Post cover image

July 18, 2026

Getting Started with bWAPP on Linux: Installation, Database Configuration, Service Management &…

Introduction

By Om Barot

3 min read

Introduction

If you're learning web application security, bWAPP (Buggy Web Application) is one of the best intentionally vulnerable applications for practicing vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), Command Injection, CSRF, File Inclusion, and many more.

This guide walks you through installing bWAPP on Kali Linux using Apache2, PHP, and MariaDB. It also includes service management, verification steps, and solutions to common installation problems that beginners often face.

⚠️ Disclaimer:_ bWAPP is intentionally vulnerable. Install and use it only in a virtual machine or isolated lab environment. Never expose it to the public internet._

Prerequisites

Before starting, update your Kali Linux system.

sudo apt update
sudo apt upgrade -y

Install the required packages.

sudo apt install apache2 mariadb-server php php-mysql git unzip -y

Verify the installation.

php -v
apache2 -v
mariadb --version

Start Required Services

Start Apache.

sudo systemctl start apache2

Start MariaDB.

sudo systemctl start mariadb

Enable both services to start automatically after reboot.

sudo systemctl enable apache2
sudo systemctl enable mariadb

Check that both services are running.

systemctl status apache2
systemctl status mariadb

You should see:

Active: active (running)

Download bWAPP

Move to Apache's web directory.

cd /var/www/html

Clone the repository.

sudo git clone https://github.com/raesene/bWAPP.git

If you downloaded the ZIP file instead, extract it into /var/www/html.

Verify the folder exists.

ls

You should see:

bWAPP

Set File Permissions

Give Apache ownership of the application.

sudo chown -R www-data:www-data /var/www/html/bWAPP
sudo chmod -R 755 /var/www/html/bWAPP

Configure MariaDB

Login to MariaDB.

sudo mysql -u root -p

Create the database.

CREATE DATABASE bWAPP;

Create a database user.

CREATE USER 'user'@'localhost' IDENTIFIED BY 'pass';

Grant the required permissions.

GRANT ALL PRIVILEGES ON bWAPP.* TO 'user'@'localhost';

Reload the privilege table.

FLUSH PRIVILEGES;

Exit MariaDB.

EXIT;

Configure bWAPP

Open the configuration file.

sudo nano /var/www/html/bWAPP/admin/settings.php

Verify that the database settings are correct.

$db_server = "localhost";
$db_username = "user";
$db_password = "pass";
$db_database = "bWAPP";

Save the file.

Restart Services

Restart Apache.

sudo systemctl restart apache2

Restart MariaDB.

sudo systemctl restart mariadb

Install bWAPP

Open your browser and visit:

http://localhost/bWAPP/install.php

Click the installation link displayed on the page.

The installer will automatically create the required database tables and insert the default data.

After the installation completes successfully, open:

http://localhost/bWAPP/login.php

Default credentials:

Username: bee
Password: bug

Verify the Database

Login to MariaDB again.

sudo mysql -u root -p

Select the database.

USE bWAPP;

List all tables.

SHOW TABLES;

If the installation completed successfully, you should see multiple tables.

If the output is:

Empty set

then the installer did not create the database correctly.

Manual Database Recovery (Only If Installation Fails)

Normally, you should never need this section because it install.php automatically creates the database tables.

However, if it SHOW TABLES; returns an empty database, you can manually create the users table.

CREATE TABLE IF NOT EXISTS users (
    id INT(10) NOT NULL AUTO_INCREMENT,
    login VARCHAR(100) DEFAULT NULL,
    password VARCHAR(100) DEFAULT NULL,
    email VARCHAR(100) DEFAULT NULL,
    secret VARCHAR(100) DEFAULT NULL,
    activation_code VARCHAR(100) DEFAULT NULL,
    activated TINYINT(1) DEFAULT '0',
    reset_code VARCHAR(100) DEFAULT NULL,
    admin TINYINT(1) DEFAULT '0',
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

Insert the default users.

INSERT INTO users
(login, password, email, secret, activation_code, activated, reset_code, admin)
VALUES
(
'A.I.M.',
'6885858486f31043e5839c735d99457f045affd0',
'bwapp-aim@mailinator.com',
'A.I.M. or Authentication Is Missing',
NULL,
1,
NULL,
1
),
(
'bee',
'6885858486f31043e5839c735d99457f045affd0',
'bwapp-bee@mailinator.com',
'Any bugs?',
NULL,
1,
NULL,
1
);

Verify the records.

SELECT * FROM users;

Apache Service Management

Start Apache.

sudo systemctl start apache2

Stop Apache.

sudo systemctl stop apache2

Restart Apache.

sudo systemctl restart apache2

Check Apache status.

systemctl status apache2

MariaDB Service Management

Start MariaDB.

sudo systemctl start mariadb

Stop MariaDB.

sudo systemctl stop mariadb

Restart MariaDB.

sudo systemctl restart mariadb

Check MariaDB status.

systemctl status mariadb

Common Errors and Solutions

1. Unknown database

Unknown database 'bWAPP'

Create the database.

CREATE DATABASE bWAPP;

2. Access denied for user

Access denied for user 'user'@'localhost'

Grant the required permissions.

GRANT ALL PRIVILEGES ON bWAPP.* TO 'user'@'localhost';
FLUSH PRIVILEGES;

3. Empty database

SHOW TABLES;
Empty set

The installer failed to create the database schema.

Run the installation again or use the manual recovery procedure above.

4. 404 Not Found

Verify that the bWAPP directory exists.

ls /var/www/html

Restart Apache.

sudo systemctl restart apache2

5. Blank Page

A blank page usually indicates a PHP error.

Check Apache logs.

sudo tail -f /var/log/apache2/error.log

Verify that PHP and the MySQL extension are installed.

php -v
php -m | grep mysqli

6. MariaDB Service Not Running

Check the service status.

systemctl status mariadb

Start the service.

sudo systemctl start mariadb

Useful Commands

Update Kali.

sudo apt update && sudo apt upgrade -y

Restart Apache.

sudo systemctl restart apache2

Restart MariaDB.

sudo systemctl restart mariadb

Login to MariaDB.

sudo mysql -u root -p

Show databases.

SHOW DATABASES;

Use the bWAPP database.

USE bWAPP;

Show tables.

SHOW TABLES;

Exit MariaDB.

EXIT;

Best Practices

  • Install bWAPP only inside a virtual machine.
  • Keep the VM disconnected from public networks when not needed.
  • Take a VM snapshot after completing the installation.
  • Never expose bWAPP to the internet.
  • Practice only in your own lab environment.
  • Regularly update Kali Linux while keeping a backup of your lab.

Conclusion

bWAPP remains one of the best platforms for learning web application security through hands-on practice. By correctly configuring Apache, PHP, and MariaDB, verifying the database, and understanding common troubleshooting steps, you can build a stable lab environment for practicing penetration testing techniques.

A clean installation saves time and avoids unnecessary debugging, allowing you to focus on what really matters — learning how web vulnerabilities work and how to identify and mitigate them in real-world applications.

Happy Learning and Happy Hacking!