dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

work on logging

Browse Source
This commit is contained in:
lawson89 2014-06-03 14:39:21 -04:00
parent c8ec75b5f2
commit 10be6757af
4 changed files with 771 additions and 781 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

724
java/org/owasp/webgoat/HammerHead.java
View File

@ -1,4 +1,3 @@
package org.owasp.webgoat; package org.owasp.webgoat;
import java.io.IOException; import java.io.IOException;
@ -22,461 +21,410 @@ import org.owasp.webgoat.session.Screen;
import org.owasp.webgoat.session.UserTracker; import org.owasp.webgoat.session.UserTracker;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.owasp.webgoat.session.WebgoatContext; import org.owasp.webgoat.session.WebgoatContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
/*************************************************************************************************** * *************************************************************************************************
* *
* *
* This file is part of WebGoat, an Open Web Application Security Project utility. For details, * This file is part of WebGoat, an Open Web Application Security Project
* please see http://www.owasp.org/ * utility. For details, please see http://www.owasp.org/
* *
* Copyright (c) 2002 - 2007 Bruce Mayhew * Copyright (c) 2002 - 2007 Bruce Mayhew
* *
* This program is free software; you can redistribute it and/or modify it under the terms of the * This program is free software; you can redistribute it and/or modify it under
* GNU General Public License as published by the Free Software Foundation; either version 2 of the * the terms of the GNU General Public License as published by the Free Software
* License, or (at your option) any later version. * Foundation; either version 2 of the License, or (at your option) any later
* version.
* *
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without * This program is distributed in the hope that it will be useful, but WITHOUT
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* General Public License for more details. * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
* *
* You should have received a copy of the GNU General Public License along with this program; if * You should have received a copy of the GNU General Public License along with
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
* 02111-1307, USA. * Place - Suite 330, Boston, MA 02111-1307, USA.
* *
* Getting Source ============== * Getting Source ==============
* *
* Source for this application is maintained at code.google.com, a repository for free software * Source for this application is maintained at code.google.com, a repository
* projects. * for free software projects.
* *
* For details, please see http://code.google.com/p/webgoat/ * For details, please see http://code.google.com/p/webgoat/
* *
* *
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a> * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect
* Security</a>
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a> * @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
* @created October 28, 2003 * @created October 28, 2003
*/ */
public class HammerHead extends HttpServlet public class HammerHead extends HttpServlet {
{
private static final String WELCOMED = "welcomed"; final Logger logger = LoggerFactory.getLogger(HammerHead.class);
/**
*
*/
private static final long serialVersionUID = 645640331343188020L;
/** private static final String WELCOMED = "welcomed";
* Description of the Field
*/
protected static SimpleDateFormat httpDateFormat;
/** /**
* Set the session timeout to be 2 days *
*/ */
private final static int sessionTimeoutSeconds = 60 * 60 * 24 * 2; private static final long serialVersionUID = 645640331343188020L;
/**
* Description of the Field
*/
protected static SimpleDateFormat httpDateFormat;
/**
* Set the session timeout to be 2 days
*/
private final static int sessionTimeoutSeconds = 60 * 60 * 24 * 2;
// private final static int sessionTimeoutSeconds = 1; // private final static int sessionTimeoutSeconds = 1;
/**
* Properties file path
*/
public static String propertiesPath = null;
/** /**
* Properties file path * provides convenience methods for getting setup information from the
*/ * ServletContext
public static String propertiesPath = null; */
private WebgoatContext webgoatContext = null;
/** /**
* provides convenience methods for getting setup information from the ServletContext * Description of the Method
*/ *
private WebgoatContext webgoatContext = null; * @param request Description of the Parameter
* @param response Description of the Parameter
* @exception IOException Description of the Exception
* @exception ServletException Description of the Exception
*/
@Override
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
doPost(request, response);
}
/** /**
* Description of the Method * Description of the Method
* *
* @param request * @param request Description of the Parameter
* Description of the Parameter * @param response Description of the Parameter
* @param response * @exception IOException Description of the Exception
* Description of the Parameter * @exception ServletException Description of the Exception
* @exception IOException */
* Description of the Exception @Override
* @exception ServletException public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
* Description of the Exception Screen screen = null;
*/
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException
{
doPost(request, response);
}
/** WebSession mySession = null;
* Description of the Method try {
* // System.out.println( "HH Entering doPost: " );
* @param request // System.out.println( " - HH request " + request);
* Description of the Parameter // System.out.println( " - HH principle: " +
* @param response // request.getUserPrincipal() );
* Description of the Parameter // setCacheHeaders(response, 0);
* @exception IOException ServletContext context = getServletContext();
* Description of the Exception
* @exception ServletException
* Description of the Exception
*/
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException
{
Screen screen = null;
WebSession mySession = null; // FIXME: If a response is written by updateSession(), do not
try // call makeScreen() and writeScreen()
{ mySession = updateSession(request, response, context);
// System.out.println( "HH Entering doPost: " ); if (response.isCommitted()) {
// System.out.println( " - HH request " + request); return;
// System.out.println( " - HH principle: " + }
// request.getUserPrincipal() );
// setCacheHeaders(response, 0);
ServletContext context = getServletContext();
// FIXME: If a response is written by updateSession(), do not // Note: For the lesson to track the status, we need to update
// call makeScreen() and writeScreen() // the lesson tracker object
mySession = updateSession(request, response, context); // from the screen.createContent() method. The create content is
if (response.isCommitted()) return; // the only point
// where the lesson "knows" what has happened. To track it at a
// latter point would
// require the lesson to have memory.
