Security Levels

// Low level - No filtering at all
$name = $_GET['name'];
echo "<p>Hello {$name}</p>";
```bash

### Medium Security

The **Medium** security level implements basic protections that can be circumvented.

**Characteristics:**
- Simple input filtering (blacklists)
- Basic sanitization functions
- Easily bypassed protections
- Client-side validation only

**Purpose:**
- Learn bypass techniques
- Understand weak security implementations
- Practice filter evasion
- Identify flawed protection logic

**Example - XSS Vulnerability:**
```php
// Medium level - Simple filtering
$name = str_replace('<script>', '', $_GET['name']);
echo "<p>Hello {$name}</p>";

// High level - Whitelist approach
$allowed = ['en', 'es', 'fr'];
if (in_array($_GET['lang'], $allowed)) {
    $lang = $_GET['lang'];
} else {
    $lang = 'en';
}
echo "<p>Language: {$lang}</p>";
```sql

### Impossible Security

The **Impossible** security level demonstrates properly secured code.

**Characteristics:**
- Properly implemented security controls
- Parameterized queries (for SQL)
- Output encoding
- CSRF tokens
- Secure session handling
- Following security best practices

**Purpose:**
- Learn secure coding practices
- Understand proper implementations
- Compare vulnerable vs. secure code
- Study defense mechanisms

**Example - SQL Injection:**
```php
// Impossible level - Prepared statements
$stmt = $db->prepare('SELECT * FROM users WHERE id = ?');
$stmt->bind_param('i', $_GET['id']);
$stmt->execute();

// Valid security levels
$security_levels = array('low', 'medium', 'high', 'impossible');
```text

Each module has separate implementation files:

### Level Selection Logic

Example from SQL Injection module:

```php
switch( dvwaSecurityLevelGet() ) {
    case 'low':
        $vulnerabilityFile = 'low.php';
        break;
    case 'medium':
        $vulnerabilityFile = 'medium.php';
        break;
    case 'high':
        $vulnerabilityFile = 'high.php';
        break;
    default:
        $vulnerabilityFile = 'impossible.php';
        break;
}

if (!isset($_COOKIE['security']) || !in_array($_COOKIE['security'], $security_levels)) {
    // Set security cookie to impossible if no cookie exists
    if (in_array($_DVWA['default_security_level'], $security_levels)) {
        dvwaSecurityLevelSet($_DVWA['default_security_level']);
    } else {
        dvwaSecurityLevelSet('impossible');
    }
}
```bash

The current level is stored in the `security` cookie.

## Default Security Level

You can configure the initial security level in `config/config.inc.php`.

### Configuration Setting

```php
$_DVWA['default_security_level'] = 'impossible';

environment:
  - DEFAULT_SECURITY_LEVEL=low
```bash

### Default Behavior

From `config/config.inc.php.dist:30-33`:

```php
# Default security level
#   Default value for the security level with each session.
#   The default is 'impossible'. You may wish to set this to either 'low', 'medium', 'high' or impossible'.
$_DVWA['default_security_level'] = getenv('DEFAULT_SECURITY_LEVEL') ?: 'impossible';

function dvwa_start_session() {
    $security_level = dvwaSecurityLevelGet();
    if ($security_level == 'impossible') {
        $httponly = true;
        $samesite = "Strict";
    } else {
        $httponly = false;
        $samesite = "";
    }
    // ... session configuration
}
```sql

| Level | HttpOnly Cookie | SameSite Cookie | Session Regeneration |
|-------|----------------|-----------------|----------------------|
| Low | ❌ No | ❌ No | ❌ No |
| Medium | ❌ No | ❌ No | ❌ No |
| High | ❌ No | ❌ No | ❌ No |
| Impossible | ✅ Yes | ✅ Strict | ✅ Yes |

<Info>
  Lower security levels intentionally leave the application vulnerable to session attacks like session fixation and XSS-based cookie theft.
</Info>

## Recommended Learning Path

For the best learning experience, follow this progression:

<Steps>
  <Step title="Start with Low">
    Begin at **Low** security to understand the basic vulnerability and learn fundamental exploitation.
  </Step>
  
  <Step title="Progress to Medium">
    Move to **Medium** security and practice bypass techniques against basic protections.
  </Step>
  
  <Step title="Challenge yourself at High">
    Attempt **High** security to develop advanced skills and creative exploitation methods.
  </Step>
  
  <Step title="Study Impossible">
    Review the **Impossible** level source code to understand proper security implementation.
  </Step>
</Steps>

## Viewing Source Code

You can view the source code for each security level.

### Via Web Interface

1. Navigate to any vulnerability module
2. Click **"View Source"** in the bottom right
3. Select the security level to view its implementation
4. Compare different levels side-by-side

### Via File System

All source files are located in:

Example modules:
- `sqli` - SQL Injection
- `xss_r` - Reflected XSS
- `xss_s` - Stored XSS
- `csrf` - Cross-Site Request Forgery
- `upload` - File Upload

<Tip>
  Comparing the source code across security levels is one of the best ways to learn both exploitation and defense techniques.
</Tip>

## Disabling Authentication for Testing

For automated tool testing, you can set a fixed security level and disable authentication.

### Configuration

Edit `config/config.inc.php`:

```php
$_DVWA['disable_authentication'] = true;
$_DVWA['default_security_level'] = 'low';