I have a problem with DVWA on Kali Linux.


  • PHP function allow_url_include: Disabled
  • reCAPTCHA key: Missing

I installed according to the following commands:

curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -  
echo 'deb https://download.docker.com/linux/debian stretch stable' > /etc/apt/sources.list.d/docker.list  
apt-get update  
apt-get install docker-ce  
docker run --rm -it -p 80:80 vulnerables/web-dvwa

I modified these variables in file php.ini:

allow_url_include = Off  
allow_url_fopen = Off  


allow_url_include = On  
allow_url_fopen = On  

but it still doesn't work.

  • Now I am really curious: Kali is a distribution for penetration testing: You put Kali on a USB stick, walk into a corporate building, and hack their servers. Why on earth would you use a PHP script for that? (If you want to do PHP development, I'd recommend to switch to a distro that's actually made for that, not Kali. You'll save yourself a lot of pain in the long run. For example use Debian, which you seem to be using anyway as a package source). – dirkt May 25 '19 at 6:31
  • You have to restart Apache after editing your php,ini. However. I think you have not done anything about the forbidden function, it is another directive.You have not done anything yet about the reCAPTCHA key, and we cannot guess anything about it, it is a applicational setup, not a standard. – Rui F Ribeiro May 25 '19 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.