screen = makeScreen(mySession); // This calls the lesson's
// handleRequest()
if (response.isCommitted()) {
return;
}
// Note: For the lesson to track the status, we need to update // perform lesson-specific tracking activities
// the lesson tracker object if (screen instanceof AbstractLesson) {
// from the screen.createContent() method. The create content is AbstractLesson lesson = (AbstractLesson) screen;
// the only point
// where the lesson "knows" what has happened. To track it at a
// latter point would
// require the lesson to have memory.
screen = makeScreen(mySession); // This calls the lesson's
// handleRequest()
if (response.isCommitted()) return;
// perform lesson-specific tracking activities // we do not count the initial display of the lesson screen as a visit
if (screen instanceof AbstractLesson) if ("GET".equals(request.getMethod())) {
{ String uri = request.getRequestURI() + "?" + request.getQueryString();
AbstractLesson lesson = (AbstractLesson) screen; if (!uri.endsWith(lesson.getLink())) {
screen.getLessonTracker(mySession).incrementNumVisits();
}
} else if ("POST".equals(request.getMethod())
&& mySession.getPreviousScreen() == mySession.getCurrentScreen()) {
screen.getLessonTracker(mySession).incrementNumVisits();
}
}
// we do not count the initial display of the lesson screen as a visit // log the access to this screen for this user
if ("GET".equals(request.getMethod())) UserTracker userTracker = UserTracker.instance();
{ userTracker.update(mySession, screen);
String uri = request.getRequestURI() + "?" + request.getQueryString(); log(request, screen.getClass().getName() + " | " + mySession.getParser().toString());
if (!uri.endsWith(lesson.getLink())) screen.getLessonTracker(mySession).incrementNumVisits();
}
else if ("POST".equals(request.getMethod())
&& mySession.getPreviousScreen() == mySession.getCurrentScreen())
{
screen.getLessonTracker(mySession).incrementNumVisits();
}
}
// log the access to this screen for this user // Redirect the request to our View servlet
UserTracker userTracker = UserTracker.instance(); String userAgent = request.getHeader("user-agent");
userTracker.update(mySession, screen); String clientBrowser = "Not known!";
log(request, screen.getClass().getName() + " | " + mySession.getParser().toString()); if (userAgent != null) {
clientBrowser = userAgent;
}
request.setAttribute("client.browser", clientBrowser);
request.getSession().setAttribute("websession", mySession);
request.getSession().setAttribute("course", mySession.getCourse());
// Redirect the request to our View servlet request.getRequestDispatcher(getViewPage(mySession)).forward(request, response);
String userAgent = request.getHeader("user-agent"); } catch (Throwable t) {
String clientBrowser = "Not known!"; t.printStackTrace();
if (userAgent != null) log("ERROR: " + t);
{ screen = new ErrorScreen(mySession, t);
clientBrowser = userAgent; } finally {
} try {
request.setAttribute("client.browser", clientBrowser); this.writeScreen(mySession, screen, response);
request.getSession().setAttribute("websession", mySession); } catch (Throwable thr) {
request.getSession().setAttribute("course", mySession.getCourse()); thr.printStackTrace();
log(request, "Could not write error screen: " + thr.getMessage());
}
WebSession.returnConnection(mySession);
// System.out.println( "HH Leaving doPost: " );
}
}
request.getRequestDispatcher(getViewPage(mySession)).forward(request, response); private String getViewPage(WebSession webSession) {
} catch (Throwable t) String page;
{
t.printStackTrace();
log("ERROR: " + t);
screen = new ErrorScreen(mySession, t);
} finally
{
try
{
this.writeScreen(mySession, screen, response);
} catch (Throwable thr)
{
thr.printStackTrace();
log(request, "Could not write error screen: " + thr.getMessage());
}
WebSession.returnConnection(mySession);
// System.out.println( "HH Leaving doPost: " );
}
}
private String getViewPage(WebSession webSession) // If this session has not seen the landing page yet, go there instead.
