html restrictions lesson
This commit is contained in:
Michal Smolík
Nanne Baars
parent
007cdaa0d8
commit
01421ca822
34
webgoat-lessons/html-tampering/pom.xml
Executable file
34
webgoat-lessons/html-tampering/pom.xml
Executable file
@ -0,0 +1,34 @@
|
|||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||||
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||||
|
<modelVersion>4.0.0</modelVersion>
|
||||||
|
<artifactId>html-tampering</artifactId>
|
||||||
|
<packaging>jar</packaging>
|
||||||
|
<parent>
|
||||||
|
<groupId>org.owasp.webgoat.lesson</groupId>
|
||||||
|
<artifactId>webgoat-lessons-parent</artifactId>
|
||||||
|
<version>8.0-SNAPSHOT</version>
|
||||||
|
</parent>
|
||||||
|
|
||||||
|
<dependencies>
|
||||||
|
<dependency>
|
||||||
|
<groupId>org.springframework.boot</groupId>
|
||||||
|
<artifactId>spring-boot-starter-test</artifactId>
|
||||||
|
<scope>test</scope>
|
||||||
|
</dependency>
|
||||||
|
<dependency>
|
||||||
|
<groupId>org.springframework.security</groupId>
|
||||||
|
<artifactId>spring-security-test</artifactId>
|
||||||
|
<version>4.1.3.RELEASE</version>
|
||||||
|
<scope>test</scope>
|
||||||
|
</dependency>
|
||||||
|
<dependency>
|
||||||
|
<groupId>junit</groupId>
|
||||||
|
<artifactId>junit</artifactId>
|
||||||
|
<version>${junit.version}</version>
|
||||||
|
<type>jar</type>
|
||||||
|
<scope>test</scope>
|
||||||
|
</dependency>
|
||||||
|
|
||||||
|
</dependencies>
|
||||||
|
|
||||||
|
</project>
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
package org.owasp.webgoat.plugin;
|
||||||
|
|
||||||
|
import com.beust.jcommander.internal.Lists;
|
||||||
|
import org.owasp.webgoat.lessons.Category;
|
||||||
|
import org.owasp.webgoat.lessons.NewLesson;
|
||||||
|
|
||||||
|
import java.util.List;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* ************************************************************************************************
|
||||||
|
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||||
|
* please see http://www.owasp.org/
|
||||||
|
* <p>
|
||||||
|
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||||
|
* <p>
|
||||||
|
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||||
|
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||||
|
* License, or (at your option) any later version.
|
||||||
|
* <p>
|
||||||
|
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||||
|
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
* General Public License for more details.
|
||||||
|
* <p>
|
||||||
|
* You should have received a copy of the GNU General Public License along with this program; if
|
||||||
|
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||||
|
* 02111-1307, USA.
|
||||||
|
* <p>
|
||||||
|
* Getting Source ==============
|
||||||
|
* <p>
|
||||||
|
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||||
|
* projects.
