Download the ISO here: http://dvwa.co.uk; http://www.dvwa.co.uk/DVWA-1.0.7.iso

Install using the ISO as VM using VMWare Player or VirtualBox.

Start up the machine in "LiveCD" mode.

Start and boot the virtual machine. At the command prompt, type "ifconfig" to get the IP address of the DVWA virtual machine.

Log into the web interface by going to "http://insert the ip address of the virtual machine"

Go to "DVWA Security" located in the left-hand side toolbar.

Set the security level to "low" and click on the "Submit" button.

Review the source code (click the "View Source" button"), help information (click the "View Help" button), and the links under the "More info" section, for the following vulnerabilities:

Brute Force

SQL Injection

Upload

SQL Injection Blind

XSS Reflected

For each one of the vulnerabilities above (total of 5) provide:

The STRIDE threat that may exploit the vulnerability.

A copy of the source code for each indicating the proposed changes to mitigate the vulnerability (you can use pseudo code or actual PHP to show how you would mitigate).