{ HttpSession session = webSession.getRequest().getSession();
String page; if (session.getAttribute(WELCOMED) == null) {
session.setAttribute(WELCOMED, "true");
page = "/webgoat.jsp";
} else {
page = "/main.jsp";
}
// If this session has not seen the landing page yet, go there instead. return page;
HttpSession session = webSession.getRequest().getSession(); }
if (session.getAttribute(WELCOMED) == null)
{
session.setAttribute(WELCOMED, "true");
page = "/webgoat.jsp";
}
else
page = "/main.jsp";
return page; /**
} * Description of the Method
*
* @param date Description of the Parameter
* @return RFC 1123 http date format
*/
protected static String formatHttpDate(Date date) {
synchronized (httpDateFormat) {
return httpDateFormat.format(date);
}
}
/** /**
* Description of the Method * Return information about this servlet
* *
* @param date * @return The servletInfo value
* Description of the Parameter */
* @return RFC 1123 http date format @Override
*/ public String getServletInfo() {
protected static String formatHttpDate(Date date) return "WebGoat is sponsored by Aspect Security.";
{ }
synchronized (httpDateFormat)
{
return httpDateFormat.format(date);
}
}
/** /**
* Return information about this servlet * Return properties path
* *
* @return The servletInfo value * @throws javax.servlet.ServletException
*/ */
public String getServletInfo() @Override
{ public void init() throws ServletException {
return "WebGoat is sponsored by Aspect Security."; httpDateFormat = new SimpleDateFormat("EEE, dd MMM yyyyy HH:mm:ss z", Locale.US);
} httpDateFormat.setTimeZone(TimeZone.getTimeZone("GMT"));
propertiesPath = getServletContext().getRealPath("./WEB-INF/webgoat.properties");
webgoatContext = new WebgoatContext(this);
}
/** /**
* Return properties path * Description of the Method
* *
* @return servlet context path + WEB_INF * @param request Description of the Parameter
*/ * @param message Description of the Parameter
public void init() throws ServletException */
{ public void log(HttpServletRequest request, String message) {
httpDateFormat = new SimpleDateFormat("EEE, dd MMM yyyyy HH:mm:ss z", Locale.US); String output = new Date() + " | " + request.getRemoteHost() + ":" + request.getRemoteAddr() + " | " + message;
httpDateFormat.setTimeZone(TimeZone.getTimeZone("GMT")); log(output);
propertiesPath = getServletContext().getRealPath("./WEB-INF/webgoat.properties"); logger.debug(output);
webgoatContext = new WebgoatContext(this); }
}
/** /*
* Description of the Method * public List getLessons(Category category, String role) { Course course =
* * mySession.getCourse(); // May need to clone the List before returning it. //return new
* @param request * ArrayList(course.getLessons(category, role)); return course.getLessons(category, role); }
* Description of the Parameter */
* @param message /**
* Description of the Parameter * Description of the Method
*/ *
public void log(HttpServletRequest request, String message) * @param s Description of the Parameter
{ * @return Description of the Return Value
String output = new Date() + " | " + request.getRemoteHost() + ":" + request.getRemoteAddr() + " | " + message; */
log(output); protected Screen makeScreen(WebSession s) {
System.out.println(output); Screen screen = null;
} int scr = s.getCurrentScreen();
Course course = s.getCourse();
/* if (s.isUser() || s.isChallenge()) {
* public List getLessons(Category category, String role) { Course course = if (scr == WebSession.WELCOME) {
* mySession.getCourse(); // May need to clone the List before returning it. //return new screen = new WelcomeScreen(s);
* ArrayList(course.getLessons(category, role)); return course.getLessons(category, role); } } else {
*/ AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
if (lesson == null && s.isHackedAdmin()) {
/**
* Description of the Method
*
* @param s
* Description of the Parameter
* @return Description of the Return Value
*/
protected Screen makeScreen(WebSession s)
{
Screen screen = null;
int scr = s.getCurrentScreen();
Course course = s.getCourse();
if (s.isUser() || s.isChallenge())
{
if (scr == WebSession.WELCOME)
{
screen = new WelcomeScreen(s);
}
else
{
AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
if (lesson == null && s.isHackedAdmin())
{
// If admin was hacked, let the user see some of the // If admin was hacked, let the user see some of the
// admin screens // admin screens
lesson = course.getLesson(s, scr, AbstractLesson.HACKED_ADMIN_ROLE); lesson = course.getLesson(s, scr, AbstractLesson.HACKED_ADMIN_ROLE);
} }
if (lesson != null) if (lesson != null) {
{ screen = lesson;
screen = lesson;
// We need to do some bookkeeping for the hackable admin // We need to do some bookkeeping for the hackable admin
// interface. // interface.
