DVWA is a deliberately insecure PHP and MariaDB website for legal, local security practice. A first-time reader can use this page to understand the app, start it, create its database, sign in, and return later for the exact start, stop, log, and reset commands.
What is DVWA?
DVWA means Damn Vulnerable Web Application. It is a small training website that intentionally includes weaknesses such as SQL injection, cross-site scripting, command injection, weak authentication, and unsafe file handling. You run it on your own computer, use it only with permission, and compare how the same feature behaves at different security levels.
DVWA is maintained in the digininja GitHub repository and is listed in the OWASP Vulnerable Web Applications Directory. The Docker Compose files in that repository provide the most direct current setup.
Download, install, run and test DVWA
DVWA is an intentionally vulnerable PHP and MariaDB training site. The quickest reliable path is to install Docker, download the official repository, start its Compose stack, open the setup page, create the database, and then sign in.
Ubuntu: complete Bash installation
Open a Bash terminal and paste the full block. It installs every required package, downloads the current project or image, starts the lab, tests the web service, and prints the browser address.
RHEL, Rocky Linux or AlmaLinux: complete Bash installation
Open Bash and paste the full block. These commands use and the Docker RHEL repository.
Windows 10 or 11: complete cmd.exe installation
Open Command Prompt as Administrator. The first block installs Docker Desktop. If Windows requests a restart, restart, reopen , and paste the same block again.
Your first five minutes inside DVWA
After login, start at DVWA Security and choose Low only for the first guided pass. Open one module, submit a harmless sample input, and watch how the application responds. Then increase the security level and compare the result. The value is not memorizing payloads; it is seeing how validation, authorization, session handling, and output encoding change observable behavior.
For repeatable learning, keep a short notebook with the page, request parameters, response status, visible result, and the defensive control that would prevent the weakness in a real application.
Troubleshooting that actually helps
| Problem | What to check | Fix |
|---|---|---|
| Port 4280 does not open | Container status and logs | Run |
| Database setup returns an error | Database container readiness | Wait 20 seconds, refresh setup.php, and run Create / Reset Database again. |
| Login fails | Database initialization and credentials | Confirm the database was created, then use |
| Compose command is missing | Docker Compose plugin | Run |
How Ammune helps with production risks represented by DVWA
DVWA turns classic web weaknesses into visible request and response behavior. In production, the same patterns often appear through API endpoints, JSON parameters, tokens, object identifiers, and data-rich responses.
Build an inventory from observed traffic and show which endpoints, methods, parameters, and response fields are actually in use.
Inspect both sides of an API transaction so analysts can see the input, returned data, status, identity context, and related behavior.
Turn suspicious API activity into risk-ranked, SIEM-ready evidence that can support monitoring, investigation, and carefully controlled enforcement.
| Training weakness | Production API risk | How Ammune can help |
|---|---|---|
| SQL injection and command injection | Untrusted API input reaches a query, shell, or interpreter. | Inspect request parameters and payloads, correlate suspicious patterns with endpoint behavior, and create evidence for monitoring or enforcement. |
| Weak authentication and session handling | Stolen or abused credentials and tokens are reused across API calls. | Track abnormal identity, token, endpoint, and behavior combinations and surface unusual authentication sequences. |
| XSS and unsafe output | Untrusted content is returned to browsers or downstream clients. | Inspect response content and highlight unexpected executable content or sensitive data returned by an endpoint. |
| File and parameter abuse | Unexpected files, fields, or values reach a sensitive function. | Compare observed traffic with learned endpoint behavior and expose unusual methods, parameters, content types, or schema changes. |
Related Ammune guidance: API runtime visibility API behavior analytics API security testing vs runtime monitoring OWASP Juice Shop Docker installation and login guide
Verified project sources
The tutorial above is complete; these links are included for release history, project ownership, and future verification—not because you need to leave this page to finish the installation.
Frequently asked questions
Why is DVWA intentionally insecure?
It is a controlled teaching target designed to make common web weaknesses visible so learners can compare vulnerable behavior with safer implementation choices.
Is DVWA an OWASP-maintained project?
DVWA is maintained in the digininja repository and is listed in the OWASP Vulnerable Web Applications Directory; it is not maintained as an OWASP project.
Which DVWA security level should a beginner use?
Start with Low to understand the lesson, then repeat it at Medium and High to see how added controls change the request and response.
What should I record while using DVWA?
Record the endpoint, parameters, request method, response status, returned data and the security level so the lesson can be compared accurately.
What production lesson does DVWA teach?
Input validation, output encoding, authentication, file handling and command execution controls must be designed into the application and monitored at runtime.
Can Ammune replace secure coding?
No. Ammune adds production API visibility, behavior analysis and runtime evidence, but secure coding, authorization and incident response remain essential.
Apply the lessons from DVWA to real API traffic
Ammune helps security, DevSecOps, and SOC teams discover APIs, inspect requests and responses, identify abuse and data exposure, and turn runtime evidence into practical investigation or enforcement workflows.