DVWA Lab Setup 2026 — Complete Beginner Guide (Install & Hack in 15 Minutes)

This article provides a complete setup guide for DVWA (Damn Vulnerable Web Application), an intentionally vulnerable PHP/MySQL web application designed for ethical hackers to practice web security vulnerabilities in a controlled, local environment. The guide covers two installation methods—Docker (recommended) and manual Apache/MySQL installation—and explains DVWA's four-level security progression system that teaches both offensive attack techniques and defensive secure coding in parallel. DVWA matters because it has been the industry standard practice target for over a decade, offering infinitely resettable, source-code-visible vulnerabilities that build real exploitation muscle memory without the complications of online labs or subscriptions.

• DVWA's source code visibility accelerates learningEvery DVWA module includes a 'View Source' button that displays the vulnerable code at each security level, and crucially allows learners to compare the Low (unfiltered) version directly against the Impossible (secure) version to see what correct implementation actually looks like. This compare-and-contrast approach teaches both why vulnerabilities exist and how to fix them simultaneously, building security intuition faster than attack-only practice.
• Docker installation requires only three commandsThe Docker method eliminates manual Apache, PHP, and database configuration: one command installs Docker, one pulls and starts the DVWA container (~200MB, cached on subsequent runs), and one verification command confirms it is running. Daily workflows use simple commands like 'docker start dvwa' and 'docker stop dvwa', with complete reset via 'docker rm -f dvwa && docker run' restoring a clean state instantly.
• Four security levels represent progression toward productionLow has no filtering (exploitable with basic payloads), Medium applies simple blacklist filtering (representing a developer who tried but used wrong techniques), High uses stronger filtering (representing research but with subtle flaws), and Impossible implements correct secure patterns like parameterised queries, Content Security Policy, token validation, and strict whitelists. This progression teaches both how attacks work and why each naive defence fails.
• Brute force attack demonstrates real unprotected designThe article walks through using Hydra to credential-brute-force the DVWA login form at Low security, which has no rate limiting, account lockout, or CAPTCHA—revealing the entire admin password ('password') in seconds. Switching to Medium adds only a sleep(2) delay between attempts, which is trivially bypassed by reducing thread count, demonstrating how common ineffective defences are on real production systems.
• Manual install enables source code modificationInstalling DVWA directly on Kali's Apache and MariaDB stack (rather than via Docker) allows direct modification of PHP source files for advanced exercises, though it requires more configuration steps including creating database users, updating credentials in config files, and enabling allow_url_include in php.ini (which is a security risk on internet-facing systems but safe on localhost).
• Isolation is mandatory for safe vulnerable practiceThe article repeatedly emphasizes that DVWA must run exclusively on localhost, in a VM with host-only networking, or on an offline machine and must never be exposed to the internet or shared networks, because its vulnerabilities are real and exploitable by other network users. All 30 labs in the series target only the local instance.
• Automated verification prevents configuration debuggingThe article provides a curl-based verification script that confirms DVWA is accessible, login works, all key modules return HTTP 200 status codes, and security level settings persist. Running this check before each lab session prevents wasted time troubleshooting misconfigured environments instead of practicing the actual vulnerabilities.
• Reset mechanisms enable unlimited repetitionDVWA can be reset to a completely clean state via the browser (/dvwa/setup.php 'Create / Reset Database' button), via Docker full container reset, or via manual database commands, allowing learners to practice the same vulnerability multiple times until techniques become instinctive muscle memory.

Bottom line: DVWA is a foundational, always-available practice environment where learners can attack freely and fail without consequences, and the Docker installation method gets a fully functional setup in minutes with no manual configuration. The four-level security progression system is the core learning mechanism—start at Low to master the attack, progress through Medium and High to understand bypass techniques, then study Impossible to see what production secure code actually looks like.