// This is the only place we can tell if the user // This is the only place we can tell if the user
// successfully hacked the hackable // successfully hacked the hackable
// admin and has actually accessed an admin screen. You // admin and has actually accessed an admin screen. You
// need BOTH pieces of information // need BOTH pieces of information
// in order to satisfy the remote admin lesson. // in order to satisfy the remote admin lesson.
s.setHasHackableAdmin(screen.getRole());
s.setHasHackableAdmin(screen.getRole()); lesson.handleRequest(s);
s.setCurrentMenu(lesson.getCategory().getRanking());
lesson.handleRequest(s); } else {
s.setCurrentMenu(lesson.getCategory().getRanking()); screen = new ErrorScreen(s, "Invalid screen requested. Try: http://localhost/WebGoat/attack");
} }
else }
{ } else if (s.isAdmin()) {
screen = new ErrorScreen(s, "Invalid screen requested. Try: http://localhost/WebGoat/attack"); if (scr == WebSession.WELCOME) {
} screen = new WelcomeAdminScreen(s);
} } else {
}
else if (s.isAdmin())
{
if (scr == WebSession.WELCOME)
{
screen = new WelcomeAdminScreen(s);
}
else
{
// Admin can see all roles. // Admin can see all roles.
// FIXME: should be able to pass a list of roles. // FIXME: should be able to pass a list of roles.
AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.ADMIN_ROLE); AbstractLesson lesson = course.getLesson(s, scr, AbstractLesson.ADMIN_ROLE);
if (lesson == null) if (lesson == null) {
{ lesson = course.getLesson(s, scr, AbstractLesson.HACKED_ADMIN_ROLE);
lesson = course.getLesson(s, scr, AbstractLesson.HACKED_ADMIN_ROLE); }
} if (lesson == null) {
if (lesson == null) lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
{ }
lesson = course.getLesson(s, scr, AbstractLesson.USER_ROLE);
}
if (lesson != null) if (lesson != null) {
{ screen = lesson;
screen = lesson;
// We need to do some bookkeeping for the hackable admin // We need to do some bookkeeping for the hackable admin
// interface. // interface.
// This is the only place we can tell if the user // This is the only place we can tell if the user
// successfully hacked the hackable // successfully hacked the hackable
// admin and has actually accessed an admin screen. You // admin and has actually accessed an admin screen. You
// need BOTH pieces of information // need BOTH pieces of information
// in order to satisfy the remote admin lesson. // in order to satisfy the remote admin lesson.
s.setHasHackableAdmin(screen.getRole());
s.setHasHackableAdmin(screen.getRole()); lesson.handleRequest(s);
s.setCurrentMenu(lesson.getCategory().getRanking());
} else {
screen = new ErrorScreen(s,
"Invalid screen requested. Try Setting Admin to false or Try: http://localhost/WebGoat/attack");
}
}
}
lesson.handleRequest(s); return (screen);
s.setCurrentMenu(lesson.getCategory().getRanking()); }
}
else
{
screen = new ErrorScreen(s,
"Invalid screen requested. Try Setting Admin to false or Try: http://localhost/WebGoat/attack");
}
}
}
return (screen); /**
} * This method sets the required expiration headers in the response for a
* given RunData object. This method attempts to set all relevant headers,
* both for HTTP 1.0 and HTTP 1.1.
*
* @param response The new cacheHeaders value
* @param expiry The new cacheHeaders value
*/
protected static void setCacheHeaders(HttpServletResponse response, int expiry) {
if (expiry == 0) {
response.setHeader("Pragma", "no-cache");
response.setHeader("Cache-Control", "no-cache");
response.setHeader("Expires", formatHttpDate(new Date()));
} else {
Date expiryDate = new Date(System.currentTimeMillis() + expiry);
response.setHeader("Expires", formatHttpDate(expiryDate));
}
}
/** /**
* This method sets the required expiration headers in the response for a given RunData object. * Description of the Method
* This method attempts to set all relevant headers, both for HTTP 1.0 and HTTP 1.1. *
* * @param request Description of the Parameter
* @param response * @param response Description of the Parameter
* The new cacheHeaders value * @param context Description of the Parameter
* @param expiry * @return Description of the Return Value
* The new cacheHeaders value * @throws java.io.IOException
*/ */
protected static void setCacheHeaders(HttpServletResponse response, int expiry) protected WebSession updateSession(HttpServletRequest request, HttpServletResponse response, ServletContext context)
{ throws IOException {
if (expiry == 0) HttpSession hs;
{ hs = request.getSession(true);
response.setHeader("Pragma", "no-cache");
response.setHeader("Cache-Control", "no-cache");
response.setHeader("Expires", formatHttpDate(new Date()));
}
else
{
Date expiryDate = new Date(System.currentTimeMillis() + expiry);
response.setHeader("Expires", formatHttpDate(expiryDate));
}
}
/**
