Linux Deployment

sudo bash -c "$(curl --fail --show-error --silent --location https://raw.githubusercontent.com/IamCarron/DVWA-Script/main/Install-DVWA.sh)"
```bash

### Manual Script Installation

If you prefer to review the script first:

```bash
# Download the script
wget https://raw.githubusercontent.com/IamCarron/DVWA-Script/main/Install-DVWA.sh

# Make it executable
chmod +x Install-DVWA.sh

# Review the script
less Install-DVWA.sh

# Run as root
sudo ./Install-DVWA.sh

sudo apt update
sudo apt upgrade -y
```bash

### Install Required Packages

Install Apache, MariaDB, PHP, and required PHP modules:

```bash
sudo apt install -y apache2 mariadb-server mariadb-client php php-mysqli php-gd libapache2-mod-php

# Check Apache status
sudo systemctl status apache2

# Check MariaDB status
sudo systemctl status mariadb
```bash

You should see `active (running)` for both services.

**If services aren't running, start them:**

```bash
sudo systemctl start apache2
sudo systemctl start mariadb

sudo systemctl enable apache2
sudo systemctl enable mariadb
```bash

## Configure Apache

### Enable mod_rewrite

The API vulnerability lab requires `mod_rewrite`:

```bash
sudo a2enmod rewrite

sudo apachectl restart
```bash

Or:

```bash
sudo systemctl restart apache2

http://localhost

php -v
```text

**Locate php.ini:**
```bash
php --ini | grep "Loaded Configuration File"

sudo nano /etc/php/8.1/apache2/php.ini
```text

Modify or add these directives:

```ini
; Allow Remote File Inclusion (required for RFI vulnerability)
allow_url_include = On
allow_url_fopen = On

; Display errors for troubleshooting
display_errors = On
display_startup_errors = On

; Disable magic quotes (deprecated, but may appear in older PHP versions)
magic_quotes_gpc = Off

sudo systemctl restart apache2
```bash

Or:

```bash
sudo apachectl restart

cd /var/www/html
sudo git clone https://github.com/digininja/DVWA.git
```bash

This creates `/var/www/html/DVWA/`.

### Using wget

Download and extract the ZIP file:

```bash
cd /var/www/html
sudo wget https://github.com/digininja/DVWA/archive/master.zip
sudo unzip master.zip
sudo mv DVWA-master DVWA

sudo chown -R www-data:www-data /var/www/html/DVWA
sudo chmod -R 755 /var/www/html/DVWA
```bash

Make the upload directory writable:

```bash
sudo chmod 777 /var/www/html/DVWA/hackable/uploads/

sudo mysql_secure_installation
```bash

Follow the prompts:
- Set root password: **Yes** (choose a strong password)
- Remove anonymous users: **Yes**
- Disallow root login remotely: **Yes**
- Remove test database: **Yes**
- Reload privilege tables: **Yes**

### Create Database and User

Connect to MariaDB as root:

```bash
sudo mysql -u root -p

CREATE DATABASE dvwa;
CREATE USER 'dvwa'@'localhost' IDENTIFIED BY 'p@ssw0rd';
GRANT ALL PRIVILEGES ON dvwa.* TO 'dvwa'@'localhost';
FLUSH PRIVILEGES;
EXIT;
```sql

**Explanation:**
- `CREATE DATABASE dvwa;` - Creates the `dvwa` database
- `CREATE USER 'dvwa'@'localhost' IDENTIFIED BY 'p@ssw0rd';` - Creates user `dvwa` with password `p@ssw0rd`
- `GRANT ALL PRIVILEGES ON dvwa.* TO 'dvwa'@'localhost';` - Grants full access to the `dvwa` database
- `FLUSH PRIVILEGES;` - Reloads the grant tables

<Note>
**You cannot use the root user** with MariaDB in DVWA. You must create a dedicated database user as shown above.
</Note>

### Test Database Connection

Verify you can connect with the new user:

```bash
mysql -u dvwa -pp@ssw0rd -D dvwa

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 14
Server version: 10.x.xx-MariaDB-0ubuntu0.xx.xx

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [dvwa]>

cd /var/www/html/DVWA
sudo cp config/config.inc.php.dist config/config.inc.php
```bash

### Edit Configuration

Open the configuration file:

```bash
sudo nano config/config.inc.php

$_DVWA[ 'db_server' ]   = '127.0.0.1';
$_DVWA[ 'db_database' ] = 'dvwa';
$_DVWA[ 'db_user' ]     = 'dvwa';
$_DVWA[ 'db_password' ] = 'p@ssw0rd';
$_DVWA[ 'db_port' ]     = '3306';
```bash

**Common Configuration Options:**

```php
// Set default security level
$_DVWA[ 'default_security_level' ] = 'low';

// Disable authentication for automated tools
$_DVWA[ 'disable_authentication' ] = false;

// Set default locale (en or zh)
$_DVWA[ 'default_locale' ] = 'en';

http://localhost/DVWA/

http://<server-ip>/DVWA/

cd ~
curl -sS https://getcomposer.org/installer -o composer-setup.php
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
```text

Verify installation:

```bash
composer --version

cd /var/www/html/DVWA/vulnerabilities/api
sudo composer install
```bash

Or, if Composer is installed locally:

```bash
cd /var/www/html/DVWA/vulnerabilities/api
sudo php /path/to/composer.phar install

### Blank Page

**Cause:** PHP errors are hidden

**Solution:**
1. Enable error display in `php.ini`:
   ```ini
   display_errors = On
   display_startup_errors = On

### Database Connection Refused

**Error:**

**Cause:** MariaDB is not running

**Solution:**
```bash
sudo systemctl start mariadb
sudo systemctl enable mariadb

Database Error #1045: Access denied for user 'dvwa'@'localhost' (using password: YES)

sudo apt remove mysql-server
sudo apt install mariadb-server
```bash

See [How to Migrate from MySQL to MariaDB](https://mariadb.com/resources/blog/how-to-migrate-from-mysql-to-mariadb-on-linux-in-five-steps/)

### SELinux Blocking Database Connection (CentOS/RHEL)

**Cause:** SELinux policy prevents Apache from connecting to the database

**Solution:**
```bash
sudo setsebool -P httpd_can_network_connect_db 1

# Error log
sudo tail -n 50 /var/log/apache2/error.log

# Access log
sudo tail -n 50 /var/log/apache2/access.log