DVWA: a PHP/MariaDB web application that is damn vulnerable (14k stars)
What it does
All text below is quoted directly from the project README.
>Damn Vulnerable Web Application (DVWA)
DAMN VULNERABLE WEB APPLICATION:
- Damn Vulnerable Web Application (DVWA) is a PHP/MariaDB web application that is damn vulnerable.
- Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.
- The aim of DVWA is to practice some of the most common web vulnerabilities, with various levels of difficulty, with a simple straightforward interface.
- Please note, there are both documented and undocumented vulnerabilities with this software.
- This is intentional. You are encouraged to try and discover as many issues as possible.
>git clone digininja/DVWA
Repository
digininja/DVWA
Repository stats
|Metric|Value|
|:-|:-|
|Stars|13,914|
|Forks|5.2k|
|Last release|2.5 (2025-01-29)|
|Languages|PHP 88.9%, JavaScript 5.2%, Hack 3.3%|
|Contributors|82|
|AI contributor accounts (Claude / Codex / Cursor / Copilot)|None|
|AI co-authored commits|None|
Main contributor
|Field|Value|
|:-|:-|
|Name|Robin Wood|
|GitHub|@digininja|
|Commits to this repo|329 (top contributor)|
|Bio|Hacker, coder, climber, runner. Co-founder of the SteelCon conference.|
|Company / Location|UK|
|Followers|1.7k|
──────────────────────────────
📌 How many great GitHub repos have you discovered and completely forgotten about?
Don't let another useful tool disappear into your Reddit feed. Get the community's best repos, organized by category, plus key takeaways from real developer discussions, delivered to your inbox twice a week.
📬 Never lose track of great repos again. Subscribe free.
2 points
SQL Injection with SQLmap on Kali: From Login Form to Database
The Sqlmap tool is an open-source tool that automates SQL injection testing.
It can handle what's done manually with a few commands.
SQL injection: simply put, if a web application sends the input it takes from the user straight to the database without filtering it, you can write SQL code there.
It could be a login form, a search box, a URL parameter, etc.
The application runs that code and the data in the database comes out.
Installing Docker and SQLmap
You need to test against a vulnerable application you set up yourself, not a real system.
For this we'll use DVWA (Damn Vulnerable Web Application).
It runs with Docker.
Installation:
sudo apt update && sudo apt install -y docker.io
sudo service docker start
Sqlmap:
sudo apt install -y sqlmap
sqlmap already comes installed on Kali Linux, but it's still worth running this to bring it up to the latest version.
Start DVWA
docker run --rm -d -p 80:80 vulnerables/web-dvwa
The container comes up with a single command.
From your browser, open
localhost
Let's enter the login credentials as admin and password.
!Logging in on the DVWA login screen with admin and password
On the setup page, click the Create - Reset Database button.
!Creating the database on the DVWA setup page
Then log in again. Set the security level to Low from the DVWA Security menu.
!Security level set to Low in the DVWA Security menu
Then go to the SQL injection page from the left menu.
!DVWA SQL Injection page
sqlmap needs the session cookie so it can act as if it's logged in to the application.
Let's grab the PHPSESSID value from F12 - Application - Cookies - localhost.
!PHPSESSID cookie value in the browser developer tools
List the Databases
sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \
--cookie="PHPSESSID=XXX; security=low" \
--dbs --batch
!Listing the databases with sqlmap --dbs
--dbs lists the available databases.
If the application is vulnerable, it returns dvwa and information_schema.
Adding --batch makes sqlmap proceed through the test without asking any questions.
To see the tables:
sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \
--cookie="PHPSESSID=XXX; security=low" \
-D dvwa --tables --batch
!Tables in the dvwa database with sqlmap --tables
The dvwa database shows the guestbook and users tables.
To dump the contents:
sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \
--cookie="PHPSESSID=...; security=low" \
-D dvwa -T users --dump --batch
!Usernames and hashes in the users table with sqlmap --dump
The usernames and MD5 hashes get dumped.
sqlmap automatically tries to crack the hashes with a dictionary attack.
Results like admin/password come back. If someone uses a common password, it finds it right away.
You should only use it on systems you're authorized to test or that you set up yourself. That's what DVWA is for anyway.
