DVWA setup PHP function allow_url_include: Disabled

Question

I'm setting up DVWA on Windows via XAMPP, and I've searched in Google for about 24 hours - I cannot seem to find the answer.

My problem is setting up the server:

PHP function `allow_url_include: Disabled`

My config file says it's enabled. Could it have something to do with my ports? Should I set up my server for outside access to my router, or is the internal IP access enough?

When setting up my server I get this:

Database Setup

Click on the 'Create / Reset Database' button below to create or reset your database.

If you get an error make sure you have the correct user credentials in: C:\XAMPP\htdocs\dvwa/config/config.inc.php

Setup Check Operating system: Windows Backend database: MySQL PHP version: 5.5.30

Web Server SERVER_NAME: 192.168.0.13

PHP function display_errors: Enabled (Easy Mode!) PHP function safe_mode: Disabled PHP function allow_url_include: Disabled PHP function allow_url_fopen: Enabled PHP function magic_quotes_gpc: Disabled PHP module php-gd: Installed

reCAPTCHA key: Missing

Writable folder C:\XAMPP\htdocs\dvwa/hackable/uploads/: Yes) Writable file C:\XAMPP\htdocs\dvwa/external/phpids/0.6/lib/IDS/tmp/phpids_log.txt: Yes

Status in red, indicate there will be an issue when trying to complete some modules.

Solution 1

To solve the issue, go to:

C:\xampp\php\php.ini

And change:

allow_url_include=Off

To:

allow_url_include=On

Then go to:

C:\xampp\htdocs\DVWA\config\config.inc.php

And change:

$_DVWA[ 'recaptcha_public_key' ]  = ' ';
$_DVWA[ 'recaptcha_private_key' ] = ' ';

Into:

$_DVWA[ 'recaptcha_public_key' ]  = '6LdK7xITAAzzAAJQTfL7fu6I-0aPl8KHHieAT_yJg';
$_DVWA[ 'recaptcha_private_key' ] = '6LdK7xITAzzAAL_uw9YXVUOPoIHPZLfw2K1n5NVQ';

Solution 2

I know this is two weeks old at this point but to fix this you will want to modify php.ini, at least on Linux. I haven't ran into this on Windows, but here is the line you need to change:

; Whether to allow include/require to open URLs (like http:// or ftp://) as files.
; http://php.net/allow-url-include
allow_url_include=Off

Change that last line to:

allow_url_include=on

Now, restart the Apache server and reload the URL.

Solution 3

Found it for Windows and XAMPP installation. Don't bother to change values in php.ini file located in DVWA Folder. Instead, look for php.ini located in XAMPP installation directory e.g. C:\xampp\php\php.ini

Search for the string:

allow_url_include=

Change the value to allow_url_include=On and restart apache.

Solution 4

For Kali Linux editing "apache2 wide" php.ini worked for me:

# updatedb
# locate php.ini
/etc/php/7.2/apache2/php.ini
/etc/php/7.2/cli/php.ini
/usr/lib/php/7.2/php.ini-development
/usr/lib/php/7.2/php.ini-production
/usr/lib/php/7.2/php.ini-production.cli
/var/www/html/DVWA-master/php.ini
# nano /etc/php/7.2/apache2/php.ini

CTRL + W, search for allow_url_include, set it On

# service restart apache2

And you should have allow_url_include enabled

Solution 5

Found the problems mates but this for windows but may apply for you 👍

you need to apply the changes in the "phpForApache.ini" not the "php.in"

View more solutions

Comments

[Mohammad Sina Karvandi]

It works but I should say you must restart apache service on xampp to see the affects .

[coatless]

Not sure how this is related to the allow_url_include issue as it is disabling a url.

[Elie Saad]

This post doesn't answer the question