DVWA Brute Force Lab 2026 — Hydra & Burp Intruder Complete Walkthrough Day 2

This article is a hands-on walkthrough of the DVWA brute force lab, teaching credential attack techniques across four security levels while demonstrating how defenses progress from none to proper implementation. It covers using Hydra for direct attacks at Low security, bypassing sleep-based rate limiting at Medium, extracting CSRF tokens with Burp Intruder at High, and analyzing the secure code patterns that make Impossible-level truly resistant. The article matters because it teaches both offensive techniques and the defensive coding patterns that should prevent them, giving learners a complete understanding of credential protection.

• Low security uses unprotected GET requestsDVWA's Low security brute force module passes credentials directly in URL query parameters with no CSRF token, rate limiting, or lockout mechanism. The username and password appear as query strings like ?username=admin&password=test&Login=Login, and failed attempts return the same predictable error message 'Username and/or password incorrect.' This design makes it trivial for Hydra's http-get-form module to automate the attack in seconds.
• Hydra extracts session cookies and parametersBefore running Hydra, the attacker must capture the exact request format using Burp or browser DevTools, including the PHPSESSID cookie value, parameter names, and the failure string that distinguishes wrong passwords from successful login. The article provides a complete Hydra command syntax that binds these elements: it specifies the username (-l admin), wordlist (-P), target path, parameter substitution (^USER^ and ^PASS^), the failure string to match, and the session cookie in the HTTP header.
• Sleep delays are bypassed by slowing threadsAt Medium security, DVWA adds a sleep(2) PHP function that delays each login attempt by 2 seconds, which the article describes as 'inconvenience, not protection.' Hydra bypasses this completely using the -t 1 flag to reduce threads to 1, forcing single-threaded execution that naturally waits for each response; the attack still succeeds, just more slowly. The article emphasizes that sleep() does not limit total attempts, it only stretches them over time.
• CSRF tokens require recursive grep extractionHigh security introduces per-request user_token CSRF tokens that must match a session token; Hydra cannot handle dynamic tokens so the attacker must use Burp Suite Intruder instead. The article explains using Pitchfork attack type with Recursive Grep payload extraction: Burp reads the user_token value from each server response and injects it into the next request automatically, effectively automating token reuse and defeating this defense layer.
• Impossible security combines four complementary defensesDVWA's Impossible level implements PDO parameterized queries (preventing SQL injection), SHA-256 password hashing with salt (replacing insecure MD5), a failed_login counter stored per user account, and automatic account lockout after three failed attempts with time-based auto-unlock. The article stresses that no single measure is sufficient alone—the combination makes brute force impractical because lockout stops attempts entirely regardless of attack speed or sophistication.
• PDO prepared statements prevent SQL injectionThe Low security code uses raw string concatenation in SQL queries (vulnerable to injection), while Impossible uses PDO bindParam() with placeholders like 'SELECT * FROM users WHERE user = (:user) LIMIT 1;' and parameter binding. This prevents attackers from injecting SQL code through the username or password fields, removing an alternative attack path that could bypass authentication entirely.
• Source code comparison teaches secure patternsThe article emphasizes reading the actual PHP code at each level (provided via docker exec or direct file access) to see vulnerable patterns replaced by secure implementations. This teaches learners to recognize md5() password hashing, lack of lockout counters, and missing token validation in real production code reviews, and to understand exactly how these patterns enable exploitation.
• Legal and ethical boundaries are non-negotiableThe article repeatedly states that all techniques must only be used against DVWA running on 127.0.0.1, and that unauthorized credential brute force attacks are illegal in all jurisdictions. It explicitly warns that the skills are only for authorized testing in controlled lab environments like DVWA, TryHackMe, or HackTheBox, never against systems you do not own or have explicit written permission to test.

Bottom line: Brute force defense requires account lockout implemented in the database combined with secure password hashing and prepared SQL statements; sleep delays and CSRF tokens alone are ineffective because they can be bypassed by slowing attacks or extracting tokens automatically. Understanding this progression from Low to Impossible security teaches both the offensive techniques used to attack unprotected logins and the specific coding patterns required to defend against them.