Fastest bWAPP setup: Docker, installer, and login

Already have Docker, Docker Compose, and Git? The block below clones the community-maintained PHP 7.4 adaptation, records the exact Git commit for repeatability, and replaces its default Compose exposure with a localhost-only configuration. The database remains inside Docker and is not published to the host.

git clone https://github.com/lmoroz/bWAPP.git bwapp-lab
cd bwapp-lab
git rev-parse HEAD | tee BWAPP_COMMIT.txt

cat > compose.local.yml <<'YAML'
services:
  web:
    build: .
    image: bwapp-local:php74
    ports:
      - "127.0.0.1:8080:80"
    depends_on:
      - db
    environment:
      MYSQL_HOST: db
      MYSQL_USER: root
  db:
    image: mysql:5.7
    environment:
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    volumes:
      - bwapp_db_data:/var/lib/mysql
volumes:
  bwapp_db_data:
YAML

docker compose -f compose.local.yml up -d --build
docker compose -f compose.local.yml ps

# Show status and recent logs
docker compose -f compose.local.yml ps
docker compose -f compose.local.yml logs --tail 120

# Stop the lab but keep its database
docker compose -f compose.local.yml stop

# Start it again later
docker compose -f compose.local.yml start

# Remove containers and the training database
docker compose -f compose.local.yml down -v

What bWAPP is—and what it is not

bWAPP means “buggy web application.” It is a free, open-source PHP/MySQL application intentionally built with vulnerable behavior for authorized education. The project and OWASP’s directory describe more than 100 exercises spanning injection, scripting, authentication, authorization, file handling, server-side request forgery, XML, web services, parameter tampering, insecure configuration, and other historical web-security topics.

The most accurate phrasing is: bWAPP is listed by OWASP, but it is not an OWASP-maintained application. That distinction improves technical accuracy and avoids implying that every exercise maps directly to the current OWASP Top 10.

Which bWAPP installation method should you choose?

For most readers, a localhost-only Docker build is the simplest option. Use the official ZIP when provenance or source inspection matters. Use bee-box only when a course expects it or when the original environment is more important than modern host integration.

Install bWAPP on Ubuntu, RHEL, Kali Linux, or Windows

The bWAPP application steps remain the same after Docker is available. What changes is the supported installation method for Docker and Compose on each operating system. Before copying commands, confirm that your OS release is supported by the current vendor documentation.

sudo apt update
sudo apt install -y ca-certificates curl git
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world

sudo git clone https://github.com/lmoroz/bWAPP.git /opt/bwapp-lab
cd /opt/bwapp-lab
sudo git rev-parse HEAD | sudo tee BWAPP_COMMIT.txt
sudo tee compose.local.yml >/dev/null <<'YAML'
services:
  web:
    build: .
    image: bwapp-local:php74
    ports:
      - "127.0.0.1:8080:80"
    depends_on:
      - db
    environment:
      MYSQL_HOST: db
      MYSQL_USER: root
  db:
    image: mysql:5.7
    environment:
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    volumes:
      - bwapp_db_data:/var/lib/mysql
volumes:
  bwapp_db_data:
YAML
sudo docker compose -f compose.local.yml up -d --build

sudo dnf -y install git dnf-plugins-core
sudo dnf config-manager --add-repo \
  https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world

sudo git clone https://github.com/lmoroz/bWAPP.git /opt/bwapp-lab
cd /opt/bwapp-lab
sudo git rev-parse HEAD | sudo tee BWAPP_COMMIT.txt
sudo tee compose.local.yml >/dev/null <<'YAML'
services:
  web:
    build: .
    image: bwapp-local:php74
    ports:
      - "127.0.0.1:8080:80"
    depends_on:
      - db
    environment:
      MYSQL_HOST: db
      MYSQL_USER: root
  db:
    image: mysql:5.7
    environment:
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    volumes:
      - bwapp_db_data:/var/lib/mysql
volumes:
  bwapp_db_data:
YAML
sudo docker compose -f compose.local.yml up -d --build

sudo apt update
sudo apt install -y docker.io docker-compose git
sudo systemctl enable docker --now
sudo docker run --rm hello-world

git clone https://github.com/lmoroz/bWAPP.git "$HOME/bwapp-lab"
cd "$HOME/bwapp-lab"
git rev-parse HEAD | tee BWAPP_COMMIT.txt
cat > compose.local.yml <<'YAML'
services:
  web:
    build: .
    image: bwapp-local:php74
    ports:
      - "127.0.0.1:8080:80"
    depends_on:
      - db
    environment:
      MYSQL_HOST: db
      MYSQL_USER: root
  db:
    image: mysql:5.7
    environment:
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    volumes:
      - bwapp_db_data:/var/lib/mysql
volumes:
  bwapp_db_data:
YAML
sudo docker-compose -f compose.local.yml up -d --build

