DVWA Versions Save

Easy built in support for containers by @hoang-himself .

Fixed a bug where the session cookie would not be set correctly if the web server was running on a non-standard port.

Was never used so removed it.

A new, Open HTTP Redirect vulnerability has been added.

Merging in the new Authorisation Bypass module

Pastebin are now adding a nosniff header so moved to Hastebin for the low level CSP lab.

Also fixed some broken links.

There hasn't been a release for a very long time, so this one brings the last 5 years together into a big release.

• Added a dedicated objective (or "flag") for file include. (@g0tmi1k)
• Added a warning to any module that requires a certain configuration. (@g0tmi1k)
• Added comments to all source code that would be visible via DVWA modules. (@g0tmi1k)
• Added CSRF token to pre-auth forms (login/setup/security pages). (@g0tmi1k + @Shinkurt)
• Added HttpOnly cookie flag on impossible levels. (@g0tmi1k)
• Added more detail to the documentation. (@g0tmi1k)
• Added PDO to all impossible levels requiring MySQL. (@g0tmi1k)
• Added PHPIDS options into the config file. (@g0tmi1k)
• Added system check to setup. (@g0tmi1k)
• Added various information to all help pages for every module. (@g0tmi1k)
• Changed brute force medium to be harder due to sleep. (@g0tmi1k)
• Changed file include landing page + added 3x example pages. (@g0tmi1k)
• Changed file include medium to be harder due to more filters. (@g0tmi1k)
• Changed HTTP REFERER check for medium level CSRF. (@g0tmi1k)
• Changed input box for medium level with SQLi + SQLi Blind. (@g0tmi1k)
• Changed SQLi + SQLi Blind to be $_POST rather than $_GET. (@g0tmi1k)
• Changed SQLi Blind to be a real example of the vulnerability. (@g0tmi1k)
• Fixed brute force and file upload impossible levels, as they were vulnerable. (@g0tmi1k + @Shinkurt)
• Fixed bug with file fnclude page not loading. (@g0tmi1k)
• Fixed CAPTCHA bug to read URL parameters on impossible. (@g0tmi1k)
• Fixed CAPTCHA bug where the form wouldn't be visible. (@g0tmi1k)
• Fixed CAPTCHA bug where the URL parameters were not being used for low + medium. (@g0tmi1k)
• Fixed CSRF medium level bug when not on localhost. (@g0tmi1k)
• Fixed setup bug with custom URL path. (@g0tmi1k)
• Removed PostgreSQL DB support. (@g0tmi1k)
• Renamed 'Command Execution' to 'Command Injection'. (@g0tmi1k)
• Renamed 'high' level to 'impossible' and created new vectors for 'high'. (@g0tmi1k)
• Updated README and documentation. (@g0tmi1k)
• Various code cleanups in the core PHP files+CSS. (@g0tmi1k)
• Various setup improvements (e.g. redirection + limited menu links). (@g0tmi1k)