cytopia/dvwa

Dockerized DVWA

Install | Start | Stop | Usage | Features | Configuration | Capture the flag | Tools | FAQ | Sec Tools | License

https://github.com/cytopia/docker-dvwa/workflows/build/badge.svg](https://github.com/cytopia/docker-dvwa/actions?query=workflow%3Abuild) https://github.com/cytopia/docker-dvwa/workflows/nightly/badge.svg](https://github.com/cytopia/docker-dvwa/actions?query=workflow%3Anightly) ![License]([***]

Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.

https://github.com/digininja/DVWA

https://github.com/digininja/DVWA has an official Docker image available at https://hub.docker.com/r/vulnerables/web-dvwa/, however by the time of writing this image did not receive any recent updates.

If you need an always up-to-date version or arm64 images, you can use the here provided Docker Compose setup. The image is built every night against the latest master branch of the https://github.com/digininja/DVWA and pushed to https://hub.docker.com/r/cytopia/dvwa.

Additionally this Docker image comes with a few CTF challenges that require you to completely compromise the machine and reach root access. Read here for details.

Available Architectures: amd64, arm64

:whale: Available Docker image versions

Rolling releaess

The following Docker image tags are rolling releases and are built and updated every night.

https://github.com/cytopia/docker-dvwa/workflows/nightly/badge.svg](https://github.com/cytopia/docker-dvwa/actions?query=workflow%3Anightly)

:tada: Install

Clone repository from GitHub:

bash
git clone https://github.com/cytopia/docker-dvwa

:zap: Start

Inside the cloned repository (docker-dvwa/ directory):

bash
make start

:no_entry_sign: Stop

Inside the cloned repository (docker-dvwa/ directory):

bash
make stop

:computer: Usage

After running make start you can access DVWA in your browser via:

• Url: http://localhost:8000
• User: admin
• Pass: password

:star: Features

• :whale: - Works out of the box on Linux, MacOS and Windows via Docker
• :elephant: - Comes in flavours of all common PHP version
• :pirate_flag: - Enhances DVWA with local exploitation challenges
• :repeat: - Docker images are https://hub.docker.com/r/cytopia/dvwa against https://github.com/digininja/DVWA master branch
• :open_file_folder: - Bundles Adminer to inspect the database

:wrench: Configuration

This setup allows you to configure a few settings via the .env file.

The following .env file variables are default settings and their values can also be changed from within the web interface:

^[1] For the SECURITY_LEVEL changes to take effect, you will have to clear your cookies. Alternatively change it in the web interface.
^[2] WAF (Web Application Firewall) / IDS (Intrusion Detection System)

:pirate_flag: Capture the flag

Additionally to the default DVWA features, this flavour also contains a few flags that can be captured via various means (including local privilege escalation).

• Flag 1: flag{b9bbcb33e11b80be759c4e844862482d}
• Flag 2: flag{fc3fd58dcdad9ab23faca6e9a36e581c}
• Flag 3: flag{eca7d1f3cf60a8b5344a49287b9076e4}

How to play?

• :heavy_check_mark: You must gain access to the running Docker container through the web application.
• :no_entry: You cannot use docker exec -it dvwa_web bash to gain access

Let me know on :bird: *** if you've solved them and how easy/difficult they were.

:gear: Tools

The DVWA Docker image contains the following tools assisting you in solving the challenges and also allowing you to gain access via reverse shells.

• bash
• netcat
• ping
• sudo
• telnet
• python3

:bulb: FAQ

bash
127.0.0.1  dvwa

bash
# PHP VERSION
# -----------
# Uncomment one of the PHP versions you want to use for DVWA
#PHP_VERSION=5.6
#PHP_VERSION=7.0
#PHP_VERSION=7.1
#PHP_VERSION=7.2
#PHP_VERSION=7.3
#PHP_VERSION=7.4
#PHP_VERSION=8.0
PHP_VERSION=8.1

bash
# the command below will stop all running container,
# remove their state and delete the MySQL docker volume.
make reset

bash
make logs

bash
make enter

bash
# This is builing the image for the default PHP version
make rebuild

# This is building the image with PHP 8.0
make rebuild PHP=8.0

:rocket: Deployment

AWS

https://github.com/cytopia/docker-dvwa/actions/workflows/terraform.yml/badge.svg](https://github.com/cytopia/docker-dvwa/actions/workflows/terraform.yml)

This repository ships a Terraform module to deploy DVWA on AWS.

bash
cd aws/
cp terraform.tfvars-example terraform.tfvars

terraform init
terraform apply

For more information see Terraform module.

Kubernetes

https://github.com/cytopia/docker-dvwa/actions/workflows/kubernetes.yml/badge.svg](https://github.com/cytopia/docker-dvwa/actions/workflows/kubernetes.yml)

This repository ships Kubernetes resources to deploy DVWA on K8s or minikube.

bash
cd k8s/
kubectl apply -f .

For more information see k8s.

:lock: https://github.com/cytopia sec tools

Below is a list of sec tools and docs I am maintaining, which might come in handy working on DVWA.

:page_facing_up: License

MIT License

Copyright (c) 2021 https://github.com/cytopia