I just installed dvws into the root of its own site but all the menu options assume it is in the dvws directory so end up at 404 pages.

api.zip

This might be deliberate but $id is not defined in dvws/vulnerabilities/wsdlenum/functions.php if a username is passed that isn't in the $details array.

This is what gets returned:

<br />
<b>Notice</b>:  Undefined variable: id in <b>/var/sites/dvws/secure/htdocs/dvws/vulnerabilities/wsdlenum/functions.php</b> on line <b>36</b><br />
<?xml version="1.0" encoding="ISO-8859-1"?><SOAP-ENV:Envelope SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:check_user_idResponse xmlns:ns1="http://schemas.xmlsoap.org/soap/envelope/"><return xsi:nil="true" xsi:type="xsd:string"/></ns1:check_user_idResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>  

Hi,

As mentioned by you, there are not many practical environments available for hacking web services, I am glad you created dvws.

I am trying to exploit XXE, and tried different payloads. Its not working. below is request and payloads which i tried.

POST /dvws/vulnerabilities/xxe/ HTTP/1.1
Host: 192.168.2.2
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.2/dvws/vulnerabilities/xxe/
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

name=&xxe;

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

and i tried to include just entity, even this does not works.

name=&xxe;

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I tried xml tag too, no luck.

name=&xxe;

REST API SQL Injection is broken.
When "/dvws/vulnerabilities/sqli/api.php/users/2" is called it returns "Fatal error: Uncaught Error: Call to undefined function mysql_connect()"

Thanks for this very useful tool. I will like to recommend integration of a feature.
Since there is already a WADL component, how about defining a document that contains the vulnerable endpoints in DVWS ? A possible standard could be using the Open API (formerly Swagger). The OpenAPI is getting popular and its inclusion could be a very useful functionality for REST security testing. Cheers !