DVWA
Damn Vulnerable Web Application, a PHP web app with deliberately insecure code for practice.
Technical Architecture & Overview
DVWA is a long-running intentionally vulnerable web application covering SQL injection, XSS, file upload, command injection, CSRF, broken access control, API flaws, and more. Low, Medium, and High security levels show progressively harder flawed defenses, and an Impossible level shows a secure implementation for comparison. Each challenge shows its source so learners can see what the flaw looks like in code. It runs on a PHP and MySQL stack such as XAMPP or through Docker Compose with images published to GitHub Container Registry.
Targeted Technical Use Cases
Practicing web exploitation techniques and testing scanners against known-vulnerable code in a safe local target.
Evaluation & Trade-offs
Core Strengths
- +Difficulty settings let the same app serve beginners and advanced users.
- +Source view connects exploitation to vulnerable code.
- +Docker Compose setup with a prebuilt image on GitHub Container Registry.
Trade-Offs & Limitations
- -Single PHP application, so framework-specific flaws in modern stacks are out of scope.
- -Must stay off internet-facing servers, since the README warns such installs will be compromised.
Defensive Security Application
Security training for developers and testers on what web vulnerabilities look like in source.
Frequently Asked Questions
What is DVWA?→
DVWA is a long-running intentionally vulnerable web application covering SQL injection, XSS, file upload, command injection, CSRF, broken access control, API flaws, and more. Low, Medium, and High security levels show progressively harder flawed defenses, and an Impossible level shows a secure implementation for comparison. Each challenge shows its source so learners can see what the flaw looks like in code. It runs on a PHP and MySQL stack such as XAMPP or through Docker Compose with images published to GitHub Container Registry.
What is DVWA used for?→
Practicing web exploitation techniques and testing scanners against known-vulnerable code in a safe local target.
What are the strengths of DVWA?→
- +Difficulty settings let the same app serve beginners and advanced users.
- +Source view connects exploitation to vulnerable code.
- +Docker Compose setup with a prebuilt image on GitHub Container Registry.
What are the limitations of DVWA?→
- +Single PHP application, so framework-specific flaws in modern stacks are out of scope.
- +Must stay off internet-facing servers, since the README warns such installs will be compromised.
How is DVWA used defensively?→
Security training for developers and testers on what web vulnerabilities look like in source.