How to Install DVWA Quickly with Docker Compose

The official repository provides a Compose configuration that starts the web application and its MariaDB database together. It publishes the application on 127.0.0.1:4280, which means the site is reachable from the same computer but not from other devices by default. That loopback binding is an important safety control, not an inconvenience to remove.

docker version
docker compose version

git clone https://github.com/digininja/DVWA.git
cd DVWA
git rev-parse HEAD

docker compose config
docker compose up -d
docker compose ps

What Is DVWA, and Why Do People Call It OWASP DVWA?

DVWA stands for Damn Vulnerable Web Application. It is an intentionally insecure web application with multiple difficulty levels and source-view features that help learners connect browser behavior to server-side implementation decisions. The official OWASP Vulnerable Web Applications Directory describes it as a PHP and MariaDB application for legal training in a controlled environment.

The phrase OWASP DVWA is a common search term, but the project relationship should be stated accurately. DVWA is maintained in the digininja/DVWA GitHub repository. OWASP lists the application in its Vulnerable Web Applications Directory; OWASP does not maintain the DVWA source repository.

Safety Rules Before You Start DVWA

DVWA is designed to contain weaknesses. Its safety depends on the boundary around it. A normal web application may be hardened for shared networks; DVWA deliberately is not.

Official DVWA Download, Current Release and Source Options

The official README says that the only supported version is the latest source from the official GitHub repository. On August 4, 2026, the latest tagged release shown on the official Releases page is DVWA 2.5, released January 29, 2025. That release added an OpenAPI and vulnerable-API module, while the repository's master branch may include later changes.

For a personal lab, the current repository is usually the simplest choice. For a course or repeatable workshop, choose a tag or commit and record it with git rev-parse HEAD. This makes troubleshooting easier because every participant starts from the same source revision.

Install DVWA on Ubuntu, RHEL and Windows

If Docker and Docker Compose already work, skip directly to cloning or downloading DVWA. Otherwise, use the installation method documented by Docker for the operating system rather than relying on an old third-party script.

Ubuntu: Install Docker Engine and DVWA

Docker's current Ubuntu documentation supports maintained 64-bit Ubuntu releases and warns that published container ports can bypass some host firewall rules. DVWA's loopback binding reduces that exposure, but you should still review the Compose configuration before starting it.

sudo apt update
sudo apt install -y ca-certificates curl git
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world

git clone https://github.com/digininja/DVWA.git
cd DVWA
git rev-parse HEAD
sudo docker compose config
sudo docker compose up -d
sudo docker compose ps

Official reference: Install Docker Engine on Ubuntu. If Docker is already installed through another source, review Docker's conflicting-package guidance before replacing it.

RHEL: Install Docker Engine and DVWA

Use a maintained Red Hat Enterprise Linux release supported by Docker's current documentation. Review any existing Podman compatibility packages or older Docker packages before installing Docker Engine from Docker's repository.

sudo dnf -y install dnf-plugins-core git
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world

git clone https://github.com/digininja/DVWA.git
cd DVWA
git rev-parse HEAD
sudo docker compose config
sudo docker compose up -d
sudo docker compose ps

Official reference: Install Docker Engine on RHEL.

Windows 10 or Windows 11: Docker Desktop and PowerShell

Docker Desktop supports Windows 10 and Windows 11 when its current system requirements are met. The WSL 2 backend is the default and meets the needs of most users. Start Docker Desktop and confirm that Linux containers are active before running the commands below.

wsl --version
wsl --update

docker version
docker compose version

Invoke-WebRequest -Uri https://github.com/digininja/DVWA/archive/refs/heads/master.zip -OutFile DVWA-master.zip
Expand-Archive -Path .\DVWA-master.zip -DestinationPath . -Force
Set-Location .\DVWA-master

docker compose config
docker compose up -d
docker compose ps
Start-Process http://localhost:4280/setup.php

Official references: Install Docker Desktop on Windows and Docker Desktop WSL 2 backend.

Kali Linux and other Debian-based systems

DVWA's official README includes troubleshooting notes for Debian-based distributions, including Kali. For a clean installation, use Docker's supported packages for the underlying distribution where possible. Do not mix several Docker or container-engine package sources without understanding which daemon and Compose plugin your terminal is using.

DVWA Database Setup, Browser URLs and Default Login

Starting the containers does not automatically create the application tables and sample data. Complete the setup page before expecting the documented login to work.

1. Wait for both services to start and confirm them with docker compose ps.
2. Open /setup.php and select Create / Reset Database.
3. Allow the setup process to finish and follow the redirect, or open /login.php.
4. Enter the lowercase username admin and password password.
5. Confirm that the module menu, security-level control and source-view features are available.
6. Use only synthetic lab data and stop the containers after the session.

