DVWA靶场搭建

1.1 DVWA靶机搭建

DVWA (Damn VuInerable Web Application)是一个用来进行安全脆弱性鉴定的PHP/MySQL Web应用，旨在为安全专业人员测试自己的专业技能和工具提供合法的环境，帮助web开发者更好的理解web应用安全防范的过程。

github地址：https://github.com/digininja/DVWA

1.1.1 安装配置LAMP环境

[[email protected] ~]# yum install -y httpd php php-mysql php-gd mariadb-server mariadb
[[email protected] ~]# systemctl enable mariadb.service
[[email protected] ~]# systemctl enable httpd.service
[[email protected] ~]# systemctl start mariadb
[[email protected] ~]# systemctl start httpd
[[email protected] ~]# mysqladmin -u root password "123456"

1.1.2 创建数据库

[[email protected] ~]# mysql -uroot -p
MariaDB [(none)]> create database dvwa character set utf8mb4 collate utf8mb4_general_ci;
MariaDB [(none)]> grant ALL on dvwa.* to 'dvwa'@'%' identified by '123456';
MariaDB [(none)]> exit

1.1.3 下载部署DVWA

[[email protected] ~]# cd /var/www/html/
[[email protected] html]# wget https://codeload.github.com/digininja/DVWA/zip/refs/heads/master
[[email protected] html]# unzip master
[[email protected] html]# mv DVWA-master/ DVWA
[[email protected] html]# chown -R apache.apache DVWA/

1.1.4 配置DVWA

[[email protected] html]# cd DVWA/config/
[[email protected] config]# cp config.inc.php.dist config.inc.php
[[email protected] config]# vim config.inc.php
20 $_DVWA[ 'db_user' ]     = 'root';
21 $_DVWA[ 'db_password' ] = '123456';
# 配置google recaptcha验证码
27 $_DVWA[ 'recaptcha_public_key' ]  = '6Lfy6ZEgAAAAAJTA_dMsfsdfJLaJcECNZrcX21eql';
28 $_DVWA[ 'recaptcha_private_key' ] = '6Lfy6ZEgAAAAAIlPpNdgfhfgExDxCbCHZhJ5-G9oN';
[[email protected] config]# vim /etc/php.ini
815 allow_url_include = On
[[email protected] ~]# systemctl restart httpd

1.1.5 Web页面安装

1.1.6 登录DVWA

• 登录URL：http://192.168.10.159/DVWA/login.php
• 用户名：admin
• 密码：password

1.1.7 调整DVWA安全级别