# Damn Vulnerable Web Application (DVWA)

Damn Vulnerable Web Application (DVWA) is a Cyber Range Training product. It runs on-premises. Pricing is free.

A deliberately vulnerable PHP/MySQL web application designed for security training, testing, and educational purposes in controlled environments.

Checked October 2026.

## What is Damn Vulnerable Web Application (DVWA)?

Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application designed with intentional security vulnerabilities for educational and testing purposes.

The application serves as a controlled environment where security professionals can practice their skills and test security tools legally. Web developers can use DVWA to understand web application security processes and learn about common vulnerabilities.

DVWA functions as a training platform for both students and teachers in classroom environments focused on web application security education. The application contains multiple security flaws that users are encouraged to discover and exploit.

The tool requires deployment in isolated environments such as virtual machines with NAT networking mode to prevent exposure to public networks. It is typically used with XAMPP for web server and database functionality.

DVWA explicitly warns against deployment on public-facing servers due to its intentionally vulnerable nature, which would result in system compromise if exposed to the internet.

Tags: MySQL, PHP, Education, Vulnerable Applications

## Where it fits in your security program (NIST CSF 2.0)

- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.

## Quick facts

- Category: [Human Risk](https://cybersectools.com/categories/human-risk) · [Cyber Range Training](https://cybersectools.com/categories/cyber-range)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market
- Pricing model: Free
- GitHub stars: 12,763
- Website: github.com

## Damn Vulnerable Web Application (DVWA) FAQ

### What is Damn Vulnerable Web Application (DVWA)?

Damn Vulnerable Web Application (DVWA) is a product in the Cyber Range Training category. It covers MySQL, PHP and Education.

### What is the pricing for Damn Vulnerable Web Application (DVWA)?

Damn Vulnerable Web Application (DVWA) is free. Download and setup instructions are at https://github.com/digininja/DVWA/.

### What are alternatives to Damn Vulnerable Web Application (DVWA)?

Alternatives to Damn Vulnerable Web Application (DVWA) listed on CybersecTools:

1. [OffSec Proving Grounds](https://cybersectools.com/tools/offsec-proving-grounds) - Online lab platform offering hands-on penetration testing practice machines for OSCP prep (Commercial)
2. [Payatu BugBazaar](https://cybersectools.com/tools/payatu-bugbazaar) - Intentionally vulnerable mobile app for practicing Android and iOS penetration testing (Free)
3. [IronCircle Cybersecurity Training Platform](https://cybersectools.com/tools/ironcircle-cybersecurity-training-platform) - AI-powered browser-based cybersecurity training platform with labs and certs (Commercial)
4. [TryHackMe Cyber Security Training](https://cybersectools.com/tools/tryhackme-cyber-security-training) - Hands-on cybersecurity training platform with gamified labs and challenges (Commercial)
5. [Cybexer Cyber Ranges for Finance and Banking](https://cybersectools.com/tools/cybexer-cyber-ranges-for-finance-and-banking) - Cyber range platform for finance & banking sector security training (Commercial)

Compare all Damn Vulnerable Web Application (DVWA) alternatives at [https://cybersectools.com/alternatives/damn-vulnerable-web-application-dvwa](https://cybersectools.com/alternatives/damn-vulnerable-web-application-dvwa)

### What deployment and organization size does Damn Vulnerable Web Application (DVWA) fit?

Damn Vulnerable Web Application (DVWA) is available as on-premises software. It is listed for startups, small businesses and mid-market companies. It is free.

## Compare Damn Vulnerable Web Application (DVWA) with similar solutions

- [Damn Vulnerable Web Application (DVWA) vs OffSec Proving Grounds](https://cybersectools.com/compare/damn-vulnerable-web-application-dvwa-vs-offsec-proving-grounds)
- [Damn Vulnerable Web Application (DVWA) vs Payatu BugBazaar](https://cybersectools.com/compare/damn-vulnerable-web-application-dvwa-vs-payatu-bugbazaar)
- [Damn Vulnerable Web Application (DVWA) vs IronCircle Cybersecurity Training Platform](https://cybersectools.com/compare/damn-vulnerable-web-application-dvwa-vs-ironcircle-cybersecurity-training-platform)

All alternatives to Damn Vulnerable Web Application (DVWA): [/alternatives/damn-vulnerable-web-application-dvwa](https://cybersectools.com/alternatives/damn-vulnerable-web-application-dvwa)

---

Source: https://cybersectools.com/tools/damn-vulnerable-web-application-dvwa

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Damn Vulnerable Web Application (DVWA): funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md