# PowerShell as Administrator: enable or update WSL
wsl --install
wsl --update

# Install Git and Docker Desktop with WinGet
winget install -e --id Git.Git --source winget
winget install -e --id Docker.DockerDesktop --source winget

# Restart if requested, start Docker Desktop, then run PowerShell normally
git clone https://github.com/lmoroz/bWAPP.git "$HOME\bwapp-lab"
Set-Location "$HOME\bwapp-lab"
git rev-parse HEAD | Set-Content BWAPP_COMMIT.txt
@'
services:
  web:
    build: .
    image: bwapp-local:php74
    ports:
      - "127.0.0.1:8080:80"
    depends_on:
      - db
    environment:
      MYSQL_HOST: db
      MYSQL_USER: root
  db:
    image: mysql:5.7
    environment:
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    volumes:
      - bwapp_db_data:/var/lib/mysql
volumes:
  bwapp_db_data:
'@ | Set-Content -Encoding utf8 compose.local.yml

docker compose -f compose.local.yml up -d --build
docker compose -f compose.local.yml ps

Official bWAPP download, SourceForge, bee-box, and GitHub

The official ITSEC GAMES website points to SourceForge for the original project files and bee-box. SourceForge currently lists bWAPP v2.2, modified on November 2, 2014, as the latest application archive. OWASP’s directory links to the same project but does not maintain the code.

curl -L \
  "https://sourceforge.net/projects/bwapp/files/bWAPP/bWAPPv2.2/bWAPPv2.2.zip/download" \
  -o bWAPPv2.2.zip

# Record a local hash and inspect the archive contents
sha256sum bWAPPv2.2.zip
unzip -l bWAPPv2.2.zip | less

bWAPP install.php, login page, and documented credentials

The first page is the database installer. Open http://127.0.0.1:8080/bWAPP/install.php, use the installation link once, and wait for a success message before opening login.php. The project documentation and common lab builds use bee as the username and bug as the password.

If login fails, confirm that the installation completed, clear only the lab site’s cookies, and review both service logs. Resetting the database volume is a last resort because it deletes all local training state.

A better bWAPP walkthrough: learn the control, not just the answer

A useful lab note should be reproducible, defensive, and limited to the environment you control. Avoid collecting payload lists without explaining why the application accepted the input or how a production system should prevent the same class of failure.

bWAPP SSRF lesson: a safe local learning method

bWAPP includes a server-side request forgery exercise. The safe objective is to observe that the application server makes a request based on user-controlled input, then identify the missing destination controls. Keep every destination on loopback or inside the same isolated lab; do not probe cloud metadata services, school/work systems, or networks you do not own.

Exercise goal: observe a server making a request from user-controlled input.
Safe destination: 127.0.0.1 or a service created inside the same private lab.
Record: baseline request, changed input, response difference, server-side effect.
Root cause: destination is trusted without strict validation.
Defenses: exact allowlist, DNS and resolved-IP validation, redirect checks,
egress restrictions, short timeouts, response limits, and minimal logging.

For defensive controls, use the OWASP SSRF Prevention Cheat Sheet. For API-specific context, see OWASP API7:2023.

bWAPP troubleshooting: fix the common setup problems

# Container state and logs
docker compose -f compose.local.yml ps
docker compose -f compose.local.yml logs --tail 200 web
docker compose -f compose.local.yml logs --tail 200 db

# Check whether port 8080 is already used on Linux
sudo ss -lntp | grep ':8080' || true

# Validate the Compose file before rebuilding
docker compose -f compose.local.yml config

# Rebuild after a failed or partial build
docker compose -f compose.local.yml down
docker compose -f compose.local.yml build --no-cache
docker compose -f compose.local.yml up -d

# Intentionally erase the local training database
docker compose -f compose.local.yml down -v
docker compose -f compose.local.yml up -d --build

Primary sources and current references

The guide distinguishes official project sources, OWASP catalog entries, current platform documentation, and community code.

What bWAPP can teach—and where modern security goes further

bWAPP is mainly a traditional web application lab. Its most transferable skill is the observation loop: identify the route, capture a normal baseline, change one controlled input, compare the result, name the trust failure, and define both a preventive control and a regression test.

Continue with the OWASP Top 10 guide, the API risk guide, and the API security evaluation checklist.

bWAPP lab checklist before you begin

Conclusion: keep bWAPP local, repeatable, and honest about its age

bWAPP remains useful because it gathers many classic web-security mistakes into one selectable training application. The most practical modern setup is a reviewed community Docker build with a localhost-only Compose override and the exact Git commit recorded. The official v2.2 source and bee-box remain available through the project’s SourceForge pages, while OWASP provides independent directory entries.

Open the installer locally, use the documented training account, capture a normal baseline, change one input at a time, and finish each exercise with the root cause, production control, and regression test. Just as importantly, recognize the limits: a 2014 training application is a foundation for learning—not a complete map of the OWASP Top 10:2025 or modern API security.

bWAPP frequently asked questions