* Description of the Method
*
* @param request
* Description of the Parameter
* @param response
* Description of the Parameter
* @param context
* Description of the Parameter
* @return Description of the Return Value
*/
protected WebSession updateSession(HttpServletRequest request, HttpServletResponse response, ServletContext context)
throws IOException
{
HttpSession hs;
hs = request.getSession(true);
// System.out.println( "HH Entering Session_id: " + hs.getId() ); // System.out.println( "HH Entering Session_id: " + hs.getId() );
// dumpSession( hs ); // dumpSession( hs );
// Get our session object out of the HTTP session // Get our session object out of the HTTP session
WebSession session = null; WebSession session = null;
Object o = hs.getAttribute(WebSession.SESSION); Object o = hs.getAttribute(WebSession.SESSION);
if ((o != null) && o instanceof WebSession) if ((o != null) && o instanceof WebSession) {
{ session = (WebSession) o;
session = (WebSession) o; } else {
}
else
{
// Create new custom session and save it in the HTTP session // Create new custom session and save it in the HTTP session
// System.out.println( "HH Creating new WebSession: " ); // System.out.println( "HH Creating new WebSession: " );
session = new WebSession(webgoatContext, context); session = new WebSession(webgoatContext, context);
// Ensure splash screen shows on any restart // Ensure splash screen shows on any restart
hs.removeAttribute(WELCOMED); hs.removeAttribute(WELCOMED);
hs.setAttribute(WebSession.SESSION, session); hs.setAttribute(WebSession.SESSION, session);
// reset timeout // reset timeout
hs.setMaxInactiveInterval(sessionTimeoutSeconds); hs.setMaxInactiveInterval(sessionTimeoutSeconds);
} }
session.update(request, response, this.getServletName()); session.update(request, response, this.getServletName());
// to authenticate // to authenticate
// System.out.println( "HH Leaving Session_id: " + hs.getId() ); // System.out.println( "HH Leaving Session_id: " + hs.getId() );
// dumpSession( hs ); // dumpSession( hs );
return (session); return (session);
} }
/** /**
* Description of the Method * Description of the Method
* *
* @param s * @param s Description of the Parameter
* Description of the Parameter * @param screen
* @param response * @param response Description of the Parameter
* Description of the Parameter * @exception IOException Description of the Exception
* @exception IOException */
* Description of the Exception protected void writeScreen(WebSession s, Screen screen, HttpServletResponse response) throws IOException {
*/ response.setContentType("text/html");
protected void writeScreen(WebSession s, Screen screen, HttpServletResponse response) throws IOException
{
response.setContentType("text/html");
PrintWriter out = response.getWriter(); PrintWriter out = response.getWriter();
if (s == null) if (s == null) {
{ screen = new ErrorScreen(s, "Page to display was null");
screen = new ErrorScreen(s, "Page to display was null"); }
}
// set the content-length of the response. // set the content-length of the response.
// Trying to avoid chunked-encoding. (Aspect required) // Trying to avoid chunked-encoding. (Aspect required)
response.setContentLength(screen.getContentLength()); response.setContentLength(screen.getContentLength());
response.setHeader("Content-Length", screen.getContentLength() + ""); response.setHeader("Content-Length", screen.getContentLength() + "");
screen.output(out); screen.output(out);
out.close(); out.close();
} }
} }

604
pom.xml
View File

@ -1,320 +1,326 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion> <modelVersion>4.0.0</modelVersion>
<groupId>WebGoat</groupId> <groupId>WebGoat</groupId>
<artifactId>WebGoat</artifactId> <artifactId>WebGoat</artifactId>
<packaging>war</packaging> <packaging>war</packaging>
<version>6.0-SNAPSHOT</version> <version>6.0-SNAPSHOT</version>
<repositories> <repositories>
<repository> <repository>
<id>maven2-repository.dev.java.net</id> <id>maven2-repository.dev.java.net</id>
<name>Java.net Maven 2 Repository</name> <name>Java.net Maven 2 Repository</name>
<url>http://download.java.net/maven/2</url> <url>http://download.java.net/maven/2</url>
</repository> </repository>
</repositories> </repositories>
<!-- Shared version number properties --> <!-- Shared version number properties -->
<properties> <properties>
<org.springframework.version>3.2.4.RELEASE</org.springframework.version> <org.springframework.version>3.2.4.RELEASE</org.springframework.version>
<spring.security.version>3.2.4.RELEASE</spring.security.version> <spring.security.version>3.2.4.RELEASE</spring.security.version>
<tiles.version>2.2.2</tiles.version> <tiles.version>2.2.2</tiles.version>
</properties> </properties>
<build> <build>
