Install | Start | Stop | Usage | Features | Configuration | Capture the flag | Tools | FAQ | Sec Tools | License
Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.
DVWA has an official Docker image available at Dockerhub, however by the time of writing this image did not receive any recent updates.
If you need an always up-to-date version or arm64
images, you can use the here provided Docker Compose setup. The image is built every night against the latest master branch of the DVWA and pushed to Dockehub.
Additionally this Docker image comes with a few CTF challenges that require you to completely compromise the machine and reach root access. Read here for details.
Available Architectures: amd64
, arm64
The following Docker image tags are rolling releases and are built and updated every night.
Docker Tag | Git Ref | PHP | Available Architectures |
---|---|---|---|
latest |
master | latest | amd64 , arm64 |
php-8.1 |
master | 8.1 |
amd64 , arm64 |
php-8.0 |
master | 8.0 |
amd64 , arm64 |
php-7.4 |
master | 7.4 |
amd64 , arm64 |
php-7.3 |
master | 7.3 |
amd64 , arm64 |
php-7.2 |
master | 7.2 |
amd64 , arm64 |
php-7.1 |
master | 7.1 |
amd64 , arm64 |
php-7.0 |
master | 7.0 |
amd64 , arm64 |
php-5.6 |
master | 5.6 |
amd64 , arm64 |
Clone repository from GitHub:
git clone https://github.com/cytopia/docker-dvwa
Inside the cloned repository (docker-dvwa/
directory):
make start
Inside the cloned repository (docker-dvwa/
directory):
make stop
After running make start
you can access DVWA in your browser via:
- Url: http://localhost:8000
- User:
admin
- Pass:
password
- π³ - Works out of the box on Linux, MacOS and Windows via Docker
- π - Comes in flavours of all common PHP version
- π΄ββ οΈ - Enhances DVWA with local exploitation challenges
- π - Docker images are updated every night against DVWA master branch
- π - Bundles Adminer to inspect the database
This setup allows you to configure a few settings via the .env
file.
Variable | Default | Settings |
---|---|---|
PHP_VERSION |
8.1 |
PHP version to run DVWA (5.6 , 7.0 , 7.1 , 7.2 , 7.3 , 7.4 , 8.0 or 8.1 ) |
LISTEN_PORT |
8000 |
Local port for the web server to listen on |
RECAPTCHA_PRIV_KEY |
Required to make the captcha module work. (See FAQ section below) | |
RECAPTCHA_PUB_KEY |
Required to make the captcha module work. (See FAQ section below) | |
PHP_DISPLAY_ERRORS |
0 |
Set to 1 to display PHP errors (if you want a really easy mode) |
The following .env
file variables are default settings and their values can also be changed from within the web interface:
Variable | Default | Settings |
---|---|---|
SECURITY_LEVEL |
medium |
Adjust the difficulty level for the challenges[1] ( low , medium , high or impossible ) |
PHPIDS_ENABLED |
0 |
Set to 1 to enable PHP WAF/IDS[2] (off by default) |
PHPIDS_VERBOSE |
0 |
Set to 1 to display WAF/IDS reasons for blocked requests |
[1] For the
SECURITY_LEVEL
changes to take effect, you will have to clear your cookies. Alternatively change it in the web interface.
[2] WAF (Web Application Firewall) / IDS (Intrusion Detection System)
Additionally to the default DVWA features, this flavour also contains a few flags that can be captured via various means (including local privilege escalation).
- Flag 1:
flag{b9bbcb33e11b80be759c4e844862482d}
- Flag 2:
flag{fc3fd58dcdad9ab23faca6e9a36e581c}
- Flag 3:
flag{eca7d1f3cf60a8b5344a49287b9076e4}
How to play?
- βοΈ You must gain access to the running Docker container through the web application.
- β You cannot use
docker exec -it dvwa_web bash
to gain access
Let me know on π¦ Twitter if you've solved them and how easy/difficult they were.
