Damn Vulnerable Web Application (DVWA)
A PHP/MySQL web application designed for security professionals to practice and enhance their skills by exploiting common web vulnerabilities.
| Category | Penetration Testing Tools |
|---|---|
| This page updated | a month ago |
| Pricing Details | Free to use and open source. |
| Target Audience | Security professionals, penetration testers, and students learning about web vulnerabilities. |
The Damn Vulnerable Web Application (DVWA) presents a significant challenge for security professionals by intentionally embedding a wide range of common web vulnerabilities, making it an ideal tool for training and skill development in a controlled environment.
Technically, DVWA is a PHP/MySQL web application that can be deployed in various ways, including using Docker, XAMPP, or directly on a web server. The application is designed to be highly vulnerable, with features such as SQL injection, cross-site scripting (XSS), command injection, and file inclusion vulnerabilities. These vulnerabilities are intentionally left undocumented in some cases, encouraging users to discover and exploit them as part of their learning process.
Operationally, it is crucial to run DVWA in a isolated environment, such as a virtual machine or a Docker container, to prevent any potential security risks. The application comes with configurable security levels, allowing users to adjust the difficulty of the vulnerabilities they are testing against. This flexibility is key for both beginners and advanced security professionals to hone their skills.
Key technical details include the use of default credentials (username: admin, password: password) which are intentionally weak to facilitate easy access and brute force attacks. The database setup involves creating or resetting the database through the application's setup interface, with default database credentials that need to be adjusted for security purposes. Additionally, DVWA requires proper configuration of database credentials and other settings, such as reCAPTCHA keys, to ensure smooth operation.
Given its educational purpose, DVWA is distributed under the GNU General Public Licence and is available for download from GitHub or other mirrored sources, as the original website is no longer active.