<sourceDirectory>${basedir}/java</sourceDirectory> <sourceDirectory>${basedir}/java</sourceDirectory>
<resources> <resources>
<resource> <resource>
<directory>${basedir}/java</directory> <directory>${basedir}/java</directory>
</resource> </resource>
<resource> <resource>
<directory>${basedir}/resources</directory> <directory>${basedir}/resources</directory>
</resource> </resource>
</resources> </resources>
<plugins> <plugins>
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId> <artifactId>maven-compiler-plugin</artifactId>
<configuration> <configuration>
<source>1.6</source> <source>1.6</source>
<target>1.6</target> <target>1.6</target>
<encoding>ISO-8859-1</encoding> <encoding>ISO-8859-1</encoding>
</configuration> </configuration>
</plugin> </plugin>
<plugin> <plugin>
<artifactId>maven-eclipse-plugin</artifactId> <artifactId>maven-eclipse-plugin</artifactId>
<configuration> <configuration>
<wtpversion>1.5</wtpversion> <wtpversion>1.5</wtpversion>
<sourceIncludes> <sourceIncludes>
<sourceInclude>${basedir}/java/**/*.java</sourceInclude> <sourceInclude>${basedir}/java/**/*.java</sourceInclude>
</sourceIncludes> </sourceIncludes>
</configuration> </configuration>
</plugin> </plugin>
<plugin> <plugin>
<groupId>org.apache.maven.plugins</groupId> <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-war-plugin</artifactId> <artifactId>maven-war-plugin</artifactId>
<configuration> <configuration>
<warSourceDirectory>${basedir}/webapp</warSourceDirectory> <warSourceDirectory>${basedir}/webapp</warSourceDirectory>
</configuration> </configuration>
</plugin> </plugin>
<plugin> <plugin>
<groupId>org.codehaus.mojo</groupId> <groupId>org.codehaus.mojo</groupId>
<artifactId>tomcat-maven-plugin</artifactId> <artifactId>tomcat-maven-plugin</artifactId>
<configuration> <configuration>
<url>http://localhost:8080/manager</url> <url>http://localhost:8080/manager</url>
<additionalConfigFilesDir>${basedir}/tomcatconf</additionalConfigFilesDir> <additionalConfigFilesDir>${basedir}/tomcatconf</additionalConfigFilesDir>
</configuration> </configuration>
</plugin> </plugin>
</plugins> </plugins>
</build> </build>
<dependencies> <dependencies>
<dependency> <dependency>
<groupId>javax.activation</groupId> <groupId>javax.activation</groupId>
<artifactId>activation</artifactId> <artifactId>activation</artifactId>
<version>1.1</version> <version>1.1</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis</artifactId> <artifactId>axis</artifactId>
<version>1.2</version> <version>1.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis-saaj</artifactId> <artifactId>axis-saaj</artifactId>
<version>1.2</version> <version>1.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis-jaxrpc</artifactId> <artifactId>axis-jaxrpc</artifactId>
<version>1.2</version> <version>1.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>axis</groupId> <groupId>axis</groupId>
<artifactId>axis-ant</artifactId> <artifactId>axis-ant</artifactId>
<version>1.2</version> <version>1.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-fileupload</groupId> <groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId> <artifactId>commons-fileupload</artifactId>
<version>1.2.1</version> <version>1.2.1</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-io</groupId> <groupId>commons-io</groupId>
<artifactId>commons-io</artifactId> <artifactId>commons-io</artifactId>
<version>1.4</version> <version>1.4</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-collections</groupId> <groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId> <artifactId>commons-collections</artifactId>
<version>3.1</version> <version>3.1</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-digester</groupId> <groupId>commons-digester</groupId>
<artifactId>commons-digester</artifactId> <artifactId>commons-digester</artifactId>
<version>1.4.1</version> <version>1.4.1</version>
<exclusions> <exclusions>
<exclusion> <exclusion>
<groupId>xml-apis</groupId> <groupId>xml-apis</groupId>
<artifactId>xml-apis</artifactId> <artifactId>xml-apis</artifactId>
</exclusion> </exclusion>
</exclusions> </exclusions>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-logging</groupId> <groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId> <artifactId>commons-logging</artifactId>
<version>1.0.4</version> <version>1.1.3</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>commons-discovery</groupId> <groupId>org.slf4j</groupId>
<artifactId>commons-discovery</artifactId> <artifactId>jcl-over-slf4j</artifactId>
<version>0.2</version> <version>1.7.7</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>javax.mail</groupId> <groupId>commons-discovery</groupId>
<artifactId>mail</artifactId> <artifactId>commons-discovery</artifactId>
<version>1.4.2</version> <version>0.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>javax.mail</groupId> <groupId>javax.mail</groupId>
