It's ok to put the mutillidae in /var/www/html/ because that it's the default apache root directory.
By default the linux sql server don't have a password set, so you need to type the stage 5....