DVWA靶场搭建

1.1 DVWA靶机搭建

DVWA (Damn VuInerable Web Application)是一个用来进行安全脆弱性鉴定的PHP/MySQL Web应用，旨在为安全专业人员测试自己的专业技能和工具提供合法的环境，帮助web开发者更好的理解web应用安全防范的过程。

github地址：https://github.com/digininja/DVWA

1.1.1 安装配置LAMP环境

[root@web ~]# yum install -y httpd php php-mysql php-gd mariadb-server mariadb
[root@web ~]# systemctl enable mariadb.service
[root@web ~]# systemctl enable httpd.service
[root@web ~]# systemctl start mariadb
[root@web ~]# systemctl start httpd
[root@web ~]# mysqladmin -u root password "123456"

1.1.2 创建数据库

[root@web ~]# mysql -uroot -p
MariaDB [(none)]> create database dvwa character set utf8mb4 collate utf8mb4_general_ci;
MariaDB [(none)]> grant ALL on dvwa.* to 'dvwa'@'%' identified by '123456';
MariaDB [(none)]> exit

1.1.3 下载部署DVWA

[root@web ~]# cd /var/www/html/
[root@web html]# wget https://codeload.github.com/digininja/DVWA/zip/refs/heads/master
[root@web html]# unzip master
[root@web html]# mv DVWA-master/ DVWA
[root@web html]# chown -R apache.apache DVWA/

1.1.4 配置DVWA

[root@web html]# cd DVWA/config/
[root@web config]# cp config.inc.php.dist config.inc.php
[root@web config]# vim config.inc.php
20 $_DVWA[ 'db_user' ]     = 'root';
21 $_DVWA[ 'db_password' ] = '123456';
# 配置google recaptcha验证码
27 $_DVWA[ 'recaptcha_public_key' ]  = '6Lfy6ZEgAAAAAJTA_dMsfsdfJLaJcECNZrcX21eql';
28 $_DVWA[ 'recaptcha_private_key' ] = '6Lfy6ZEgAAAAAIlPpNdgfhfgExDxCbCHZhJ5-G9oN';
[root@web config]# vim /etc/php.ini
815 allow_url_include = On
[root@web ~]# systemctl restart httpd

1.1.5 Web页面安装

1.1.6 登录DVWA

• 登录URL：http://192.168.10.159/DVWA/login.php
• 用户名：admin
• 密码：password

1.1.7 调整DVWA安全级别