How to Install DVWA on Kali Linux: Complete Step-by-Step Guide

DVWA (Damn Vulnerable Web Application) is a PHP/MySQL web application designed to be a vulnerable testing ground for security professionals and students to learn about web application security in a legal environment.

Prerequisites

Kali Linux installed and updated
Root or sudo privileges
Minimum 2GB RAM recommended
Active internet connection

Method 1: Manual Installation (Recommended)

Step 1: Update Kali Linux

sudo apt update && sudo apt upgrade -y

Step 2: Install Required Packages

sudo apt install -y apache2 mariadb-server php php-mysqli php-gd libapache2-mod-php git

Step 3: Start and Enable Services

sudo systemctl start apache2
sudo systemctl enable apache2
sudo systemctl start mariadb
sudo systemctl enable mariadb

Step 4: Secure MySQL Installation

sudo mysql_secure_installation

Follow the prompts to set a root password and secure the installation.

Step 5: Download DVWA

cd /var/www/html/
sudo git clone https://github.com/digininja/DVWA.git

Step 6: Set Proper Permissions

sudo chown -R www-data:www-data /var/www/html/DVWA
sudo chmod -R 755 /var/www/html/DVWA

Step 7: Configure Database

sudo mysql -u root -p

In the MySQL prompt:

CREATE DATABASE dvwa;
CREATE USER 'dvwa'@'localhost' IDENTIFIED BY 'p@ssw0rd';
GRANT ALL PRIVILEGES ON dvwa.* TO 'dvwa'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 8: Configure DVWA

cd /var/www/html/DVWA/config/
sudo cp config.inc.php.dist config.inc.php
sudo nano config.inc.php

Update the following lines:

$_DVWA['db_server'] = '127.0.0.1';
$_DVWA['db_database'] = 'dvwa';
$_DVWA['db_user'] = 'dvwa';
$_DVWA['db_password'] = 'p@ssw0rd';

Step 9: Configure PHP Settings

sudo nano /etc/php/8.2/apache2/php.ini

Find and modify these lines:

allow_url_include = On
allow_url_fopen = On
display_errors = On

Step 10: Adjust Security Level

Edit the config file to set the default security level:

$_DVWA['default_security_level'] = 'low';

Step 11: Restart Services

sudo systemctl restart apache2
sudo systemctl restart mariadb

Step 12: Access DVWA

Open your browser and navigate to:

http://localhost/DVWA

Step 13: Setup Database

Click on “Create / Reset Database”
Wait for the success message
Login with default credentials:
Username: admin
Password: password

Method 2: Using Docker (Alternative Method)

Step 1: Install Docker

sudo apt install -y docker.io docker-compose
sudo systemctl start docker
sudo systemctl enable docker

Step 2: Pull DVWA Docker Image

sudo docker pull vulnerables/web-dvwa

Step 3: Run DVWA Container

sudo docker run --rm -it -p 80:80 vulnerables/web-dvwa

Step 4: Access DVWA

Open browser and go to:

http://localhost

Post-Installation Configuration

Security Levels

DVWA has four security levels:

Low: No security measures
Medium: Basic security
High: Enhanced security
Impossible: Maximum security

To change security level:

Login to DVWA
Click “DVWA Security” in left menu
Select desired level
Click “Submit”

Important Security Notes

⚠️ Warning: DVWA is intentionally vulnerable! Never install it on a production server or any internet-facing machine.

Keep it isolated: Run DVWA only on localhost or isolated lab environments
Change default credentials: Modify admin password after first login
Firewall configuration: Ensure DVWA is not accessible from external networks
Regular updates: Keep DVWA and dependencies updated

Troubleshooting Common Issues

Issue 1: “Access denied” for database

# Check MySQL service status
sudo systemctl status mariadb

# Verify credentials in config.inc.php
sudo nano /var/www/html/DVWA/config/config.inc.php

Issue 2: PHP errors not displaying

# Edit php.ini
sudo nano /etc/php/8.2/apache2/php.ini

# Ensure these settings:
display_errors = On
error_reporting = E_ALL

Issue 3: Permission errors

sudo chown -R www-data:www-data /var/www/html/DVWA
sudo chmod -R 755 /var/www/html/DVWA

Issue 4: ReCAPTCHA errors

Edit config file and add your reCAPTCHA keys or disable it:

$_DVWA['recaptcha_public_key'] = '';
$_DVWA['recaptcha_private_key'] = '';

Useful DVWA Directories and Files

Main directory: /var/www/html/DVWA/
Configuration: /var/www/html/DVWA/config/
Vulnerability scripts: /var/www/html/DVWA/vulnerabilities/
Database setup: /var/www/html/DVWA/setup.php

Best Practices for Using DVWA

Educational use only: Use exclusively for learning and testing in controlled environments
Regular backups: Backup your Kali system before extensive testing
Document findings: Keep notes of vulnerabilities and exploitation techniques
Stay updated: Regularly update DVWA and Kali Linux
Network isolation: Use virtual networks or air-gapped systems

Conclusion

You now have a fully functional DVWA installation on Kali Linux. Remember that this is a deliberately vulnerable application designed for educational purposes. Use it responsibly to learn about web application security, penetration testing methodologies, and defensive techniques.

Always ensure your DVWA installation remains isolated from production networks and the internet to prevent unauthorized access or accidental security breaches.