Damn Vulnerable Web Application (DVWA)
A deliberately vulnerable PHP/MySQL web application designed for security training, testing, and educational purposes in controlled environments.
A deliberately vulnerable PHP/MySQL web application designed for security training, testing, and educational purposes in controlled environments.
Checked October 2026.
Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application designed with intentional security vulnerabilities for educational and testing purposes.
The application serves as a controlled environment where security professionals can practice their skills and test security tools legally. Web developers can use DVWA to understand web application security processes and learn about common vulnerabilities.
DVWA functions as a training platform for both students and teachers in classroom environments focused on web application security education. The application contains multiple security flaws that users are encouraged to discover and exploit.
The tool requires deployment in isolated environments such as virtual machines with NAT networking mode to prevent exposure to public networks. It is typically used with XAMPP for web server and database functionality.
DVWA explicitly warns against deployment on public-facing servers due to its intentionally vulnerable nature, which would result in system compromise if exposed to the internet.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Damn Vulnerable Web Application (DVWA): features, pricing and alternatives.
Damn Vulnerable Web Application (DVWA) is a product in the Cyber Range Training category. It covers MySQL, PHP and Education.
Damn Vulnerable Web Application (DVWA) is free. Download and setup instructions are at https://github.com/digininja/DVWA/.
Alternatives to Damn Vulnerable Web Application (DVWA) listed on CybersecTools:
Compare all Damn Vulnerable Web Application (DVWA) alternatives at https://cybersectools.com/alternatives/damn-vulnerable-web-application-dvwa
Damn Vulnerable Web Application (DVWA) is available as on-premises software. It is listed for startups, small businesses and mid-market companies. It is free.
Side by side: features, pricing model and the company behind each one.
A deliberately vulnerable GraphQL application designed for security testing and educational purposes, containing multiple intentional flaws for learning GraphQL attack and defense techniques.
iOS application for testing iOS penetration testing skills in a legal environment.
Linux-based operating system intentionally vulnerable for cybersecurity practice.
An intentionally vulnerable web application containing multiple web service security flaws designed for educational purposes and security testing practice.
A deliberately vulnerable web application containing DOM-based XSS, CSRF, and other web vulnerabilities for security testing and educational purposes.
A live archive of DEF CON CTF challenges, vulnerable by design, for hackers to play safely.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
