I have Kali Linux (Debian 2.0) running on a VMWare virtual machine on a mac running OS 10.10.5.

I have been trying to get the Damn Vulnerable Web Application (DVWA) running so I can practice some web app hacking on it. I installed Apache2 PHP MySQL etc with out flaw and I get the default Apache2 index.html when I go to localhost or 127.0.0.1 but if I direct to 127.0.0.1/index.php or 127.0.0.1/login.php i get a blank white page - nothing happens.

I am sure this is something simple. I have not touched anything out of the box so perhaps I need to do something in the apache2.conf file.

here is the install code I used--
I also stopped and re-started the apache server.
I am using the var/www/html webroot which is listed in 000-default.conf file

The other posts I found along these lines were several years old and the suggestions no longer applicable.

okay...
First off, Debian 2.0? Serious? This is like testing tires for speed that were made one hundred years ago...anyway...
What permission do your files have? Are they world readable? Is your folder world readable? Can you bring up a plain HTML page correctly? What does the logfile say? PHP writes its errors in the apache log file...
A blank page usually hints on a PHP error...
Can you bring up phpinfo.php at all?
Start with a simple HTML file, put it in the RIGHT folder (/var/www/html if I'm correct) and see if you can look at that...then work from there...
And now for the more crucial thing: welcome to this forum We look forward to reading from you some more
Melissa

Can you confirm that the two php files you refer to are in the /var/www/html directory you have set as Document Root?

Do you have an info.php file? What does it show? If you don't have it create it (code below) in the /var/www/html directory and access it from a brower.

In addition to the above questions asked, what is the doc root set to in the php.ini file?

Yes, I know it is old, it is what Kali Linux comes in. It's a hacker distro. The permissions are fine and as I mentioned I can see the apache2 default page fine (index.html) I will look into the log files. I am a little new to this but I can find those and look for specific PHP errors, should have thought of that. Thanks for the welcome

Yes, everything is in the web root, here is the ls

root@kaliMike:/var/www/html# ls
about.php config docs external hackable index.html instructions.php logout.php php.ini robots.txt setup.php
CHANGELOG.md COPYING.txt dvwa favicon.ico ids_log.php index.php login.php phpinfo.php README.md security.php vulnerabilities

As you can see no info.php file.

This is the entire php.ini

; This file attempts to overwrite the original php.ini file. Doesnt always work.

magic_quotes_gpc = Off
allow_url_fopen on
allow_url_include on

That's it

the problem is really simple, i don't remember th exact specifics, but you have to make sure php is working and so on.
on a debian web server it would Just Work (tm).
you seem a linux newbie - you shouldn't try to set up a web server, of all things, on kali linux.
why don't you try a netinstall of debian stable and choose the "web server" option when prompted.
wiki.debian.org will answer all your questions.

don't use the "-y" option with apt-get. the prompts are there for a reason, better to look at them and understand what you are actually doing there and if it succeeded.

(ps: it's kali 2.0, not debian 2.0)

2.0 is the current version of Kali which was released 11 August 2015 and is based on Debian Jessie. When the package is installed via apt-get everything should be configured...

You do have a phpinfo.php file, so what happens when you try http://localhost/phpinfo.php?

Check your /var/log/apache2/error.log for errors. It might provide a clue why the php pages are not being displayed.

How did you install dvwa?
http://www.geekyshows.com/2014/07/in...ali-linux.html

and...just a tip, the option:

provides more info...

see the -rw-r--r-- at every line? Those are the permission flags...

Melissa

If all you have in your php.ini files is what you posted above, that is definitely not right. I'd agree with the statement above about not using Kali. Try Debian or some other major distribution. Although it isn't difficult to install to a hard drive, it is meant to actually be used from a DVD or flash drive.

I mentioned I was new at this, however I have set up a number of servers before (IIS and apache on Mac OS). The reason I am attempting this on Kali Linux is in order to set up an intentionally vulnerable web app so I can practice with Kali. I included the -y prompt while following some other install instructions. You make a valid point. I do appreciate the help and I would not be here if I was as experienced as you seem to be. Thank you.

Thank Melissal, I was aware of this. I had checked the permissions myself. I should have included them in my post.

Thanks for the clarification on Kali Linux. That makes sense of course.

When I attempt to to go to http://localhost/phpinfo.php? I get a message saying; Unable to connect

Iceweasel can't establish a connection to the server at 127.0.0.1.

That is new. The other .php files just come up blank.

I went through my log files and I noticed this;

[Mon Dec 21 07:35:12.412644 2015] [mpm_prefork:notice] [pid 98692] AH00163: Apache/2.4.10 (Debian) configured -- resuming normal operations
[Mon Dec 21 07:35:12.412745 2015] [core:notice] [pid 98692] AH00094: Command line: '/usr/sbin/apache2'
[Mon Dec 21 19:29:57.763967 2015] [core:error] [pid 16261] (13)Permission denied: [client 127.0.0.1:55774] AH00035: access to /dvwa/setup.php denied (filesystem path '/var/www/html/dvwa/setup.php') because search permissions are missing on a component of the path
[Mon Dec 21 19:31:39.542788 2015] [:error] [pid 16262] [client 127.0.0.1:55777] PHP Warning: require_once(dvwa/includes/dvwaPage.inc.php): failed to open stream: Permission denied in /var/www/html/login.php on line 4
[Mon Dec 21 19:31:39.542882 2015] [:error] [pid 16262] [client 127.0.0.1:55777] PHP Fatal error: require_once(): Failed opening required 'dvwa/includes/dvwaPage.inc.php' (include_path='.:/usr/share/php:/usr/share/pear') in /var/www/html/login.php on line 4
[Mon Dec 21 19:32:04.891782 2015] [:error] [pid 16263] [client 127.0.0.1:55778] PHP Warning: require_once(dvwa/includes/dvwaPage.inc.php): failed to open stream: Permission denied in /var/www/html/index.php on line 4
[Mon Dec 21 19:32:04.891854 2015] [:error] [pid 16263] [client 127.0.0.1:55778] PHP Fatal error: require_once(): Failed opening required 'dvwa/includes/dvwaPage.inc.php' (include_path='.:/usr/share/php:/usr/share/pear') in /var/www/html/index.php on line 4

So I went to login.php line 4...

<?php

define( 'DVWA_WEB_PAGE_TO_ROOT', '' );
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';

and dvwa.Page.inc.php...

<?php

if( !defined( 'DVWA_WEB_PAGE_TO_ROOT' ) ) {
define( 'DVWA System error- WEB_PAGE_TO_ROOT undefined' );
exit;
}

session_start(); // Creates a 'Full Path Disclosure' vuln.

// Include configs
require_once DVWA_WEB_PAGE_TO_ROOT . 'config/config.inc.php';
require_once( 'dvwaPhpIds.inc.php' );


So in conclusion, Apache2 is working fine, this is a DVWA problem and I will figure it out. Many thanks to all who so kindly held my hand through this.

Just nudging you along
You'll get there, dont worry
Melissa