◆ Vulnerable targets & payloads

DVWA

GPL-3.0

Damn Vulnerable Web Application — a PHP/MySQL target with adjustable difficulty levels for scanner and WAF testing.

source ↗ ★ 13,646 last push 2026-09-07

Summary

Damn Vulnerable Web Application (DVWA) is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.

from the project README

Formats: app
License: GPL-3.0
Added: 2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

shell
```
$ git clone --depth 1 https://github.com/digininja/DVWA
```
Shallow clone: history isn’t needed for testing.

252 files 2.9 MB repository

.php 169
.md 23
.png 10
.js 9
.yml 8
.css 5
.jpg 5
(no ext) 5

Use it with

Commands are curated, not yet run by us.

nuclei — Scan the target once it is running locally (adjust the port to the one you exposed).

sample.app

$ nuclei -u http://127.0.0.1:3000

OWASP ZAP — Run ZAP's passive baseline scan against the locally running target.

sample.app

$ docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000

DVWA

Summary

Get it

Contents

Use it with

Related tools

dvwa

ProjectDiscovery nuclei

OWASP ZAP