Damn Vulnerable Web Application (DVWA) is a deliberately vulnerable PHP web application designed for security training and practice.
DVWA addresses the need for a safe, legal environment where security professionals, developers, and students can practice identifying and exploiting common web vulnerabilities. The application intentionally contains both documented and undocumented vulnerabilities across multiple difficulty levels, presented through a straightforward interface. Users are encouraged to discover as many issues as possible, making it suitable for hands-on learning of web application security concepts.
DVWA is intended for use in controlled environments such as virtual machines with isolated networking, not on internet-facing servers or public hosting. It serves security professionals testing tools and techniques, web developers learning to secure applications, and students and instructors in classroom settings. The application is explicitly not recommended for malicious use, and the developers disclaim responsibility for compromises resulting from installation on live servers.
Development of the project reflects broad international engagement, with the README available in multiple languages and a process for community translation contributions that emphasizes human accuracy over automated translation. The codebase is distributed under the GNU General Public License, allowing redistribution and modification.
