How to install damn small linux

Damn Small Linux is an operating system, designed to run from live media (such as a bootable business card-size CD) that, at its heart, is controlled by a Linux kernel. It is based on another Linux live CD called KNOPPIX, which, in turn, was created from a Linux distribution called Debian.

Although the Damn Small Linux site is now dead, you can still find active ISOs online. The Tiny Core Linux “TinyCore” installation is a minute 21MB, including the base distro and a decent GUI.

Damn Small is small enough and smart enough to do the following things: Boot from a business card CD as a live linux distribution (LiveCD) Boot from within a host operating system (that’s right, it can run *inside* Windows) Run very nicely from an IDE Compact Flash drive via a method we call “frugal install”

Monolithic kernel (Linux) Damn Vulnerable Linux (DVL) is a discontinued Linux distribution geared toward computer security students. It functioned as a tool for observing and studying vulnerabilities in the Linux kernel and popular user space software.

DVWA is a PHP/MySQL web application, whose main goal is to be an aid for security professionals to test their skills and tools in a legal environment.

DVWA requires a module for php which is not installed into Kali Linux or elementaryOS. So we need to add a Debian source for APT.

Damn Vulnerable Web Application (DVWA)

Not to be confused with DVIA, the Damn Vulnerable Web Application (DVWA) is a great tool for web devs and security pros alike. Basically, it’s a MySQL/PHP web app that’s designed to be super vulnerable to SQL injections and other common attacks.

SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. This information may include any number of items, including sensitive company data, user lists or private customer details.

In the US, SQL injection and other types of “hacking” are illegal under various laws and regulations stemming from the Computer Fraud and Abuse Act and the Patriot Act .

“SQL injection is still out there for one simple reason: It works!” says Tim Erlin, director of IT security and risk strategy for Tripwire. “As long as there are so many vulnerable Web applications with databases full of monetizable information behind them, SQL injection attacks will continue.”

Some common SQL injection examples include: Retrieving hidden data, where you can modify an SQL query to return additional results. Subverting application logic, where you can change a query to interfere with the application’s logic. UNION attacks, where you can retrieve data from different database tables.

Using SQL injection, a hacker will try to enter a specifically crafted SQL commands into a form field instead of the expected information. The intent is to secure a response from the database that will help the hacker understand the database construction, such as table names.

SQL injection attacks

If the web application fails to sanitize user input, an attacker can inject SQL of their choosing into the back-end database and delete, copy, or modify the contents of the database. An attacker can also modify cookies to poison a web application’s database query.

In-band SQL Injection is the most common and easy-to-exploit of SQL Injection attacks.

The exercise shows that SQL injection (SQLi) now represents nearly two-thirds (65.1%) of all Web application attacks.