ethicalhack3r/DVWA
DVWA
DVWA is a vulnerable web application sandbox and PHP security training environment. It serves as a deployable penetration testing target and an OWASP Top 10 lab designed for practicing exploits and simulating common web security vulnerabilities.
The application allows users to adjust security difficulty levels to match their skill level and toggle between different SQL database engines to test how various systems handle injection attacks. It includes a mechanism to disable authentication, enabling automated security tools to interact directly with the environment.
The project provides capabilities for vulnerability simulation, SQL injection testing, and general web security training. It includes tools for database initialization and configuration via environment variables.
Features
- Vulnerable Web Applications - Provides a deployable web application intentionally designed with security flaws for penetration testing practice.
- Language-Specific Security Training - Provides a PHP-based application designed to teach researchers and developers how to identify and exploit software flaws.
- Vulnerability Simulations - Creates a reproducible web environment with adjustable security levels to simulate real-world software flaws.
- Practice Environments - Provides a multi-engine environment for practicing and testing various SQL injection attack vectors.
- Penetration Testing Frameworks - Creates a safe, isolated environment for testing security tools and manual attack methods against known flaws.
- Web Application Penetration Testing - Offers a controlled, insecure environment to practice common web exploitation and build penetration testing skills.
- Simulated Vulnerabilities - Integrates known security flaws directly into business logic to create a realistic exploitation environment.
- SQL Injection Techniques - Provides an environment to experiment with how various SQL database engines respond to injection attacks.
- Security Labs and Practice - Serves as a hands-on lab for practicing exploits targeting the OWASP Top 10 critical web security risks.
- Database Engines - Allows users to toggle between different SQL database engines to test variant injection responses.
- Difficulty Settings - Adjusts source code execution paths and input validation based on a stored security difficulty level.
- Vulnerability Complexity Levels - Sets the complexity of available vulnerabilities to match the skill level of the user.
- Hacking Playground - Provides a intentionally vulnerable environment for security training.
- Vulnerable Applications - PHP/MySQL web application for testing security vulnerabilities.
- Vulnerable Test Targets - PHP-based web application for practicing common vulnerabilities.
