DVWA: Deliberately vulnerable web application for security training
PHP/MariaDB training platform for web security exploitation practice.
Learn more about DVWA
DVWA is a PHP-based web application backed by MariaDB that contains documented and undocumented security vulnerabilities across multiple difficulty levels. The application runs on standard web server stacks like XAMPP and is designed to be deployed in isolated environments such as virtual machines with NAT networking. It implements common web vulnerabilities including SQL injection, cross-site scripting, authentication bypass, and other OWASP-related issues with adjustable complexity settings. The tool serves as a practice platform for security professionals, developers learning secure coding practices, and students in classroom settings studying web application security.
Adjustable Difficulty Levels
Vulnerabilities scale across multiple difficulty settings from low to high complexity. Enables progressive learning paths for beginners through advanced security practitioners without requiring separate environments.
Undocumented Vulnerability Discovery
Contains intentional security flaws beyond the documented exercises, requiring active reconnaissance and analysis. Simulates real-world penetration testing scenarios where not all vulnerabilities are explicitly cataloged.
Isolated Deployment Model
Architected exclusively for VM-based isolated environments with explicit network isolation requirements. Prevents accidental internet exposure of vulnerable code through clear deployment constraints and security warnings.
import requests
# Test SQL injection vulnerability (low security)
session = requests.Session()
login_data = {'username': 'admin', 'password': 'password', 'Login': 'Login'}
session.post('http://localhost/DVWA/login.php', data=login_data)
# Exploit SQLi to extract data
payload = "1' OR '1'='1"
response = session.get('http://localhost/DVWA/vulnerabilities/sqli/', params={'id': payload, 'Submit': 'Submit'})
print(response.text)Related Repositories
Discover similar tools and frameworks used by developers
DOMPurify
DOM-based XSS sanitizer using native browser parsing.
Mobile-Security-Framework-MobSF
Automated pen-testing for Android, iOS, and Windows applications.
PentestGPT
AI-assisted Python framework for automated security testing.
Subfinder
Passive subdomain discovery via DNS resolution and validation.
Semgrep
Pattern-based code scanner for 30+ languages.
Related Reading
Guides and comparisons from the Greptile content library
Top AI Code Review Tools for Small Dev Teams 2026
Affordable, lightweight AI code review tools that help small teams catch bugs faster. Practical comparisons of accuracy, ease of use, and value for teams without enterprise budgets.
Best Security-Focused AI Code Review Tools [2026 Guide]
The six best security-focused AI code review tools, compared on SAST, SCA, DAST, and full-repo context, so you can pick the one that fits your codebase and your cycle times.
Best AI Code Review Tools for GitLab
Enterprise-grade AI code review tools for GitLab teams. In-depth comparison of accuracy, security, and integration features to accelerate your merge request workflows.
What is agentic coding? Benefits, risks, and best tools to consider
What engineering leaders need to know about agentic coding: how it differs from AI coding and vibe coding, how it works, the benefits and risks, and the tools worth evaluating.