docker-dvwa

Dockerized DVWA

Install | Start | Stop | Usage | Features | Configuration | Capture the flag | Tools | FAQ | Sec Tools | License

Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.

https://github.com/digininja/DVWA

DVWA has an official Docker image available at Dockerhub, however by the time of writing this image did not receive any recent updates.

If you need an always up-to-date version or arm64 images, you can use the here provided Docker Compose setup. The image is built every night against the latest master branch of the DVWA and pushed to Dockehub.

Additionally this Docker image comes with a few CTF challenges that require you to completely compromise the machine and reach root access. Read here for details.

Available Architectures: amd64, arm64

:whale: Available Docker image versions

Rolling releaess

The following Docker image tags are rolling releases and are built and updated every night.

:tada: Install

Clone repository from GitHub:

git clone https://github.com/cytopia/docker-dvwa

:zap: Start

Inside the cloned repository (docker-dvwa/ directory):

make start

:no_entry_sign: Stop

Inside the cloned repository (docker-dvwa/ directory):

make stop

:computer: Usage

After running make start you can access DVWA in your browser via:

• Url: http://localhost:8000
• User: admin
• Pass: password

:star: Features

• :whale: - Works out of the box on Linux, MacOS and Windows via Docker
• :elephant: - Comes in flavours of all common PHP version
• :pirate_flag: - Enhances DVWA with local exploitation challenges
• :repeat: - Docker images are updated every night against DVWA master branch
• :open_file_folder: - Bundles Adminer to inspect the database

:wrench: Configuration

This setup allows you to configure a few settings via the .env file.

The following .env file variables are default settings and their values can also be changed from within the web interface:

^[1] For the SECURITY_LEVEL changes to take effect, you will have to clear your cookies. Alternatively change it in the web interface.
^[2] WAF (Web Application Firewall) / IDS (Intrusion Detection System)

:pirate_flag: Capture the flag

Additionally to the default DVWA features, this flavour also contains a few flags that can be captured via various means (including local privilege escalation).

• Flag 1: flag{b9bbcb33e11b80be759c4e844862482d}
• Flag 2: flag{fc3fd58dcdad9ab23faca6e9a36e581c}
• Flag 3: flag{eca7d1f3cf60a8b5344a49287b9076e4}

How to play?

• :heavy_check_mark: You must gain access to the running Docker container through the web application.
• :no_entry: You cannot use docker exec -it dvwa_web bash to gain access

Let me know on :bird: Twitter if you’ve solved them and how easy/difficult they were.

:gear: Tools

The DVWA Docker image contains the following tools assisting you in solving the challenges and also allowing you to gain access via reverse shells.

• bash
• netcat
• ping
• sudo
• telnet
• python3

:bulb: FAQ

127.0.0.1  dvwa

# PHP VERSION
# -----------
# Uncomment one of the PHP versions you want to use for DVWA
#PHP_VERSION=5.6
#PHP_VERSION=7.0
#PHP_VERSION=7.1
#PHP_VERSION=7.2
#PHP_VERSION=7.3
#PHP_VERSION=7.4
#PHP_VERSION=8.0
PHP_VERSION=8.1

# the command below will stop all running container,
# remove their state and delete the MySQL docker volume.
make reset

make logs

make enter

Q: How do I setup the reCAPTCHA key?

Go to https://www.google.com/recaptcha/admin and generate your captcha as shown below:

• Ensure to choose reCAPTCHA v2
• Ensure to add all domains you plan on using

• Add SITE KEY to the RECAPTCHA_PUB_KEY variable in your .env file
• Add SECRET KEY to the RECAPTCHA_PRIV_KEY variable in your .env file

Q: How can I access/view the MySQL database?

Note: Doing so is basically cheating, but if you really need to, you can do so.

This Docker image bundles Adminer (a PHP web interace similar to phpMyAdmin) and you can access it here: http://localhost:8000/adminer.php

• Server: dvwa_db
• Username: root
• Password: rootpass

# This is builing the image for the default PHP version
make rebuild

# This is building the image with PHP 8.0
make rebuild VERSION=8.0

# Rebuild PHP 8.1 for arm64 platform
make rebuild VERSION=8.0 ARCH=linux/arm64

:rocket: Deployment

AWS

This repository ships a Terraform module to deploy DVWA on AWS.

cd aws/
cp terraform.tfvars-example terraform.tfvars

terraform init
terraform apply

For more information see Terraform module.

Kubernetes

This repository ships Kubernetes resources to deploy DVWA on K8s or minikube.

cd k8s/
kubectl apply -f .

For more information see k8s.

:lock: cytopia sec tools

Below is a list of sec tools and docs I am maintaining, which might come in handy working on DVWA.

:page_facing_up: License

MIT License

Copyright © 2021 cytopia