Sources:
https://github.com/sqlmapproject/sqlmap
https://github.com/digininja/DVWA
---
Originally written in Turkish on eminuzun.com. AI was used only for the translation.
Mentions
DVWA: a PHP/MariaDB web application that is damn vulnerable (14k stars) What it does All text below is quoted directly from the project README. >Damn Vulnerable Web Application (DVWA) DAMN VULNERABLE WEB APPLICATION: - Damn Vulnerable Web Application (DVWA) is a PHP/MariaDB web application that is damn vulnerable. - Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment. - The aim of DVWA is to practice some of the most common web vulnerabilities, with various levels of difficulty, with a simple straightforward interface. - Please note, there are both documented and undocumented vulnerabilities with this software. - This is intentional. You are encouraged to try and discover as many issues as possible. >git clone digininja/DVWA Repository digininja/DVWA Repository stats |Metric|Value| |:-|:-| |Stars|13,914| |Forks|5.2k| |Last release|2.5 (2025-01-29)| |Languages|PHP 88.9%, JavaScript 5.2%, Hack 3.3%| |Contributors|82| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|None| |AI co-authored commits|None| Main contributor |Field|Value| |:-|:-| |Name|Robin Wood| |GitHub|@digininja| |Commits to this repo|329 (top contributor)| |Bio|Hacker, coder, climber, runner. Co-founder of the SteelCon conference.| |Company / Location|UK| |Followers|1.7k| ────────────────────────────── 📌 How many great GitHub repos have you discovered and completely forgotten about? Don't let another useful tool disappear into your Reddit feed. Get the community's best repos, organized by category, plus key takeaways from real developer discussions, delivered to your inbox twice a week. 📬 Never lose track of great repos again. Subscribe free.
SQL Injection with SQLmap on Kali: From Login Form to Database The Sqlmap tool is an open-source tool that automates SQL injection testing. It can handle what's done manually with a few commands. SQL injection: simply put, if a web application sends the input it takes from the user straight to the database without filtering it, you can write SQL code there. It could be a login form, a search box, a URL parameter, etc. The application runs that code and the data in the database comes out. Installing Docker and SQLmap You need to test against a vulnerable application you set up yourself, not a real system. For this we'll use DVWA (Damn Vulnerable Web Application). It runs with Docker. Installation: sudo apt update && sudo apt install -y docker.io sudo service docker start Sqlmap: sudo apt install -y sqlmap sqlmap already comes installed on Kali Linux, but it's still worth running this to bring it up to the latest version. Start DVWA docker run --rm -d -p 80:80 vulnerables/web-dvwa The container comes up with a single command. From your browser, open localhost Let's enter the login credentials as admin and password. !Logging in on the DVWA login screen with admin and password On the setup page, click the Create - Reset Database button. !Creating the database on the DVWA setup page Then log in again. Set the security level to Low from the DVWA Security menu. !Security level set to Low in the DVWA Security menu Then go to the SQL injection page from the left menu. !DVWA SQL Injection page sqlmap needs the session cookie so it can act as if it's logged in to the application. Let's grab the PHPSESSID value from F12 - Application - Cookies - localhost. !PHPSESSID cookie value in the browser developer tools List the Databases sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \ --cookie="PHPSESSID=XXX; security=low" \ --dbs --batch !Listing the databases with sqlmap --dbs --dbs lists the available databases. If the application is vulnerable, it returns dvwa and information_schema. Adding --batch makes sqlmap proceed through the test without asking any questions. To see the tables: sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \ --cookie="PHPSESSID=XXX; security=low" \ -D dvwa --tables --batch !Tables in the dvwa database with sqlmap --tables The dvwa database shows the guestbook and users tables. To dump the contents: sqlmap -u "http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit" \ --cookie="PHPSESSID=...; security=low" \ -D dvwa -T users --dump --batch !Usernames and hashes in the users table with sqlmap --dump The usernames and MD5 hashes get dumped. sqlmap automatically tries to crack the hashes with a dictionary attack. Results like admin/password come back. If someone uses a common password, it finds it right away. You should only use it on systems you're authorized to test or that you set up yourself. That's what DVWA is for anyway. Sources: https://github.com/sqlmapproject/sqlmap https://github.com/digininja/DVWA --- Originally written in Turkish on eminuzun.com. AI was used only for the translation.