How to install DVWA on Windows to practice your web pentesting skills

Ready to find bugs!

When we are trying to learn web pentesting, we need our own environment to get these skills.

Unfortunately, we cannot trigger these actions in websites in which we are not authorized.

So we have to set a lab or website to do so.

DVWA?

DVWA(Damn Vulnerable Web application) is a Github project which consists of a intentionally vulnerable website with a lot of vulnerabilities like XSS(Cross-Site Scripting), SQLi(SQL injection), Brute Force etc.

The project was made for cybersecurity who want to test their skills to find vulnerabilites inside the website and how these affect systems.

In this article, i will teach you to install DVWA to practice your skills in web pentesting to get those vulnerabilities that are always on the lookout.

Installation

• Go to github.com and search for https://github.com/digininja/DVWA.
• Download the existing ZIP.
• Extract the files inside a new folder.
• Now, you have to install XAMPP to server in case you don’t have it installed(https://www.apachefriends.org/es/index.html)
• Choose the folder you want to set your server(in my case it is called “xampp”)

• Inside this folder, copy the DVWA folder.
• Go to xampp/htdocs and save your DVWA folder inside(in my case, i called it “DVWA-master”).

• Now we go to DVWA-master/config and search for the “config.inc.php.dist” file.
• Change the name of the file to “config.inc.php
• Now you can open your localhost in the port configured for Apache and search you will find the login page.

Use the credentials that you set in the configuration file to log in.

Once done, you will the next interface.

The website provide a difficulty level(Low,Medium,Hard and Impossible) for each vulnerability.

If you want to test the website to find SQLi without any prior security to begin with, you can set the lowest difficulty in case you don’t have experience dealing with this vulnerability.

However, you can set the difficulty to Medium or Hard if you want a more challenging experience.

I usually spend my time practicing in this website to achieve the pentesting skills that im looking for.Anyway, you have to keep practicing with other similar resources if you want a more completa experience.

Those resources could be HackTheBox or Tryhackme which helps a lot a the time of resolving vulnerable machines or defending simulated system.s

TryHackme:https://tryhackme.com/

HackTheBox:https://www.hackthebox.com/