diff --git a/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkDummy.java b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkDummy.java new file mode 100644 index 000000000..5ef8ce475 --- /dev/null +++ b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkDummy.java @@ -0,0 +1,22 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import java.io.IOException; + +@AssignmentPath("/ChromeDevTools/dummy") +public class NetworkDummy extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + public + @ResponseBody + AttackResult completed(@RequestParam String network_num) throws IOException { + return trackProgress(failed().feedback("network.request").build()); + } +} \ No newline at end of file diff --git a/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkLesson.java b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkLesson.java new file mode 100644 index 000000000..3743122fd --- /dev/null +++ b/webgoat-lessons/chrome-dev-tools/src/main/java/org/owasp/webgoat/plugin/NetworkLesson.java @@ -0,0 +1,26 @@ +package org.owasp.webgoat.plugin; + +import org.owasp.webgoat.assignments.AssignmentEndpoint; +import org.owasp.webgoat.assignments.AssignmentPath; +import org.owasp.webgoat.assignments.AttackResult; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.ResponseBody; + +import java.io.IOException; + +@AssignmentPath("/ChromeDevTools/network") +public class NetworkLesson extends AssignmentEndpoint { + + @RequestMapping(method = RequestMethod.POST) + public + @ResponseBody + AttackResult completed(@RequestParam String network_num, @RequestParam String number) throws IOException { + if(network_num.equals(number)) { + return trackProgress(success().feedback("network.success").build()); + } else { + return trackProgress(failed().feedback("network.failed").build()); + } + } +} diff --git a/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html b/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html index 008834a08..b322a96f9 100644 --- a/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html +++ b/webgoat-lessons/chrome-dev-tools/src/main/resources/html/ChromeDevTools.html @@ -34,4 +34,87 @@
+
+ + +
+
+
+ + + + +
+ + + + + + + + +
Click this button to make a request:
+
+ +
+ + + + + + + +
What is the number you found:
+ +
+
+
+
+
+ + \ No newline at end of file diff --git a/webgoat-lessons/chrome-dev-tools/src/main/resources/i18n/WebGoatLabels.properties b/webgoat-lessons/chrome-dev-tools/src/main/resources/i18n/WebGoatLabels.properties index 526d44892..a228c30b4 100644 --- a/webgoat-lessons/chrome-dev-tools/src/main/resources/i18n/WebGoatLabels.properties +++ b/webgoat-lessons/chrome-dev-tools/src/main/resources/i18n/WebGoatLabels.properties @@ -1,4 +1,8 @@ chrome-dev-tools.title=Google Chrome Developer Tools xss-dom-message-success=Correct! -xss-dom-message-failure=Incorrect. \ No newline at end of file +xss-dom-message-failure=Incorrect. + +network.request=You made a HTTP Request. +network.success=Correct, Well Done. +network.failed=That is not correct, try again. \ No newline at end of file diff --git a/webgoat-lessons/chrome-dev-tools/src/main/resources/lessonPlans/en/ChromeDevTools_Assignment.adoc b/webgoat-lessons/chrome-dev-tools/src/main/resources/lessonPlans/en/ChromeDevTools_Assignment.adoc index ca98c8d3d..405a8e5ec 100644 --- a/webgoat-lessons/chrome-dev-tools/src/main/resources/lessonPlans/en/ChromeDevTools_Assignment.adoc +++ b/webgoat-lessons/chrome-dev-tools/src/main/resources/lessonPlans/en/ChromeDevTools_Assignment.adoc @@ -1,6 +1,8 @@ == Try It! Using the Console Let's try it. Use the console in the dev tools and call the javascript function *webgoat.customjs.phoneHome*. + -You should get a response in the console. -Paste the phoneHome number in below. +You should get a response in the console. Your result should look something like: +`phone home said +{"lessonCompleted:true, ... ,"output":"phone home response is..."` +Paste the random number, after that, in the text field below. (Make sure you got the most recent number, since it's randomly generated each time you call the function) \ No newline at end of file diff --git a/webgoat-lessons/chrome-dev-tools/src/main/resources/lessonPlans/en/ChromeDevTools_Assignment_Network.adoc b/webgoat-lessons/chrome-dev-tools/src/main/resources/lessonPlans/en/ChromeDevTools_Assignment_Network.adoc new file mode 100644 index 000000000..a69677473 --- /dev/null +++ b/webgoat-lessons/chrome-dev-tools/src/main/resources/lessonPlans/en/ChromeDevTools_Assignment_Network.adoc @@ -0,0 +1,6 @@ +== Try It! Working with the Newtork Tab + +In this Assignment you need to find a specific HTTP request and read a randomized number from it. +To start click the first button, to generate an HTTP Request. Try to find this specific HTTP request. +The request should contain a field: `magic_num:` +Copy the number which is displayed afterwards, into the input field below and click on the check button. \ No newline at end of file