A Practical Approach to Web Application Vulnerability Assessment and Penetration Testing Using Kali Linux

With the rapid digitalization of services, web applications have become prime targets for cyberattacks. This paper presents a practical Vulnerability Assessment and Penetration Testing (VAPT) methodology conducted during an 8-week Ethical Hacking internship. The study was performed in an isolated, controlled lab environment using Kali Linux as the attacking platform and the Damn Vulnerable Web Application (DVWA) as the target. By simulating real-world attack vectors, critical vulnerabilities were identified and exploited, including SQL Injection, Command Injection, Unrestricted File Upload, and Cross-Site Scripting (XSS). The paper details the exploitation phases, demonstrating how attackers can bypass authentication, execute remote system commands, and gain unauthorized server access. Furthermore, it provides a remediation framework based on the OWASP Top 10 and CVSS (Common Vulnerability Scoring System) to help developers mitigate these risks. The findings emphasize the necessity of secure coding practices, strict input validation, and continuous security testing in modern software development.=