|
||||||
|
* <p>
|
||||||
|
*
|
||||||
|
* @author WebGoat
|
||||||
|
* @version $Id: $Id
|
||||||
|
* @since October 12, 2016
|
||||||
|
*/
|
||||||
|
public class HtmlTampering extends NewLesson {
|
||||||
|
@Override
|
||||||
|
public Category getDefaultCategory() {
|
||||||
|
return Category.PARAMETER_TAMPERING;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public List<String> getHints() {
|
||||||
|
return Lists.newArrayList();
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public Integer getDefaultRanking() {
|
||||||
|
return 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public String getTitle() {
|
||||||
|
return "html-tampering.title";
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public String getId() {
|
||||||
|
return "HtmlTampering";
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,59 @@
|
|||||||
|
package org.owasp.webgoat.plugin;
|
||||||
|
|
||||||
|
import org.owasp.webgoat.assignments.AssignmentEndpoint;
|
||||||
|
import org.owasp.webgoat.assignments.AssignmentPath;
|
||||||
|
import org.owasp.webgoat.assignments.AttackResult;
|
||||||
|
import org.springframework.web.bind.annotation.RequestMapping;
|
||||||
|
import org.springframework.web.bind.annotation.RequestMethod;
|
||||||
|
import org.springframework.web.bind.annotation.RequestParam;
|
||||||
|
import org.springframework.web.bind.annotation.ResponseBody;
|
||||||
|
|
||||||
|
import javax.servlet.http.HttpServletRequest;
|
||||||
|
import java.io.IOException;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* *************************************************************************************************
|
||||||
|
*
|
||||||
|
*
|
||||||
|
* This file is part of WebGoat, an Open Web Application Security Project
|
||||||
|
* utility. For details, please see http://www.owasp.org/
|
||||||
|
*
|
||||||
|
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or modify it under
|
||||||
|
* the terms of the GNU General Public License as published by the Free Software
|
||||||
|
* Foundation; either version 2 of the License, or (at your option) any later
|
||||||
|
* version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||||
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||||
|
* details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License along with
|
||||||
|
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||||
|
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||||
|
*
|
||||||
|
* Getting Source ==============
|
||||||
|
*
|
||||||
|
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||||
|
* for free software projects.
|
||||||
|
*
|
||||||
|
* For details, please see http://webgoat.github.io
|
||||||
|
*
|
||||||
|
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||||
|
* @created October 28, 2003
|
||||||
|
*/
|
||||||
|
@AssignmentPath("/HtmlTampering/task")
|
||||||
|
public class HtmlTamperingTask extends AssignmentEndpoint {
|
||||||
|
|
||||||
|
@RequestMapping(method = RequestMethod.POST)
|
||||||
|
public
|
||||||
|
@ResponseBody
|
||||||
|
AttackResult completed(@RequestParam String QTY, @RequestParam String Total) throws IOException {
|
||||||
|
if (Float.parseFloat(QTY) * 2999.99 > Float.parseFloat(Total) + 1) {
|
||||||
|
return trackProgress(success().feedback("html-tampering.tamper.success").build());
|
||||||
|
}
|
||||||
|
return trackProgress(failed().feedback("html-tampering.tamper.failure").build());
|
||||||
|
}
|
||||||
|
}
|
||||||
91
webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html
Executable file
91
webgoat-lessons/html-tampering/src/main/resources/html/HtmlTampering.html
Executable file
@ -0,0 +1,91 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
|
||||||
|
<html xmlns:th="http://www.thymeleaf.org">
|
||||||
|
|
||||||
|
<div class="lesson-page-wrapper">
|
||||||
|
<!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
|
||||||
|
<!-- include content here. Content will be presented via asciidocs files,
|
||||||
|
which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
|
||||||
|
<div class="adoc-content" th:replace="doc:HtmlTampering_Intro.adoc"></div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="lesson-page-wrapper">
|
||||||
|
<!-- stripped down without extra comments -->
|
||||||
|
<div class="adoc-content" th:replace="doc:HtmlTampering_Task.adoc"></div>
|
||||||
|
<div class="attack-container">
|
||||||
|
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
|
||||||
|
<form class="attack-form" accept-charset="UNKNOWN" name="task"
|
||||||
|
method="POST"
|
||||||
|
action="/WebGoat/HtmlTampering/task"
|
||||||
|
enctype="application/json;charset=UTF-8">
|
||||||
|
<script>
|
||||||
|
let regex=/^2999.99$/
|
||||||
|
let price = 2999.99
|
||||||
|
document.getElementById("total").innerHTML = '$' + price.toString()
|
||||||
|
document.task.Total.value = price * document.task.QTY.value
|
||||||
|
|
||||||
|
$('#task').submit(function() {
|
||||||
|
if (!regex.test(price.toString())) {
|
||||||
|
alert('Data tampering is disallowed')
|
||||||
|
price = 2999.99
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
function update() {
|
||||||
|
let total = price * document.task.QTY.value
|
||||||
|
document.getElementById("total").innerHTML = total.toString()
|
||||||
|
document.task.Total.value = total
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<center>
|
||||||
|
<h1>Shopping Cart </h1>
|
||||||
|
</center>
|
||||||
|
<br />
|
||||||
|
<table align="center" cellspacing="0" width="90%" border="1" cellpadding="2">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<th width="80%">Shopping Cart Items To Buy Now</th>
|
||||||
|
<th width="10%">Price</th>
|
||||||
|
<th width="3%">Quantity</th>
|
||||||
|
<th width="7%">Total</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>56 inch HDTV (model KTV-551)</td>
|
||||||
|
<td align="right">2999.99</td>
|
||||||
|
<td align="right">
|
||||||
|
<input size="6" value="1" name="QTY" type="TEXT" id="QTY"/>
|
||||||
|
</td>
|
||||||
|
<td id="total"></td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<br />
|
||||||
|
<table align="center" cellspacing="0" width="90%" border="0" cellpadding="2">
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td>The total charged to your credit card:</td>
|
||||||
|
<td>$2999,99</td>
|
||||||
|
<td>
|
||||||
|
<input name="UPDATE" type="button" value="UpdateCart" onclick="update()"/>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<input value="Purchase" name="SUBMIT" type="submit" />
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
<input name="Total" type="HIDDEN" value="2999.99" />
|
||||||
|
<br />
|
||||||
|
|
||||||
|
|
||||||
|
</form>
|
||||||
|
<br></br>
|
||||||
|
<div class="attack-feedback"></div>
|
||||||
|
<div class="attack-output"></div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</html>
|
||||||
@ -0,0 +1,5 @@
|
|||||||
|
html-tampering.title=HTML tampering
|
||||||
|
|
||||||
|
|
||||||
|
html-tampering.tamper.success=Well done, you just bought a TV at a discount
|
||||||
|
html-tampering.tamper.failure=This is too expensive... You need to buy at a cheaper cost!
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
|
||||||
|
== Concept
|
||||||
|
Browsers generally offer many options of editing the displayed content. Developers
|
||||||
|
therefore must be aware that the values sent by the user may have been tampered with.
|
||||||
|
== Goals
|
||||||
|
* The user should have a basic understanding of HTML
|
||||||
|
* The user will be able to exploit editing front end of website
|
||||||
@ -0,0 +1,2 @@
|
|||||||
|
=== Try it yourself
|
||||||
|
This is an internet store. Try to buy TV-s for a lower price.
|
||||||
@ -17,6 +17,7 @@
|
|||||||
<module>challenge</module>
|
<module>challenge</module>
|
||||||
<module>client-side-filtering</module>
|
<module>client-side-filtering</module>
|
||||||
<module>cross-site-scripting</module>
|
<module>cross-site-scripting</module>
|
||||||
|
<module>html-tampering</module>
|
||||||
<module>http-basics</module>
|
<module>http-basics</module>
|
||||||
<module>http-proxies</module>
|
<module>http-proxies</module>
|
||||||
<module>insecure-login</module>
|
<module>insecure-login</module>
|
||||||
|
|||||||
@ -101,6 +101,11 @@
|
|||||||
<artifactId>cross-site-scripting</artifactId>
|
<artifactId>cross-site-scripting</artifactId>
|
||||||
<version>${project.version}</version>
|
<version>${project.version}</version>
|
||||||
</dependency>
|
</dependency>
|
||||||
|
<dependency>
|
||||||
|
<groupId>org.owasp.webgoat.lesson</groupId>
|
||||||
|
<artifactId>html-tampering</artifactId>
|
||||||
|
<version>${project.version}</version>
|
||||||
|
</dependency>
|
||||||
<dependency>
|
<dependency>
|
||||||
<groupId>org.owasp.webgoat.lesson</groupId>
|
<groupId>org.owasp.webgoat.lesson</groupId>
|
||||||
<artifactId>http-basics</artifactId>
|
<artifactId>http-basics</artifactId>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user