The DVWA Docker image contains the following tools assisting you in solving the challenges and also allowing you to gain access via reverse shells.
bash
netcat
ping
sudo
telnet
python3
Q: I want to proxy through BurpSuite, but it does not work on localhost
or 127.0.0.1
.
Browsers ususally bypass localhost
or 127.0.0.1
for proxy traffic. One solution is to add an alternative hostname to /etc/hosts
and access the application through that.
/etc/hosts
:
127.0.0.1 dvwa
Then use http://dvwa:8000 in your browser.
Q: How can I run DVWA with a different PHP version?
The here provided Docker images are built against all common PHP versions and you can easily select your version of choice in the .env prior startup. To do so, just uncomment the version of choice and restart the Docker Compose stack:
.env
# PHP VERSION
# -----------
# Uncomment one of the PHP versions you want to use for DVWA
#PHP_VERSION=5.6
#PHP_VERSION=7.0
#PHP_VERSION=7.1
#PHP_VERSION=7.2
#PHP_VERSION=7.3
#PHP_VERSION=7.4
#PHP_VERSION=8.0
PHP_VERSION=8.1
Q: How can I reset the database and start fresh?
The database uses a Docker volume and you can simply remove it via:
# the command below will stop all running container,
# remove their state and delete the MySQL docker volume.
make reset
Q: How can I view Apache access or error log files?
Log files are piped to stderr from the Docker container and you can view them via:
make logs
Q: How can I get a shell on the web server container?
Note: Doing so is basically cheating, you are supposed to gain access to the machine via exploitation.
You can enter the running web server container as root via:
make enter
Q: How do I setup the reCAPTCHA key?
Go to https://www.google.com/recaptcha/admin and generate your captcha as shown below:
- Ensure to choose
reCAPTCHA v2
- Ensure to add all domains you plan on using
![](https://github.com/cytopia/docker-dvwa/raw/master/doc/captcha-01-thumb.png)
- Add
SITE KEY
to theRECAPTCHA_PUB_KEY
variable in your.env
file - Add
SECRET KEY
to theRECAPTCHA_PRIV_KEY
variable in your.env
file
![](https://github.com/cytopia/docker-dvwa/raw/master/doc/captcha-02-thumb.png)
Q: How can I access/view the MySQL database?
Note: Doing so is basically cheating, but if you really need to, you can do so.
This Docker image bundles Adminer (a PHP web interace similar to phpMyAdmin) and you can access it here: http://localhost:8000/adminer.php
- Server:
dvwa_db
- Username:
root
- Password:
rootpass
![](https://github.com/cytopia/docker-dvwa/raw/master/doc/adminer.png)
Q: How can I build the Docker image locally?
To build or rebuild the Docker image against new updates in DVWA master branch, simply do the following:
# This is builing the image for the default PHP version
make rebuild
# This is building the image with PHP 8.0
make rebuild VERSION=8.0
# Rebuild PHP 8.1 for arm64 platform
make rebuild VERSION=8.0 ARCH=linux/arm64
This repository ships a Terraform module to deploy DVWA on AWS.
cd aws/
cp terraform.tfvars-example terraform.tfvars
terraform init
terraform apply
For more information see Terraform module.
This repository ships Kubernetes resources to deploy DVWA on K8s or minikube.
cd k8s/
kubectl apply -f .
For more information see k8s.
π cytopia sec tools
Below is a list of sec tools and docs I am maintaining, which might come in handy working on DVWA.
Name | Category | Language | Description |
---|---|---|---|
offsec | Documentation | Markdown | Offsec checklist, tools and examples |
header-fuzz | Enumeration | Bash | Fuzz HTTP headers |
smtp-user-enum | Enumeration | Python 2+3 | SMTP users enumerator |
urlbuster | Enumeration | Python 2+3 | Mutable web directory fuzzer |
pwncat | Pivoting | Python 2+3 | Cross-platform netcat on steroids |
badchars | Reverse Engineering | Python 2+3 | Badchar generator |
fuzza | Reverse Engineering | Python 2+3 | TCP fuzzing tool |
Copyright (c) 2021 cytopia