DVWA lab: practise SQL injection and XSS on the Damn Vulnerable Web Application

DVWA, the Damn Vulnerable Web Application, teaches one weakness at a time: SQL injection, blind SQL injection, command injection, cross-site scripting (reflected and stored), CSRF, file upload, file inclusion, weak session identifiers, brute force and more. This lab starts it, with its database, in each student’s own private copy.

Every target is inside the student’s own lab copy, which has no route to the internet and none to any other student, so the only thing a student can attack is the application the lab started for them. The rule is said at the top of the lab: attack your own copy, never a site you do not own.

What students learn

The same exercise at four security levels, low, medium, high and impossible, is the same code insecure and then fixed. Each exercise’s View Source button shows the code at the level in force, so a student sees what each fix changes and why the easy fix is not enough. It suits secure coding and remediation: input validation, output encoding, parameterised queries and file handling.

Run it in your browser

The lab makes the database for the student, so there is nothing to set up. It starts at the low security level.

  1. Open the Container page. Open Build on the bar and choose Run a container. Anybody may open it, and the Git lab and the SQL lab start with no account. Every other lab needs a free account: create one, sign in, then press Start.
  2. Find the lab. The Sample labs card lists every sample. Find DVWA.
  3. Press Start. Start runs it as it is, in one press. Edit the file first opens the compose file so you can change it before you start.
  4. Open it. On the lab’s page, press Open and sign in as admin with the password password. The DVWA Security page raises the level. Stopping and starting the lab gives a fresh DVWA, the same as the setup page’s Create / Reset Database.

What to ask students to hand in

A screenshot of each exercise solved at low and again at high, with the lab’s own address visible, and for each a written explanation in their own words of what the weakness is, the input they used, why it worked and how the code at the high level differs. For stronger work ask for the corrected code as well as the attack.

The code on GitHub

The compose file runs DVWA’s own public image, pinned by digest, beside a MariaDB database, as unprivileged accounts. DVWA is GPL-3.0 licensed and is not distributed by us. The CAPTCHA exercise is not available, because it needs a service on the internet.

A basic lesson on this lab

DVWA Basics and DVWA Basics 2 are small lessons worked in this lab, each starting with the rule that a student attacks their own copy and nothing else. In the first they do SQL injection at the low level, read the code that allows it and see the same exercise refused at the impossible level. In the second they do cross-site scripting the same way.

A free personal account is given them on the Basics module, which is on Home, every college can copy them from the Library’s Basics folder, and a new college opens with them in a module called Lab Basics (Sample). They are deliberately small: they show a teacher what a lesson worked in a lab is, and the lab does the rest. Copy one into a module of your own to change it.

Set it as work

Say in the task which exercises to complete and what to hand in.

  1. Make the lab. In your module add a task and choose the Container lab card, then In a GitHub repository. Give https://github.com/mitsurutech/lab-dvwa with the branch main. The compose file is the default, compose.yaml. Fork the repository first if you want to change it.
  2. Publish and try it. Publish pins the commit you were shown, so a later change in the repository does not alter a lab you have already set. Start your own copy first.
  3. Hand it out. Assign it like any task, with a due date if you want one, and say in the task what to do and what to hand in.
  4. Mark what is handed in. Open a student’s copy and the work they handed in, mark it, and send it back with a reason if it needs more.

Questions people ask

Why does the lab start at the low level?
So a first attempt works. Raising the level and repeating the exercise is the lesson: it shows what each defence changes.
What are the sign-in details?
admin and password, the same in every copy. A copy is private to the student who started it, and nothing outside it can reach it.
What should students hand in for DVWA?
A screenshot of each exercise solved at low and again at high, with the lab’s own address visible, and for each a written explanation of the weakness, the input used, why it worked and how the code at the high level differs. For stronger work, ask for the corrected code as well as the attack.