DVWA – Damn Vulnerable Web App
Damn Vulnerable Web App (DVWA) has released an updated version (v1.04) of their PHP/mySQL web application that is intended to be attacked. It’s intended to be run on a local (closed) network as a learning tool for exploits and vulnerabilities. As it sits now, it pretty much contains a lot of the basics – brute force, command execution, file inclusion, SQL injection, and XSS.
DVWA Home Screen
The app does provide some help and tips for accessing some of the basics of each type of attack. It also lets you view the source code as the attacks take place (useful for debugging your XSS and SQL injection attacks). It also gives you three different levels of security for the site. This can show you as well how to prevent these attacks.
DVWA Security Settings
DVWA Source View
It’s a great tool if you’re just getting started and need the basics to get the ball rolling. But if you’re experienced at all, you may find this a little boring. It would be nice to see some advanced stuff, but if you’re at that level, you probably don’t need to be playing with apps like these. You’re probably already writing your own.
You can find the latest development files here SVN or grab the latest release version here ZIP.
Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions. For more information about how Gemini Security Solutions can help you solve your security issues, contact us!
July 27th, 2009 at 10:05 am
[...] not find DVWA as useful as someone who’s just starting out. You can read the full review here. #2 – Bejtlich Strikes Again: Offering an awesome breakdown of what white hat could do with a [...]
August 6th, 2010 at 5:39 pm
Hi – really great web site you have made. I enjoyed reading this posting. I did want to write a remark to tell you that the design of this site is very aesthetically pleasing. I used to be a graphic designer, now I am a copy editor for a merchandising firm. I have always enjoyed playing with computing machines and am trying to learn code in my free time (which there is never enough of lol).