DVWA Tutorial: Web Pentesting Practice for Beginners

Damn Vulnerable Web Application (DVWA) is a deliberately vulnerable PHP web app for practicing common web flaws at different difficulty levels. This page is the practice hub for our web pentest cluster: what DVWA is for, how security levels work, which module to open next, and where the focused attack lessons live.

What is DVWA and what is it for?

The official DVWA project describes a PHP and MariaDB web application where you practice common vulnerabilities in a controlled environment. Each module isolates one flaw class with four security levels on the same page.

What you can practice in DVWA:

• One vulnerability type at a time without hunting through a large application
• How defenses change when you raise the security slider on the same module
• Comparing insecure and secure code paths at Impossible
• Manual request inspection before you automate with sqlmap or fuzzers

DVWA is a training range, not a production benchmark. It runs locally, keeps modules short, and exposes an explicit Low / Medium / High / Impossible control so you can compare behavior on the same page.

Open DVWA and prepare the lab

Full install screenshots, Docker Compose, Apache paths, and service troubleshooting live in the install guide. To start practicing, you only need the app reachable on loopback.

Start the Kali package stack:

sudo dvwa-start

Then in the browser:

1. Open http://127.0.0.1:42001 (package home URL only)
2. On first run, left menu → Setup / Reset DB → Create / Reset Database
3. Log in with admin / password
4. Left menu → DVWA Security → set Low → Submit

Use the left menu for every module after login. Deep paths such as /vulnerabilities/... need an authenticated session and often fail if you paste them cold.

After database setup, the login page should show the DVWA logo and the default credential fields:

Explore the DVWA modules

After login, the left menu lists every practice module. DVWA 2.5 groups authentication, injection, cross-site scripting, file handling, sessions, access control, client-side logic, and API flaws into separate pages.

The complete module-to-lesson map is in the next sections — you do not need to memorize the menu names first.

Pick one module and one security level per session. Use the learning map below to choose where to go after Low.

Understand DVWA security levels

DVWA does not only make modules “easier” or “harder.” Each level changes how input is validated, how errors are shown, and which mitigations are active.

The exact control differs by module. CSRF may use a referrer check at Medium, a token at High, and current-password verification at Impossible. The CSP module uses different mechanisms entirely. Use the module behavior and View Source output rather than assuming every Medium or High level applies the same type of filtering.

Left menu → DVWA Security: the dropdown should list Low, Medium, High, and Impossible. Set Low before your first module run:

The status line above the dropdown should read Security level is currently: low when you are ready to practice.

How to practice a DVWA module

Treat each module as a small, repeatable exercise rather than trying random payloads immediately.

Start with one normal request so you understand what the page expects. Identify the input you control — for example a query parameter, form field, cookie, or header — and note the normal response before changing anything.

Then follow this workflow:

1. Submit normal input — confirm how the page behaves before testing the flaw.
2. Identify the controllable input — note the parameter, cookie, header, or form field involved.
3. Observe the response — check status code, page content, errors, redirects, or reflected input. Use browser DevTools or Burp HTTP history when the request is easier to inspect through a proxy.
4. Form a hypothesis — decide what vulnerability class the module is intended to demonstrate.
5. Open the focused lesson — use the DVWA vulnerability learning map below for the actual validation steps.
6. Repeat at Medium and High — run the same test again and note which behavior or defense changed.
7. Compare with Impossible — identify the mitigation that prevents the vulnerable behavior.

For each security level, record three things:

• what still worked;
• what stopped working;
• which control changed the result.

The goal of this page is to teach that workflow. The separate vulnerability guides own the actual payloads, exploitation steps, and proof of impact.

Compare vulnerable and secure code

DVWA’s View Source button on each module shows the PHP behind the current security level. The levels matter most when you connect behavior to code.

After you test at Low:

1. Open View Source on the module
2. Read how user input reaches the database, shell, file path, or HTML output
3. Switch to Impossible, repeat the same input, and open View Source again
4. Name the mitigation — parameterized query, output encoding, token check, path allowlist, and so on

Do not memorize payloads from Low. Understand why Impossible changed the code path. That habit transfers to real applications where you will not get a labeled difficulty slider.

DVWA vulnerability learning map

Use this table as the hub for the web section of the CompTIA PenTest+ course. When a focused lesson exists, the last column links to it. Rows marked Practice in DVWA are module-only until a dedicated guide is published.

If you are new to DVWA, choose one simple module at Low, understand its normal behavior, then open the matching focused lesson from the map. Good first modules include Brute Force, SQL Injection, or XSS (Reflected). Server-side template injection is not a DVWA module; practice it on the SSTI lab instead.

Use Burp Suite with DVWA

DVWA works in a normal browser, but Burp makes it easier to inspect and replay requests. Use the Burp Suite proxy tutorial for Proxy, HTTP history, target scope, Repeater, and Intruder.

On this page, Burp is only a supporting tool. Vulnerability-specific request manipulation belongs in the focused attack guides.

DVWA vs OWASP Juice Shop

Neither target is universally better. They teach overlapping skills with different ergonomics.

Start with DVWA when you want short modules and clear level sliders. Add Juice Shop when you want a wider challenge set on the same isolated lab.

Common DVWA browser and practice problems

Service start failures, MariaDB errors, port mismatches, and install paths belong in the install guide.

What to learn next

After you can log in, set security levels, and pick modules from the map, continue in this order:

1. SQL injection with sqlmap on DVWA — manual proof plus automation
2. Burp Suite proxy tutorial — intercept, Repeater, and Intruder on the same target
3. Local file inclusion attack — then return to DVWA File Inclusion
4. How to bypass CSRF protection — pair with DVWA CSRF at Medium and High
5. Web app fuzzing tools — when manual testing feels slow
6. Install OWASP Juice Shop on Kali — second web target in the lab

Summary

DVWA is the practice hub for web application testing in this course. It packages common vulnerabilities into short modules with four security levels so you can compare insecure handling against improved defenses on the same page.

Open the lab with dvwa-start, complete setup once, set Low, and use the learning map to route each module to a focused lesson. Compare Low through Impossible with View Source so you understand mitigations — not just payloads.

Keep the instance on localhost or host-only, document what changes when you raise the security slider, and leave exploit walkthroughs to the per-vulnerability guides.

References

• DVWA project site: https://dvwa.co.uk/
• DVWA GitHub repository: https://github.com/digininja/DVWA
• OWASP Web Security Testing Guide: https://owasp.org/www-project-web-security-testing-guide/
• OWASP Juice Shop: https://owasp.org/www-project-juice-shop/