Damn Small Vulnerable Web (DSVW) is a deliberately vulnerable web application written in under 100 lines of code, created for educational purposes. It supports majority of (most popular) web application vulnerabilities together with appropriate attacks.
Run the following command:
$ python3 dsvw.py
Damn Small Vulnerable Web (DSVW) < 100 LoC (Lines of Code) #v0.5
by: Miroslav Stampar (@stamparm)
[i] running HTTP server at 'http://127.0.0.1:65412'...
Optionally, --host=ADDR and --port=N can be used to change the listening address and/or port (e.g. python3 dsvw.py --host=0.0.0.0 --port=8080).
and navigate your browser to http://127.0.0.1:65412/:
Python (3.x) is required for running this program. Items XML External Entity (local), XML External Entity (remote) and Blind XPath Injection (boolean) require installation of python-lxml (e.g. apt-get install python-lxml). Otherwise, those will be disabled.
To install lxml via pip, run the following command:
pip install -r requirements.txt
$ docker build . -t dsvw && docker run -p 65412:65412 dsvw
The tests directory holds a stdlib-only regression suite that starts dsvw.py itself, walks through
every attack case listed on the index page and checks that each one still works. All targets are local
(a bundled HTTP fixture stands in for third-party sites), so the suite needs no Internet access:
$ python3 -m unittest discover -s tests -t tests -v
Tests requiring sqlmap (end-to-end exploitation of the SQL injection points) are
skipped automatically when it is not installed, while DSVW_SKIP_SLOW=1 leaves out the time-based one.