<artifactId>mailapi</artifactId> <artifactId>mail</artifactId>
<version>1.4.2</version> <version>1.4.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>hsqldb</groupId> <groupId>javax.mail</groupId>
<artifactId>hsqldb</artifactId> <artifactId>mailapi</artifactId>
<version>1.8.0.7</version> <version>1.4.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>log4j</groupId> <groupId>hsqldb</groupId>
<artifactId>log4j</artifactId> <artifactId>hsqldb</artifactId>
<version>1.2.8</version> <version>1.8.0.7</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>wsdl4j</groupId> <groupId>log4j</groupId>
<artifactId>wsdl4j</artifactId> <artifactId>log4j</artifactId>
<version>1.5.1</version> <version>1.2.17</version>
</dependency> </dependency>
<dependency>
<groupId>java2html</groupId> <dependency>
<artifactId>j2h</artifactId> <groupId>wsdl4j</groupId>
<version>1.3.1</version> <artifactId>wsdl4j</artifactId>
</dependency> <version>1.5.1</version>
<dependency> </dependency>
<groupId>ecs</groupId> <dependency>
<artifactId>ecs</artifactId> <groupId>java2html</groupId>
<version>1.4.2</version> <artifactId>j2h</artifactId>
</dependency> <version>1.3.1</version>
<dependency> </dependency>
<groupId>javax.transaction</groupId> <dependency>
<artifactId>jta</artifactId> <groupId>ecs</groupId>
<version>1.0.1B</version> <artifactId>ecs</artifactId>
</dependency> <version>1.4.2</version>
<dependency> </dependency>
<groupId>net.sourceforge.jtds</groupId> <dependency>
<artifactId>jtds</artifactId> <groupId>javax.transaction</groupId>
<version>1.2.2</version> <artifactId>jta</artifactId>
</dependency> <version>1.0.1B</version>
<dependency> </dependency>
<groupId>org.apache.tomcat</groupId> <dependency>
<artifactId>tomcat-catalina</artifactId> <groupId>net.sourceforge.jtds</groupId>
<version>7.0.27</version> <artifactId>jtds</artifactId>
<scope>provided</scope> <version>1.2.2</version>
</dependency> </dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina</artifactId>
<version>7.0.27</version>
<scope>provided</scope>
</dependency>
<!-- ************* spring MVC and related dependencies ************** --> <!-- ************* spring MVC and related dependencies ************** -->
<!-- servlet API --> <!-- servlet API -->
<dependency> <dependency>
<groupId>javax</groupId> <groupId>javax</groupId>
<artifactId>javaee-api</artifactId> <artifactId>javaee-api</artifactId>
<version>6.0</version> <version>6.0</version>
<scope>provided</scope> <scope>provided</scope>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.springframework</groupId> <groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId> <artifactId>spring-core</artifactId>
<version>${org.springframework.version}</version> <version>${org.springframework.version}</version>
</dependency> </dependency>
<!-- Spring MVC framework --> <!-- Spring MVC framework -->
<dependency> <dependency>
<groupId>org.springframework</groupId> <groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId> <artifactId>spring-webmvc</artifactId>
<version>${org.springframework.version}</version> <version>${org.springframework.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.springframework.security</groupId> <groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId> <artifactId>spring-security-core</artifactId>
<version>${spring.security.version}</version> <version>${spring.security.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.springframework.security</groupId> <groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId> <artifactId>spring-security-config</artifactId>
<version>${spring.security.version}</version> <version>${spring.security.version}</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.springframework.security</groupId> <groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId> <artifactId>spring-security-web</artifactId>
<version>${spring.security.version}</version> <version>${spring.security.version}</version>
</dependency> </dependency>
<!-- Apache Commons Upload --> <!-- Apache Commons Upload -->
<dependency> <dependency>
<groupId>commons-fileupload</groupId> <groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId> <artifactId>commons-fileupload</artifactId>
<version>1.2.2</version> <version>1.2.2</version>
</dependency> </dependency>
<!-- Apache Commons Upload --> <!-- Apache Commons Upload -->
<dependency> <dependency>
<groupId>commons-io</groupId> <groupId>commons-io</groupId>
<artifactId>commons-io</artifactId> <artifactId>commons-io</artifactId>
<version>1.3.2</version> <version>1.3.2</version>
</dependency> </dependency>
<!-- JSTL --> <!-- JSTL -->
<dependency> <dependency>
<groupId>javax.servlet</groupId> <groupId>javax.servlet</groupId>
