How To Work With WebGoat

Welcome to a brief overview of WebGoat.

Environment Information

WebGoat uses the Apache Tomcat server but can run in any application server. It is configured to run on localhost although this can be easily changed, see the ""Tomcat Configuration"" section in the Introduction.

The WebGoat Interface



1. Lesson Categories in WebGoat. Click on a Category to see specific Lessons.
2. This will show the underlying Java source code.
3. This will show the complete solution of the selected lesson.
4. This will show goals and objectives of the lesson.
5. This will show technical hints to solve the lesson.
6. This shows the HTTP request data
7. If you want to restart a lesson you can use this link.

Solve The Lesson

Always start with the lesson plan. Then try to solve the lesson and if necessary, use the hints. The last hint is the solution text if applicable. If you cannot solve the lesson using the hints, you may view the solution for complete details.

Read And Edit Parameters/Cookies

To read and edit parameters and cookies you need a local proxy like OWASP ZAP to intercept the HTTP request. More information on ZAP can be found in the "Useful Tools" section in the Introduction.

Configuring new WebGoat users

WebGoat uses spring-security.xml to configure users.

<!-- Authentication Manager -->
<authentication-manager alias="authenticationManager">
  <authentication-provider>
    <user-service>
      <user name="guest" password="guest" authorities="ROLE_WEBGOAT_USER" />
      <user name="webgoat" password="webgoat" authorities="ROLE_WEBGOAT_ADMIN" />
      <user name="server" password="server" authorities="ROLE_SERVER_ADMIN" />
    </user-service>
  </authentication-provider>
</authentication-manager>  
  

Adding Users

Usually WebGoat only requires logging in with the user:guest and password:guest. But maybe in laboratory you have made a setup with one server and a lot of clients. In this case you might want to have a user for every client, you will have to alter /WEB-INF/spring-security.xml to add additional users. We recommend not to use real passwords as the passwords are stored in plain text in this file!

Adding a new User

Adding a user is straight forward. You can use the guest entry as an example. The added users should have the same role as the guest user. The new user/password will not show on the login page. Add lines like this to the /WEB-INF/spring-security.xml file:

<user name="guest2" password="guest2" authorities="ROLE_WEBGOAT_USER" />
...