DVWA (Damn Vulnerable Web Application) is an intentionally insecure PHP/MySQL web application used for practicing common web vulnerabilities like SQL injection, XSS, CSRF, and file inclusion in a safe, legal environment.

Does DVWA work on Ubuntu and Kali Linux?

Yes. DVWA runs on any Linux distribution that supports a LAMP stack (Apache, MySQL, PHP). This guide covers both Ubuntu 22.04+ and Kali Linux step by step.

How long does it take to install DVWA?

With all prerequisites met, DVWA installation takes approximately 10–15 minutes following this guide.

What PHP version is required for DVWA?

DVWA is compatible with PHP 7.4 and PHP 8.x. This guide uses PHP 8.2 with Apache on Ubuntu/Kali Linux.

DVWA should only be run on a local machine or isolated lab network. Never expose it to the public internet, as it is intentionally full of security vulnerabilities.

trust me! it works.

Hi, I'm Muhammad Aqib Bashir, and I'm here to guide you through setting up DVWA on your local machine.

Running into an error? 404s, database connection failures, blank pages, and more, all covered in the full troubleshooting guide.

View Troubleshooting Guide →

⭐

Did it work for you?

If this guide saved you time, a GitHub star helps others find it too.

Star on GitHub

Quick Reference

Check Service Status:

sudo systemctl status apache2
sudo systemctl status mysql

Restart Services:

sudo systemctl restart apache2
sudo systemctl restart mysql

Auto-Start on Boot:

sudo systemctl enable apache2
sudo systemctl enable mysql

View Apache Errors:

sudo tail -f /var/log/apache2/error.log