Use a Tag or Commit for Repeatable DVWA Classes

Cloning the master branch gives you the latest supported source, but a course taught over several weeks benefits from a fixed revision. Otherwise, two learners may receive different files if the repository changes between installations.

# Record the exact current revision
git rev-parse HEAD
git status --short

# Show available tags
git tag --sort=-version:refname | head

# Optional: use the 2.5 release for a repeatable lab
git checkout 2.5

docker compose config
docker compose pull
docker compose up -d

Store the commit or tag in the workshop instructions together with the Docker versions and the date the commands were verified. Do not assume that an old exported command sheet will remain accurate forever.

DVWA Start, Stop, Logs, Update and Reset Commands

Run these commands from the directory containing compose.yml. On Linux, keep sudo unless your account is intentionally configured for Docker access; membership in the Docker group is effectively high privilege on the host.

# Validate and start
docker compose config
docker compose up -d
docker compose ps

# Review recent logs
docker compose logs --tail=150

# Stop without deleting the database volume
docker compose down

# Update the current branch and refresh images
git pull --ff-only
docker compose pull
docker compose up -d

# Completely reset the disposable lab
docker compose down -v
docker compose up -d

docker compose down -v deletes the named database volume. Use it only when no lab data needs to be preserved. The reset is useful for a disposable training environment, but it is not a normal production database procedure.

DVWA Troubleshooting: Common Problems and Exact Checks

localhost:4280 does not open

Confirm Docker is running, validate the Compose file, check service state and review recent logs. The web application may take a short time to become ready while MariaDB initializes.

docker version
docker compose version
docker compose config
docker compose ps
docker compose logs --tail=150

# Linux: check the local listening port
sudo ss -ltnp | grep ':4280' || true

# Windows PowerShell: check the local listening port
Get-NetTCPConnection -LocalPort 4280 -ErrorAction SilentlyContinue

Port 4280 is already in use

Change only the host-side port and preserve the loopback address. For example, change 127.0.0.1:4280:80 to 127.0.0.1:8806:80, run docker compose up -d, and open http://localhost:8806.

The setup page loads, but database creation fails

Review the database service in docker compose ps and inspect its logs. On a disposable lab with nothing to preserve, a full volume reset can remove stale or incomplete database state.

The default login is rejected

Use lowercase admin and password. Return to /setup.php, create or reset the database, then retry in a private browser window if old localhost cookies are interfering.

Docker permission is denied on Linux

Use sudo docker ... as shown above. Docker documents an optional non-root configuration, but adding a user to the Docker group grants powerful host access. Review the official Linux post-installation guidance before making that change.

Another device cannot connect

This is the expected behavior of the safe default. The official configuration uses 127.0.0.1. Do not publish the deliberately vulnerable application to the internet. Use an isolated classroom network only when shared access is an explicit and supervised requirement.

A clean reset does not solve the problem

Record the operating system, Docker version, Compose version, Git commit, output of docker compose ps and relevant logs. Compare the issue against the official issue tracker before opening a new report.

How to Use DVWA as a Safe Learning Lab

A strong exercise should end with a defensive lesson, not merely an unexpected browser result. Keep every test inside the DVWA environment and use a repeatable workflow that connects behavior, source code, mitigation and evidence.

1. Record normal behavior. Note the page, request method, inputs, status code and expected response.
2. Change one controlled variable. Avoid broad automated activity and remain inside the selected module.
3. Compare security levels. Observe how the implementation changes between the available levels.
4. Read the source view. Identify the missing or improved server-side control.
5. Describe the root cause. Distinguish weak validation, unsafe interpretation, missing authorization, insecure configuration or another underlying problem.
6. Write the prevention. Explain the secure design or coding control that should replace the vulnerable behavior.
7. Define useful evidence. Identify the minimum request, response, identity and timing fields a defender would need without copying secrets into logs.
8. Reset and retest. Confirm the corrected behavior and record the result.

The current released OWASP Top 10 is the 2025 edition. DVWA remains useful for classic web-security concepts, but its module list should not be presented as a complete implementation of every modern Top 10 category. For broader practice, compare it with OWASP Juice Shop and review the OWASP Top 10 with practical examples.

DVWA Installation and Safety Checklist

Primary Sources Used for This Guide

• Official digininja/DVWA repository and README
• Official DVWA releases
• OWASP Vulnerable Web Applications Directory entry
• Docker Engine installation for Ubuntu
• Docker Engine installation for RHEL
• Docker Desktop installation for Windows
• OWASP Top 10 project

Frequently Asked Questions About DVWA Installation and Login