Damn Vulnerable Web Application (DVWA) is a deliberately vulnerable web application created by Ryan Dewhurst. It is licensed under GPLv3.

You can download DVWA locally and install it in a virtual machine. We are providing an online version to save you the time and pain of having to do that. 

A sample set of vulnerabilities include:

• Cross Site Scripting
• Command Injection
• SQL Injection
• File Upload/Inclusion

and many more. 

The following username and password may be used to explore the application:

• User: admin        Password: password