DVWA

What is DVWA?

DVWA (Damn Vulnerable Web Application) is a PHP web application backed by a MySQL/MariaDB database that is vulnerable on purpose. For years it has been one of the first labs people set up when getting into web hacking, and it remains useful for one big reason: each vulnerability lives in its own module and can be played at several security levels, so you see the same bug exploited, half-mitigated and finally fixed properly.

The project is open source and hosted on GitHub. It includes a button to view the PHP source of every module at every level, which makes it an excellent tool both for aspiring attackers and for developers who want to understand what makes a function secure or insecure.

What DVWA is used for

• Learning classic web vulnerabilities: SQL injection, XSS, command injection, file inclusion, CSRF and file upload.
• Practising with tools such as Burp Suite, OWASP ZAP or sqlmap in a legal setting.
• Understanding mitigation: comparing low-level code with the Impossible level teaches secure coding practices.
• Teaching classes and workshops, since it is up in minutes and easy to reset.

How to install DVWA with Docker

The official repository ships a Docker Compose file, the easiest way to bring it up together with its database:

git clone https://github.com/digininja/DVWA.git
cd DVWA
docker compose up -d

With the repository's default configuration, the app is served at http://localhost:4280. If you change the port in the Compose file, use that one instead.

First steps once it is running:

1. Log in with the default credentials: username admin, password password.
2. Go to the Setup / Reset DB page and click Create / Reset Database to build the tables.
3. Log in again and pick a difficulty under DVWA Security.

Stop it with docker compose down. As with any vulnerable lab, never expose it to the Internet: run it locally or on an isolated lab network.

Security levels

Level	What it means
Low	No protection at all. Ideal for understanding the vulnerability in its purest form.
Medium	Typical but insufficient defences (blacklists, incomplete filters) that can be bypassed.
High	Stronger defences or a different twist, closer to a CTF challenge.
Impossible	A correct implementation. A reference for how the code should be written.

The level is stored in a cookie named security, which matters when you use external tools.

How to use DVWA: practical examples

Command injection (Low)

The Command Injection module pings whatever IP you enter. On Low nothing is filtered, so you can chain another command:

127.0.0.1; whoami

On Medium some characters get stripped; the challenge is finding separators the blacklist forgot.

SQL injection (Low)

The SQL Injection module looks up a user by ID. Try an always-true condition:

1' OR '1'='1

From there, practise the UNION SELECT technique to work out the column count and pull data from other tables.

Automating with sqlmap

Since DVWA requires a session, you have to hand sqlmap your cookie (copy it from the browser or Burp):

sqlmap -u "http://localhost:4280/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=YOUR_SESSION; security=low" --dbs

Do it by hand first and then with sqlmap, so you understand what the tool is automating.

Reflected and stored XSS

In the XSS (Reflected) and XSS (Stored) modules the goal is getting the browser to run injected JavaScript. On Low a script tag is enough; on Medium and High you will need other tags, case tricks or event attributes to slip past the filters.

Read the source

Every module has a View Source button. Use it after exploiting each level and compare it with Impossible: you will see parameterised queries, anti-CSRF tokens, allowlist validation and other real defences.

Pro tips

• Finish every module at every level before moving on. The jump from Low to Medium is where most of the learning happens.
• Intercept everything with a proxy: many medium-level protections exist only client-side and fall over once you edit the request.
• Write it up: payload, cause and fix for every bug, just like a real report.
• Move on when ready: once DVWA feels easy, try OWASP Juice Shop, which is more modern and complex.

Pros and cons

Pros	Cons
Free, open source and easy to set up	Dated stack (classic PHP, no modern API)
Security levels show how defences evolve	Low levels are very easy
Source code viewable inside the app	Does not track or score solved challenges
Huge number of tutorials and writeups	Not much like a modern application

DVWA alternatives

• OWASP Juice Shop: a modern app with far more challenges and a score board.
• PortSwigger Web Security Academy: free online labs with detailed theory.
• VulnHub: full virtual machines to practise locally.
• Root-Me: free web challenges by difficulty.

Frequently asked questions

What are the DVWA default credentials?

admin / password. If login fails, make sure you created the database from the Setup page.

Is DVWA legal?

Yes. It is designed to be attacked on your own machine. What is illegal is using those techniques against other people's systems without permission.

Why can't sqlmap find the injection?

Usually because the session cookie was not passed, or the security cookie is set to a different level than you expect.

DVWA or Juice Shop to start?

DVWA is simpler and isolates each bug, which makes it great for first steps. Juice Shop is the natural next step.

If you want to build the Linux and command-line foundation you will use in all these labs, practise at the Hackers en Acción Academy.