin/apache2 -k start ├─1644 /usr/sbin/apache2 -k start ├─1645 /usr/sbin/apache2 -k start ├─1646 /usr/sbin/apache2 -k start └─1647 /usr/sbin/apache2 -k start

Apr 24 02:02:28 dvma.cyb systemd[1]: Starting The Apache HTTP Server... Apr 24 02:02:33 dvma.cyb systemd[1]: Started The Apache HTTP Server. cyber@dvma:~$

Output 2:

MariaDB [(none)]>

May you please assist me.

digininja commented 7 months ago

Is your config file definitely pointing at this database server? Send me a screenshot of the database section of your config file, an example of you logging in using those credentials on the command line, and the last 10 entries from the Apache log straight after the error has occurred.

CyberSpace7777 commented 7 months ago

Hi Robin,

Thank you for your assistance.

Please find the requested details below, spread across over three posts:

1. Screenshot of database section of config file:

cyber@dvma:/var/www/html/DVWA/config$ vi config.inc.php <?php

If you are having problems connecting to the MySQL database and all of the variables below are correct try changing the 'db_server' variable from localhost to 127.0.0.1. Fixes a problem due to sockets. Thanks to @digininja for the fix.

Database management system to use $DBMS = 'MySQL'; $DBMS = 'PGSQL'; // Currently disabled

Database variables WARNING: The database specified under db_database WILL BE ENTIRELY DELETED during setup. Please use a database dedicated to DVWA.

If you are using MariaDB then you cannot use root, you must use create a dedicated DVWA user. See README.md for more information on this. $_DVWA = array(); $_DVWA[ 'db_server' ] = 'dvwa.cyb'; $_DVWA[ 'db_database' ] = 'dvwa'; $_DVWA[ 'db_user' ] = 'dvwa'; $_DVWA[ 'db_password' ] = 'p@ssw0rd'; $_DVWA[ 'db_port'] = '3306';

ReCAPTCHA settings Used for the 'Insecure CAPTCHA' module You'll need to generate your own keys at: https://www.google.com/recaptcha/admin $_DVWA[ 'recaptcha_public_key' ] = ''; $_DVWA[ 'recaptcha_private_key' ] = '';

Default security level Default value for the security level with each session. The default is 'impossible'. You may wish to set this to either 'low', 'medium', 'high' or impossible'. $_DVWA[ 'default_security_level' ] = 'low';

Default locale Default locale for the help page shown with each session. The default is 'en'. You may wish to set this to either 'en' or 'zh'. $_DVWA[ 'default_locale' ] = 'en';

Disable authentication Some tools don't like working with authentication and passing cookies around so this setting lets you turn off authentication. $_DVWA[ 'disable_authentication' ] = true; "config.inc.php" [readonly][dos] 56L, 2162B 1,1 Top

digininja commented 7 months ago

There is no screenshot.

CyberSpace7777 commented 7 months ago

Post 1: