Dockerized DVWA

Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.

https://github.com/digininja/DVWA

DVWA has an official Docker image available at Dockerhub, but at this point they are not producing an image from the current code base.

HUGE THANK YOU TO cytopia who built a docker compose version of latest DVWA. For our uses, it's a little bit heavy and not quickly accessible (still needs database initialization) and is multiple images. We wanted something that was a bit more simple to run and use instantly. This image work is based upon work they have done!

We publish an amd64, arm64, and arm/v7 version of this image weekly. If you want a NOW up-to-date version, you can use the here provided Dockerfile. The images are built every Sunday night or when we make tweaks to this repository and are pushed to Dockehub.

Available Architectures: amd64, arm64, arm/v7

🐳 Available Docker image versions

Rolling releases

The following Docker image tags are rolling releases and are built and updated every Sunday.

Docker Tag	Git Ref	PHP	Available Architectures
`latest`	main	8.1	`amd64`, `arm64`, `arm/v7`

🎉 Install

Docker/Podman Run In forground

docker run --rm -it -p 8080:80 kaakaww/dvwa-docker:latest

at this point you can use DVWA by accessing https://localhost:8080 or

Clone repository from GitHub:

git clone https://github.com/kaakaww/dvwa-docker

⚡ Start

Inside the cloned repository (docker-dvwa/ directory):

docker build . -t docker-dvwa
docker run -rm -p 8080:80 docker-dvwa

🚫 Stop

Inside the cloned repository (dvwa-docker/ directory):

docker stop docker-dvwa

💻 Usage

After running docker run you can access DVWA in your browser via:

Url: http://localhost:8080
User: admin
Pass: password

⭐ Features

🐳 - Works out of the box on Linux, MacOS and Windows via Docker
🔁 - Docker images are updated every Sunday against DVWA main branch
📂 - Bundles Adminer to inspect the database

🔧 Configuration

This setup allows you to configure a few settings via the Dockerfile file to change settings in your own image.

Variable	Default	Settings
`RECAPTCHA_PRIV_KEY`		Required to make the captcha module work. (See FAQ section below)
`RECAPTCHA_PUB_KEY`		Required to make the captcha module work. (See FAQ section below)
`PHP_DISPLAY_ERRORS`	`0`	Set to `1` to display PHP errors (if you want a really easy mode)

The following Dockerfile file variables are default settings and their values can also be changed from within the web interface:

Variable	Default	Settings
`SECURITY_LEVEL`	`low`	Adjust the difficulty level for the challenges^[1] (`low`, `medium`, `high` or `impossible`)
`PHPIDS_ENABLED`	`0`	Set to `1` to enable PHP WAF/IDS^[2] (off by default)
`PHPIDS_VERBOSE`	`0`	Set to `1` to display WAF/IDS reasons for blocked requests

^[1] For the SECURITY_LEVEL changes to take effect, you will have to clear your cookies. Alternatively change it in the web interface.
^[2] WAF (Web Application Firewall) / IDS (Intrusion Detection System)

💡 FAQ

Q: How can I run DVWA with a different PHP version?

Changing the base reference in your own version of this Dockerfile is possible. Change `from php:8.1-apache` to the version you desire and build the image:

Q: How can I reset the database and start fresh?

Hit the reset database button in DVWA OR rebuild the docker container. Either with set the database fresh.

Q: How can I view Apache access or error log files?

Log files are piped to stderr from the Docker container and you can view them via:

docker attach <container-id|container-name>

Q: How can I get a shell on the web server container?

Note: Doing so is basically cheating, you are supposed to gain access to the machine via exploitation.

You can enter the running web server container as root via:

docker exec -it <container-id|container-name> /bin/bash

Q: How do I setup the reCAPTCHA key?

Go to https://www.google.com/recaptcha/admin and generate your captcha as shown below:

Ensure to choose reCAPTCHA v2
Ensure to add all domains you plan on using

Add SITE KEY to the RECAPTCHA_PUB_KEY variable in your Dockerfile file
Add SECRET KEY to the RECAPTCHA_PRIV_KEY variable in your Dockerfile file

Q: How can I access/view the MySQL database?

Note: Doing so is basically cheating, but if you really need to, you can do so.

This Docker image bundles Adminer (a PHP web interace similar to phpMyAdmin) and you can access it here: http://localhost:8080/adminer.php

Server: 127.0.0.1
Username: dvwa
Password: p@ssw0rd

Q: How can I build the Docker image locally?

To build or rebuild the Docker image against new updates in DVWA master branch, simply do the following:

# This is building the image for the default PHP version
docker build -t <name-of-image> .

📄 License

MIT License