diff --git a/webgoat-lessons/html-tampering/pom.xml b/webgoat-lessons/html-tampering/pom.xml new file mode 100755 index 000000000..44d24a8ce --- /dev/null +++ b/webgoat-lessons/html-tampering/pom.xml @@ -0,0 +1,34 @@ + + 4.0.0 + html-tampering + jar + + org.owasp.webgoat.lesson + webgoat-lessons-parent + 8.0-SNAPSHOT + + + + + org.springframework.boot + spring-boot-starter-test + test + + + org.springframework.security + spring-security-test + 4.1.3.RELEASE + test + + + junit + junit + ${junit.version} + jar + test + + + + + diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java new file mode 100755 index 000000000..86223963c --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTampering.java @@ -0,0 +1,63 @@ +package org.owasp.webgoat.plugin; + +import com.beust.jcommander.internal.Lists; +import org.owasp.webgoat.lessons.Category; +import org.owasp.webgoat.lessons.NewLesson; + +import java.util.List; + +/** + * ************************************************************************************************ + * This file is part of WebGoat, an Open Web Application Security Project utility. For details, + * please see http://www.owasp.org/ + *

+ * Copyright (c) 2002 - 20014 Bruce Mayhew + *

+ * This program is free software; you can redistribute it and/or modify it under the terms of the + * GNU General Public License as published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + *

+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without + * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + *

+ * You should have received a copy of the GNU General Public License along with this program; if + * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA + * 02111-1307, USA. + *

+ * Getting Source ============== + *

+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software + * projects. + *

+ * + * @author WebGoat + * @version $Id: $Id + * @since October 12, 2016 + */ +public class HtmlTampering extends NewLesson { + @Override + public Category getDefaultCategory() { + return Category.PARAMETER_TAMPERING; + } + + @Override + public List getHints() { + return Lists.newArrayList(); + } + + @Override + public Integer getDefaultRanking() { + return 3; + } + + @Override + public String getTitle() { + return "html-tampering.title"; + } + + @Override + public String getId() { + return "HtmlTampering"; + } +} diff --git a/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java new file mode 100755 index 000000000..a89ba294a --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/java/org/owasp/webgoat/plugin/HtmlTamperingTask.java @@ -0,0 +1,59 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.HttpServletRequest; +import java.io.IOException; + +/** + * ************************************************************************************************* + * + * + * This file is part of WebGoat, an Open Web Application Security Project + * utility. For details, please see http://www.owasp.org/ + * + * Copyright (c) 2002 - 20014 Bruce Mayhew + * + * This program is free software; you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free Software + * Foundation; either version 2 of the License, or (at your option) any later + * version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 59 Temple + * Place - Suite 330, Boston, MA 02111-1307, USA. + * + * Getting Source ============== + * + * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository + * for free software projects. + * + * For details, please see http://webgoat.github.io + * + * @author Bruce Mayhew WebGoat + * @created October 28, 2003 + */ +@AssignmentPath("/HtmlTampering/task") +public class HtmlTamperingTask extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + public + @ResponseBody + AttackResult completed(@RequestParam String QTY, @RequestParam String Total) throws IOException { + if (Float.parseFloat(QTY) * 2999.99 > Float.parseFloat(Total) + 1) { + return trackProgress(success().feedback("html-tampering.tamper.success").build()); + } + return trackProgress(failed().feedback("html-tampering.tamper.failure").build()); + } +} diff --git a/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html new file mode 100755 index 000000000..552fc8e1b --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html @@ -0,0 +1,91 @@ + + + + +

+ + +
+
+ +
+ +
+
+
+
+ +
+

Shopping Cart

+
+
+ + + + + + + + + + + + + + + +
Shopping Cart Items To Buy NowPriceQuantityTotal
56 inch HDTV (model KTV-551)2999.99 + +
+
+ + + + + + + + + +
The total charged to your credit card:$2999,99 + + + +
+ +
+ + +
+

+
+
+
+
+ diff --git a/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties new file mode 100755 index 000000000..8084fcf71 --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/i18n/WebGoatLabels.properties @@ -0,0 +1,5 @@ +html-tampering.title=HTML tampering + + +html-tampering.tamper.success=Well done, you just bought a TV at a discount +html-tampering.tamper.failure=This is too expensive... You need to buy at a cheaper cost! diff --git a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc new file mode 100755 index 000000000..d2dd4b243 --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Intro.adoc @@ -0,0 +1,7 @@ + +== Concept +Browsers generally offer many options of editing the displayed content. Developers +therefore must be aware that the values sent by the user may have been tampered with. +== Goals +* The user should have a basic understanding of HTML +* The user will be able to exploit editing front end of website diff --git a/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc new file mode 100755 index 000000000..60b07989d --- /dev/null +++ b/webgoat-lessons/html-tampering/src/main/resources/lessonPlans/en/HtmlTampering_Task.adoc @@ -0,0 +1,2 @@ +=== Try it yourself +This is an internet store. Try to buy TV-s for a lower price. diff --git a/webgoat-lessons/pom.xml b/webgoat-lessons/pom.xml index c0bd2241a..79d287f30 100644 --- a/webgoat-lessons/pom.xml +++ b/webgoat-lessons/pom.xml @@ -17,6 +17,7 @@ challenge client-side-filtering cross-site-scripting + html-tampering http-basics http-proxies insecure-login diff --git a/webgoat-server/pom.xml b/webgoat-server/pom.xml index 2708a0055..bce375377 100644 --- a/webgoat-server/pom.xml +++ b/webgoat-server/pom.xml @@ -101,6 +101,11 @@ cross-site-scripting ${project.version} + + org.owasp.webgoat.lesson + html-tampering + ${project.version} + org.owasp.webgoat.lesson http-basics