DVWA 安装

Author: Xu FC

Platform： 4.15.0-kali2-amd64
DVWA (Dam Vulnerable Web Application) : 基于 PHP + MySQL 的 包含多种漏洞的 Web 应用。

DVWA安装

---

• Kali Linux 默认安装了 Apache2， MySQL 和 PHP， 不需要重复安装

root@server2:/var/www/html# apachectl -v
Server version: Apache/2.4.29 (Debian)
Server built:   2018-01-14T11:01:58

root@server2:/var/www/html# mysql --version
mysql  Ver 15.1 Distrib 10.1.29-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

root@server2:/var/www/html# php --version
PHP 7.2.3-1 (cli) (built: Mar  6 2018 11:15:04) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.3-1, Copyright (c) 1999-2018, by Zend Technologies

• 添加 php-gd 模块

apt install -y php7.2-gd

• 在/var/www/html目录下clone DVWA文件

root@server2:/var/www/html# git clone https://github.com/ethicalhack3r/DVWA.git
root@server2:/var/www/html# ls
DVWA  index.html  index.nginx-debian.html

• 启动 MySQL: /etc/init.d/mysql start
• 连接 MySQL，并添加 database

root@server2:/var/www/html# mysql -u root -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 34
Server version: 10.1.29-MariaDB-6 Debian buildd-unstable

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database dvwa;
MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| dvwa               |
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
4 rows in set (0.00 sec)

• 添加 user

MariaDB [(none)]> grant all privileges on *.* to dvwa@localhost identified by 'dvwa123';
MariaDB [(none)]> select user from mysql.user;
+------+
| user |
+------+
| dvwa |
| root |
+------+
2 rows in set (0.00 sec)
MariaDB [(none)]> exit
Bye

• DVWA 配置文件: root@server2:/var/www/html/DVWA/config# cp config.inc.php.dist config.inc.php
• 修改配置文件config.inc.php

# Database variables
#   WARNING: The database specified under db_database WILL BE ENTIRELY DELETED during setup.
#   Please use a database dedicated to DVWA.
#
# If you are using MariaDB then you cannot use root, you must use create a dedicated DVWA user.
#   See README.md for more information on this.
$_DVWA = array();
$_DVWA[ 'db_server' ]   = '127.0.0.1';
$_DVWA[ 'db_database' ] = 'dvwa';
$_DVWA[ 'db_user' ]     = 'dvwa';
$_DVWA[ 'db_password' ] = 'dvwa123';

# ReCAPTCHA settings
#   Used for the 'Insecure CAPTCHA' module
#   You'll need to generate your own keys at: https://www.google.com/recaptcha/admin
$_DVWA[ 'recaptcha_public_key' ]  = '6LdK7xITAAzzAAJQTfL7fu6I-0aPl8KHHieAT_yJg';
$_DVWA[ 'recaptcha_private_key' ] = '6LdK7xITAzzAAL_uw9YXVUOPoIHPZLfw2K1n5NVQ';

• 将设置权限

chown www-data:www-data /var/www/html/DVWA/hackable/uploads
chown www-data:www-data /var/www/html/DVWA/config
chown www-data:www-data /var/www/html/DVWA/external/phpids/0.6/lib/IDS/tmp/phpids_log.txt
chmod -R 755 /var/www/html/DVWA/hackable/uploads
chmod -R 755 /var/www/html/DVWA/config
chmod -R 755 /var/www/html/DVWA/external/phpids/0.6/lib/IDS/tmp/phpids_log.txt

• 修改 /etc/php7.2/apache2/php.ini 中的配置

allow_url_include = On

• 启动 apache2: systemctl start apache2

• 访问 http://localhost/DVWA/setup.php
  

  

  setup.php: 检查配置

• 点击 Create/Reset Database 按钮，提示数据库创建成功

  
  
  

  setup.php: create DB

• DVWA 安装完成，默认用户名/密码: admin/password

  
  
  

  login.php

index.php