Damn Vulnerable Web Services

Damn Vulnerable Web Services (DVWS) is an intentionally insecure web application designed for educational purposes in web service security testing. The application contains multiple vulnerable web service components that demonstrate real-world security flaws commonly found in web services and APIs. It serves as a practical learning environment for security professionals to understand and practice identifying web application vulnerabilities. DVWS includes various vulnerability types such as WSDL enumeration, XML External Entity (XXE) injection, XML bomb denial-of-service attacks, XPath injection, and WSDL scanning capabilities. The platform also features cross-site tracing vulnerabilities, OS command injection flaws, and server-side request forgery (SSRF) issues. Additional security weaknesses implemented include REST API SQL injection vulnerabilities, same origin method execution flaws, and JSON Web Token (JWT) secret key brute force scenarios. The application demonstrates Cross-Origin Resource Sharing (CORS) misconfigurations as well. The tool requires XAMPP setup for deployment, utilizing Apache Web Server and MySQL database components. Users can access setup instructions and database configuration through the provided web interface at localhost/dvws/instructions.php.