{"name":"DVWA: Practice Web Application Security in a PHP/MariaDB Lab","description":"DVWA is a deliberately vulnerable PHP/MariaDB web application for security professionals, developers, students, and teachers to practice common web vulnerabilities. Its difficulty levels and Docker setup make it useful for controlled training, not public deployment.","github":"https://github.com/digininja/DVWA","url":"https://osrepos.com/repo/digininja-dvwa","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/digininja-dvwa","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/digininja-dvwa.md","json":"https://osrepos.com/repo/digininja-dvwa.json","topics":["php","security","web-app","education","web-security-training","vulnerable-web-application","sql-injection"],"keywords":["php","security","web-app","education","web-security-training","vulnerable-web-application","sql-injection"],"stars":null,"summary":"DVWA is a deliberately vulnerable PHP/MariaDB web application for security professionals, developers, students, and teachers to practice common web vulnerabilities. Its difficulty levels and Docker setup make it useful for controlled training, not public deployment.","content":"## Overview\n\nDamn Vulnerable Web Application (DVWA) is a deliberately vulnerable web application built with PHP and MariaDB. It gives security professionals, web developers, students, and teachers a controlled environment to practice common web vulnerabilities, test tools, and learn how application security issues work.\n\nChallenges offer different difficulty levels, and some vulnerabilities are intentionally undocumented so learners can investigate beyond guided exercises. DVWA is designed for a legal lab or classroom setting, not for hosting on an internet-facing server.\n\n## Key Features\n- Practice common web vulnerabilities through a straightforward web interface.\n- Set different security difficulty levels for challenges.\n- Explore both documented and intentionally undocumented vulnerabilities.\n- Run the application with Docker Compose, or install it on a PHP and MariaDB web stack.\n- Configure most settings through a PHP configuration file or environment variables.\n- Use the API lab with Apache `mod_rewrite` and Composer vendor files.\n- Switch SQL injection challenges to SQLite3 with additional PHP support.\n\n## Use Cases\n- Security professionals can exercise testing tools and techniques against a deliberately vulnerable target in an isolated lab.\n- Web developers can study how common application vulnerabilities arise and practice securing web applications.\n- Teachers can use the application for hands-on lessons in a controlled classroom environment.\n- Students can work through vulnerability challenges at different difficulty levels and investigate issues not documented in the application.\n\n## Our Take\nDVWA is an established, actively maintained training application with recent commits and contributions from a broad contributor base, though it has had no release in over a year.\n\n**Good fit if:**\n- You need a deliberately vulnerable PHP/MariaDB application for legal, controlled security training.\n- Docker Compose is a convenient way to run a local or workshop lab.\n- Your learners benefit from varying challenge difficulty and room for independent discovery.\n\n**Look elsewhere if:**\n- You need a secure application to deploy publicly or use as a production service.\n- Your training environment cannot provide PHP and MariaDB, or Docker and Docker Compose.\n- You need a recently published release rather than the actively updated development branch.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Active**: regular commits |\n| Last commit | 2026-10-18 (5 days ago) |\n| Commits, last 90 days | 16 |\n| Releases, last 12 months | 0 (latest 2.5, 2025-01-29) |\n| Contributors | 66 (top contributor: 57% of commits) |\n| Issues closed, last 90 days | 2 |\n| Pull requests merged, last 90 days | 6 (typically merged in 0 days) |\n| Project age | 13 years |\n\nChecked on 2026-10-24 with the GitHub API.\n\n## Project Facts\n\n- Language: PHP\n- License: GPL-3.0\n- Stars: 13.9k\n- Forks: 5.2k\n- Topics: dvwa, hacking, infosec, php, security, sql-injection, training\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- PHP (main language on GitHub)\n- A Dockerfile, so it can run in a container; a Compose file sets up the related services\n- A test suite and automated checks on GitHub Actions\n\n## Getting Started\nClone the repository and start the Docker Compose services:\n\n```sh\ngit clone https://github.com/digininja/DVWA.git\ncd DVWA\ndocker compose up -d\n```\n\nThen visit `http://localhost:4280`. See the README for manual installation, configuration, and database setup details.\n\n## License in Plain Words\n\n**GPL-3.0** (strong copyleft).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the license notice\n- Share your changes: yes, the full source of anything you distribute that includes it, under the GPL\n- Includes an explicit patent grant from the contributors\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Alternatives\n\n- [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank): Vuln Bank focuses on banking scenarios across web, API, GraphQL, and AI, while DVWA teaches common vulnerabilities in a deliberately vulnerable PHP app.\n\n| Project | Language | License | Stars | Status |\n|---|---|---|---|---|\n| **DVWA** | PHP | GPL-3.0 | 13.9k | Active |\n| [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank) | HTML | MIT | 960 | Maintained |\n\n## Considerations\n- DVWA is intentionally vulnerable. Keep it isolated and bound to localhost unless you deliberately configure a controlled workshop network; do not expose it to the internet.\n- The application needs a PHP web server and MariaDB for a manual setup. The Docker option requires Docker and Docker Compose.\n- The project documents limited support for older PHP versions and limited support for SQLite3 SQL injection setup.\n- The latest release is over a year old, although the repository remains active with regular commits and merged contributions. Its contributor base is not concentrated in one person.\n- The repository uses GPL-3.0. Review the license terms if you modify or redistribute it.","metrics":{"detailViews":2,"githubClicks":0},"dates":{"published":null,"modified":"2026-10-24T15:44:24.000Z"}}