DVWA
Damn Vulnerable Web Application, a PHP web app with deliberately insecure code for practice.
Technical Architecture & Overview
DVWA is a long-running intentionally vulnerable web application covering SQL injection, XSS, file upload, command injection, CSRF, and more, with difficulty levels from impossible down to trivially broken. Each challenge shows the vulnerable source so learners can see what the flaw looks like in code. It runs from a LAMP stack or the official Docker image.
Targeted Technical Use Cases
Practicing web exploitation techniques and testing scanners against known-vulnerable code in a safe local target.
Evaluation & Trade-offs
Core Strengths
- +Difficulty settings let the same app serve beginners and advanced users.
- +Source view connects exploitation to vulnerable code.
- +Docker deployment takes minutes.
Trade-Offs & Limitations
- -PHP-era vulnerabilities only.
- -Dated UI and stack compared to modern apps.
Defensive Security Application
Security training for developers and testers on what web vulnerabilities look like in source.
Frequently Asked Questions
What is DVWA?→
DVWA is a long-running intentionally vulnerable web application covering SQL injection, XSS, file upload, command injection, CSRF, and more, with difficulty levels from impossible down to trivially broken. Each challenge shows the vulnerable source so learners can see what the flaw looks like in code. It runs from a LAMP stack or the official Docker image.
What is DVWA used for?→
Practicing web exploitation techniques and testing scanners against known-vulnerable code in a safe local target.
What are the strengths of DVWA?→
- +Difficulty settings let the same app serve beginners and advanced users.
- +Source view connects exploitation to vulnerable code.
- +Docker deployment takes minutes.
What are the limitations of DVWA?→
- +PHP-era vulnerabilities only.
- +Dated UI and stack compared to modern apps.
How is DVWA used defensively?→
Security training for developers and testers on what web vulnerabilities look like in source.