User Accounts

INSERT INTO users VALUES (
  '1', 'admin', 'admin', 'admin', MD5('password'), ...
);
```sql

<Warning>
  MD5 is cryptographically broken and should never be used in production. DVWA uses it intentionally to demonstrate insecure password storage and to make password cracking exercises feasible.
</Warning>

### Security Implications by Level

**Low Level:**
- Passwords transmitted in plain text
- No password strength requirements
- Unlimited login attempts

**Medium Level:**
- Still using MD5
- Minimal rate limiting
- Weak protection against brute force

**High Level:**
- MD5 with additional controls
- Anti-CSRF tokens
- Random delays

**Impossible Level:**
- Still uses MD5 (database limitation)
- Account lockout protection
- Failed login tracking

## Account Usage in Exercises

### Brute Force Module
Goal: Discover user passwords through automated guessing

- Start with username enumeration
- Use wordlists to crack passwords
- Progress through security levels
- Learn about account lockouts at Impossible level

**Objective:** "Get the administrator's password by brute forcing. Bonus points for getting the other four user passwords!"

### SQL Injection Module
Goal: Extract user data from the database

- Dump the users table
- Retrieve password hashes
- Extract usernames and other details
- Understand data exposure risks

**Sample Exploitation:**
```sql
' UNION SELECT user, password FROM users-- -

CREATE TABLE users (
  user_id int(6) PRIMARY KEY,
  first_name varchar(15),
  last_name varchar(15),
  user varchar(15),
  password varchar(32),
  avatar varchar(70),
  last_login TIMESTAMP,
  failed_login INT(3),
  role VARCHAR(20) DEFAULT 'user',
  account_enabled TINYINT(1) DEFAULT 1
);
```sql

### access_log Table
Tracks user access to resources:
```sql
CREATE TABLE access_log (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  target_id INT NOT NULL,
  action VARCHAR(50) NOT NULL,
  timestamp DATETIME NOT NULL,
  FOREIGN KEY (user_id) REFERENCES users(user_id),
  FOREIGN KEY (target_id) REFERENCES users(user_id)
);

CREATE TABLE security_log (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  target_id INT NOT NULL,
  action VARCHAR(50) NOT NULL,
  timestamp DATETIME NOT NULL,
  ip_address VARCHAR(45) NOT NULL,
  FOREIGN KEY (user_id) REFERENCES users(user_id),
  FOREIGN KEY (target_id) REFERENCES users(user_id)
);
```bash

## Account Management

### Resetting Accounts
To restore all accounts to default:

1. Navigate to **Setup DVWA**
2. Click **Create / Reset Database**
3. All accounts return to original passwords
4. All logs are cleared
5. Failed login counters reset to 0

### Account Lockout (Impossible Level)

At the Impossible security level, the brute force module implements account lockout:

- 5 failed login attempts within 15 minutes triggers lockout
- Locked accounts cannot log in (even with correct password)
- Prevents user enumeration
- Can cause denial of service
- Demonstrates realistic security controls

**Lockout Behavior:**

## Using Accounts in Testing

### Password Cracking Practice

1. Extract password hashes via SQL injection
2. Use tools like John the Ripper or Hashcat
3. Compare cracking times for different passwords
4. Learn about rainbow tables and dictionary attacks

**Example hash extraction:**
```sql
SELECT user, password FROM users;

/hackable/users/admin.jpg
/hackable/users/gordonb.jpg
/hackable/users/1337.jpg
/hackable/users/pablo.jpg
/hackable/users/smithy.jpg