<artifactId>jstl</artifactId> <artifactId>jstl</artifactId>
<version>1.2</version> <version>1.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>taglibs</groupId> <groupId>taglibs</groupId>
<artifactId>standard</artifactId> <artifactId>standard</artifactId>
<version>1.1.2</version> <version>1.1.2</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>log4j</groupId> <groupId>log4j</groupId>
<artifactId>log4j</artifactId> <artifactId>log4j</artifactId>
<version>1.2.15</version> <version>1.2.17</version>
<exclusions> <exclusions>
<exclusion> <exclusion>
<groupId>javax.jms</groupId> <groupId>javax.jms</groupId>
<artifactId>jms</artifactId> <artifactId>jms</artifactId>
</exclusion> </exclusion>
<exclusion> <exclusion>
<groupId>com.sun.jdmk</groupId> <groupId>com.sun.jdmk</groupId>
<artifactId>jmxtools</artifactId> <artifactId>jmxtools</artifactId>
</exclusion> </exclusion>
<exclusion> <exclusion>
<groupId>com.sun.jmx</groupId> <groupId>com.sun.jmx</groupId>
<artifactId>jmxri</artifactId> <artifactId>jmxri</artifactId>
</exclusion> </exclusion>
</exclusions> </exclusions>
</dependency> </dependency>
<dependency> <dependency>
<groupId>junit</groupId> <groupId>junit</groupId>
<artifactId>junit</artifactId> <artifactId>junit</artifactId>
<version>4.8.1</version> <version>4.8.1</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tiles</groupId> <groupId>org.apache.tiles</groupId>
<artifactId>tiles-core</artifactId> <artifactId>tiles-core</artifactId>
<version>${tiles.version}</version> <version>${tiles.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tiles</groupId> <groupId>org.apache.tiles</groupId>
<artifactId>tiles-template</artifactId> <artifactId>tiles-template</artifactId>
<version>${tiles.version}</version> <version>${tiles.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tiles</groupId> <groupId>org.apache.tiles</groupId>
<artifactId>tiles-servlet</artifactId> <artifactId>tiles-servlet</artifactId>
<version>${tiles.version}</version> <version>${tiles.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.apache.tiles</groupId> <groupId>org.apache.tiles</groupId>
<artifactId>tiles-jsp</artifactId> <artifactId>tiles-jsp</artifactId>
<version>${tiles.version}</version> <version>${tiles.version}</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.slf4j</groupId> <groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId> <artifactId>slf4j-api</artifactId>
<version>1.5.8</version> <version>1.7.7</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.slf4j</groupId> <groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId> <artifactId>slf4j-log4j12</artifactId>
<version>1.5.8</version> <version>1.7.7</version>
<type>jar</type> <type>jar</type>
</dependency> </dependency>
<!-- ************* END spring MVC and related dependencies ************** --> <!-- ************* END spring MVC and related dependencies ************** -->
</dependencies> </dependencies>
</project> </project>

32
resources/log4j.properties Normal file
View File

@ -0,0 +1,32 @@
log4j.rootLogger=INFO, MAIN_LOG, ERROR_LOG
# MAIN - everything gets logged here
log4j.appender.MAIN_LOG=org.apache.log4j.RollingFileAppender
log4j.appender.MAIN_LOG.File=${catalina.home}/logs/webgoat_main.log
log4j.appender.MAIN_LOG.layout=org.apache.log4j.PatternLayout
log4j.appender.MAIN_LOG.layout.ConversionPattern=%d [%t] %-5p %c %x - %m%n
log4j.appender.MAIN_LOG.MaxFileSize=10MB
log4j.appender.MAIN_LOG.MaxBackupIndex=5
log4j.appender.MAIN_LOG.append=true
# ERROR
log4j.appender.ERROR_LOG=org.apache.log4j.RollingFileAppender
log4j.appender.ERROR_LOG.File=${catalina.home}/logs/webgoat_error.log
log4j.appender.ERROR_LOG.layout=org.apache.log4j.PatternLayout
log4j.appender.ERROR_LOG.layout.ConversionPattern=%d [%t] %-5p %x - %m%n
log4j.appender.ERROR_LOG.MaxFileSize=10MB
log4j.appender.ERROR_LOG.MaxBackupIndex=2
log4j.appender.ERROR_LOG.append=true
log4j.appender.ERROR_LOG.Threshold=ERROR
# PERFORMANCE
log4j.logger.PERF_LOG=DEBUG, PERF_LOG
log4j.appender.PERF_LOG=org.apache.log4j.RollingFileAppender
log4j.appender.PERF_LOG.File=${catalina.home}/logs/webgoat_perf.log
log4j.appender.PERF_LOG.layout=org.apache.log4j.PatternLayout
log4j.appender.PERF_LOG.layout.ConversionPattern=%m%n
log4j.appender.PERF_LOG.MaxFileSize=10MB
log4j.appender.PERF_LOG.MaxBackupIndex=2
log4j.appender.PERF_LOG.append=true
log4j.additivity.PERF_LOG = false

4
webapp/WEB-INF/web.xml
View File

@ -329,6 +329,10 @@
<mime-type>video/x-ms-wmv</mime-type> <mime-type>video/x-ms-wmv</mime-type>
</mime-mapping> </mime-mapping>
<welcome-file-list>
<welcome-file>login.do</welcome-file>
</welcome-file-list>
<!-- Define reference to the user database for looking up roles --> <!-- Define reference to the user database for looking up roles -->
<!-- <!--
<resource-env-ref> <resource-env-ref>