This project focused on identifying security vulnerabilities in the Damn Vulnerable Web Application (DVWA), a deliberately insecure web app used for learning and practice. It was hosted on Kali Linux using Docker for safe local testing. The vulnerabilities tested included SQL Injection, Reflected Cross-Site Scripting (XSS), Broken Authentication through brute-force login, and Cross-Site Request Forgery (CSRF). Each attack was simulated manually through the browser interface. All findings were mapped to the OWASP Top 10 categories. Each vulnerability was documented with screenshots, technical details, and suggested mitigation strategies to improve application security.