bWAPP, short for buggy Web Application, is a legacy PHP and MySQL training app with more than one hundred intentionally vulnerable exercises. This guide uses the fastest practical community Docker image, clearly labels that dependency, completes the database setup, and keeps the login and lifecycle commands together.
What is bWAPP?
bWAPP is a deliberately insecure PHP application created for authorized web-security training. It includes a broad set of lessons covering injection, cross-site scripting, authentication, file handling, SSRF, XML, and other classic web weaknesses.
The original bWAPP source and bee-box VM are hosted on SourceForge and are now legacy releases. The Docker method below uses the community-maintained image because the original project does not publish a current official container. The page keeps that distinction visible so readers know exactly what they are running.
Download, install, run and test bWAPP
bWAPP is a legacy PHP and MySQL training application with more than one hundred deliberately vulnerable exercises. The original project does not publish a current official container, so the quickest cross-platform path below clearly uses a community image; the original SourceForge ZIP is also provided.
Ubuntu: complete Bash installation
Open a Bash terminal and paste the full block. It installs every required package, downloads the current project or image, starts the lab, tests the web service, and prints the browser address.
RHEL, Rocky Linux or AlmaLinux: complete Bash installation
Open Bash and paste the full block. These commands use and the Docker RHEL repository.
Windows 10 or 11: complete cmd.exe installation
Open Command Prompt as Administrator. The first block installs Docker Desktop. If Windows requests a restart, restart, reopen , and paste the same block again.
The installation view confirms that the local lab is ready. The next visual introduces the broader request and response context you should keep in mind before starting the guided bWAPP walkthrough below.
A practical first bWAPP walkthrough
After the database is created, sign in and choose one simple lesson such as reflected input handling or authentication behavior. Keep the security level low for the first pass, then raise it and compare how the response changes. The application contains many older vulnerability examples, so connect each exercise to the underlying principle rather than assuming the exact implementation matches a modern framework.
For SSRF exercises, use only destinations that belong to your own local lab. The learning goal is to understand why a server should restrict outbound destinations, protocols, redirects, DNS resolution, and response handling.
Troubleshooting that actually helps
| Problem | What to check | Fix |
|---|---|---|
| install.php does not load | Container and port mapping | Run |
| Database creation fails | Container initialization | Wait ten seconds, reload install.php, and inspect |
| bee / bug login fails | Database not created | Return to install.php and complete the database setup first. |
| Port 8080 is busy | Another local application | Stop the other service or change the host side of the port mapping. |
How Ammune helps with production risks represented by bWAPP
bWAPP covers a very broad set of classic weaknesses. Ammune can map many of those lessons to real API request and response behavior, while infrastructure controls still remain necessary for risks such as server-side egress.
Build an inventory from observed traffic and show which endpoints, methods, parameters, and response fields are actually in use.
Inspect both sides of an API transaction so analysts can see the input, returned data, status, identity context, and related behavior.
Turn suspicious API activity into risk-ranked, SIEM-ready evidence that can support monitoring, investigation, and carefully controlled enforcement.
| Training weakness | Production API risk | How Ammune can help |
|---|---|---|
| SSRF-style URL parameters | An API accepts a URL or host value that causes the server to fetch an unintended destination. | Identify suspicious URL-bearing parameters and response anomalies; network egress filtering and cloud metadata protection are still required to stop all SSRF paths. |
| Injection and XSS | Untrusted parameters reach a query, interpreter, or returned page. | Inspect payloads and responses, identify unusual structures, and provide endpoint context for investigation or policy decisions. |
| Weak authentication and sessions | Predictable or reused credentials and sessions enable API misuse. | Correlate identity, token, endpoint, and behavior patterns to surface unusual login and session activity. |
| File and XML processing | Unexpected files or XML structures reach sensitive parsers. | Detect unusual content types, methods, payload shapes, parser-related errors, and response leakage around affected endpoints. |
Related Ammune guidance: OWASP API SSRF API abuse detection API response data leakage OWASP Juice Shop Docker installation and login guide
Verified project sources
The tutorial above is complete; these links are included for release history, project ownership, and future verification—not because you need to leave this page to finish the installation.
Frequently asked questions
Why is bWAPP considered a legacy lab?
Its original release is older and its dependencies reflect an earlier PHP and MySQL ecosystem, although its vulnerability lessons remain educational.
Is the community Docker image an official bWAPP release?
No. It is a convenience image maintained outside the original SourceForge project, so use it only in an isolated lab and verify the image source.
What does the bWAPP security level change?
It changes how much protection the application applies, letting learners compare weak and stronger handling of the same input.
Why is SSRF important beyond bWAPP?
Server-side request forgery can let an application reach internal services, metadata endpoints or destinations the user could not contact directly.
What should be modernized before using bWAPP in a class?
Keep it isolated, use disposable containers or a VM, avoid real credentials and reset the environment between groups.
How can Ammune help with related production behavior?
Ammune can identify unusual API destinations, parameters, response data and behavior patterns, while network egress controls remain essential for SSRF prevention.
Apply the lessons from bWAPP to real API traffic
Ammune helps security, DevSecOps, and SOC teams discover APIs, inspect requests and responses, identify abuse and data exposure, and turn runtime evidence into practical investigation or enforcement workflows.