Lab 17 of 17 · By Michael Stout
In this lab
Use Copy beside a command to copy it exactly.
Test DVWA with OWASP ZAP
Labs 14–16 all worked against Metasploitable. This lab turns to Lab 12's other target — DVWA — with a tool built for web applications instead of network hosts. OWASP ZAP finds classes of finding, like SQL injection and cross-site scripting, that a network-layer scanner never reaches.
A different attack surface needs a different scanner
Metasploitable's vulnerabilities live in outdated network services — the kind of thing Nmap and OpenVAS were built to find. DVWA's live inside the application logic itself: a form that doesn't sanitize input, a query built by string concatenation. ZAP proxies traffic to the app and actively probes every page, form, and parameter it can find, instead of every port. DVWA is deliberately built with a full spread of these flaws at adjustable difficulty, which is exactly what makes it a useful ZAP target rather than a real site.
ZAP is an OWASP flagship project — no licensing threshold to check, unlike Docker Desktop in Lab 4.
What you'll need
Lab 12's range, with the dvwa container published at localhost:8080.
Java 17 or later. ZAP's Windows installer doesn't bundle it — unlike the macOS build, which does.
Around 250 MB for the ZAP installer, plus a JDK if you don't already have one.
25–35 minutes, most of it DVWA's first-run setup and the scan itself.
Java first, then ZAP
- Confirm Java is present:If that errors, install a JDK 17 or later from
java -version
adoptium.netfirst — ZAP's Windows installer needs it but doesn't include it. - Download ZAP. Go to
zaproxy.org/downloadand get the 64-bit Windows installer. - Run the installer and accept the defaults, then launch ZAP. If it asks about persisting sessions on first launch, either answer works for this lab.
DVWA isn't usable until you do this once
- Create the database. Browse to
localhost:8080/setup.phpand click “Create / Reset Database” — Lab 12's image ships with no database until this runs once. - Log in. Go to
localhost:8080/login.phpand sign in withadmin/password— DVWA's own default, not something this lab set. - Lower the security level. Open “DVWA Security” in the left menu and set it to Low. Its default, Impossible, is intentionally unbreakable — ZAP will have nothing worth reading there.
Log in through ZAP, then attack what it saw
- Explore DVWA through ZAP's own browser. Quick Start tab → Manual Explore → enter
localhost:8080/login.php→ Launch Browser. In that browser, log in and click through a few modules (SQL Injection, XSS reflected) — ZAP records every request as you go, cookie included. - Run the active scan against what it now knows about: in the Sites tree, right-click the site → Attack → Active Scan → Start Scan. This time it can reach the pages behind login, not just the login form.
- Read the results. Open the Alerts tab, sort by risk, and click a High finding — check the Response tab to see exactly which part of the page ZAP is flagging.
Three more ways to use the same scan
| Try | What it shows you |
|---|---|
| Set DVWA Security to Medium, rerun | A before/after: how many alerts survive DVWA's basic mitigations at the next difficulty step. |
| The HUD, in ZAP's launched browser | A live overlay showing alerts as you click, instead of only reading them after the fact in the desktop app. |
| Report → Generate Report | Export the alerts as HTML or PDF — the artifact you'd actually hand upward, the same idea as Lab 14's report export. |
Only ever point ZAP at Lab 12's own dvwa container. It's the same authorization boundary Labs 11 and 14 set for Nmap and OpenVAS — a web app scanner is no different.
At Low security, DVWA is designed to fail almost everything ZAP throws at it. A long alerts list isn't ZAP over-triggering — it's the teaching material doing its job. Don't read the volume as noise to dismiss.
Sources. OWASP ZAP, getting started and Automated/Manual Explore workflow, zaproxy.org/getting-started. OWASP ZAP, download page and system requirements, zaproxy.org/download. Docker Hub, vulnerables/web-dvwa, first-run and default credentials, hub.docker.com/r/vulnerables/web-dvwa. ZAP's version number and Java requirement are current as of September 2026 and worth re-checking before teaching this lab live.