diff --git a/.gitignore b/.gitignore index da8b19b46..078aa39cf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,18 @@ /nb-configuration.xml /nbactions.xml +/target/ +/.classpath +/.project +/.settings/.jsdtscope +/.settings/org.eclipse.jdt.core.prefs +/.settings/org.eclipse.m2e.core.prefs +/.settings/org.eclipse.wst.common.component +/.settings/org.eclipse.wst.common.project.facet.core.prefs.xml +/.settings/org.eclipse.wst.common.project.facet.core.xml +/.settings/org.eclipse.wst.jsdt.ui.superType.container +/.settings/org.eclipse.wst.jsdt.ui.superType.name +/.settings/org.eclipse.wst.validation.prefs +/.externalToolBuilders/ .project /target .classpath @@ -11,5 +24,3 @@ src/main/main.iml *.LOCAL.*.jsp *.REMOTE.*.jsp - - diff --git a/src/main/java/org/owasp/webgoat/HammerHead.java b/src/main/java/org/owasp/webgoat/HammerHead.java index 61587c65f..faddc8961 100644 --- a/src/main/java/org/owasp/webgoat/HammerHead.java +++ b/src/main/java/org/owasp/webgoat/HammerHead.java @@ -134,8 +134,8 @@ public class HammerHead extends HttpServlet { logger.debug("Response already committed, exiting"); return; } - - if ("true".equals(request.getParameter("start"))) { + + if ("true".equals(request.getParameter("start")) || request.getQueryString() == null) { logger.warn("Redirecting to start controller"); response.sendRedirect("start.mvc"); return; diff --git a/src/main/java/org/owasp/webgoat/controller/About.java b/src/main/java/org/owasp/webgoat/controller/About.java new file mode 100644 index 000000000..479f83a74 --- /dev/null +++ b/src/main/java/org/owasp/webgoat/controller/About.java @@ -0,0 +1,49 @@ +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ +package org.owasp.webgoat.controller; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpSession; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.servlet.ModelAndView; + +/** + * + * @author rlawson + */ +@Controller +public class About { + + final Logger logger = LoggerFactory.getLogger(About.class); + private static final String WELCOMED = "welcomed"; + + @RequestMapping(value = "about.mvc", method = RequestMethod.GET) + public ModelAndView welcome(HttpServletRequest request, + @RequestParam(value = "error", required = false) String error, + @RequestParam(value = "logout", required = false) String logout) { + + // set the welcome attribute + // this is so the attack servlet does not also + // send them to the welcome page + HttpSession session = request.getSession(); + if (session.getAttribute(WELCOMED) == null) { + session.setAttribute(WELCOMED, "true"); + } + + //go ahead and send them to webgoat (skip the welcome page) + ModelAndView model = new ModelAndView(); + //model.setViewName("welcome"); + //model.setViewName("main_new"); + model.setViewName("about"); + return model; + } + +} diff --git a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java index 24b6016b8..3d85137a7 100644 --- a/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java +++ b/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java @@ -19,7 +19,9 @@ import org.apache.ecs.Element; import org.apache.ecs.ElementContainer; import org.apache.ecs.StringElement; import org.apache.ecs.html.Body; +import org.apache.ecs.html.Center; import org.apache.ecs.html.Form; +import org.apache.ecs.html.H1; import org.apache.ecs.html.Head; import org.apache.ecs.html.Html; import org.apache.ecs.html.IMG; @@ -729,11 +731,8 @@ public abstract class AbstractLesson extends Screen implements Comparable + + + + + +
+ +

About WebGoat

+
+
+

Thank you for using WebGoat! This program is a demonstration of common web application flaws. + The exercises are intended to provide hands on experience with + application penetration testing techniques.

+

The WebGoat project is led + by Bruce Mayhew. Please send all comments to Bruce at [TODO, session was blowing up here for some reason].

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
OWASP Foundation
+ 		+
Aspect Security
+
+
+ WebGoat Authors
+
+
+ Bruce Mayhew
+
+
+ Jeff Williams
+
+

+ WebGoat Design Team
+ 		+

+ V5.4 Lesson Contributers
+
+
David Anderson
+
Laurence Casey (Graphics)
+
Rogan Dawes
+
Bruce Mayhew
+ 		+
Sherif Koussa
+
Yiannis Pavlosoglou
+
+ +
+
Special Thanks + for V5.4
+ 		+
Documentation + Contributers
+
+
Brian Ciomei (Multitude of bug fixes)
+
To all who have sent comments
+ + 		+
+ Erwin Geirnaert
+
+ Aung Khant
+
+ Sherif Koussa +
+
+
 
+
+
+
 
+
 
+
 
+
WARNING
+ While running this program, your machine is extremely vulnerable to + attack if you are not running on localhost. If you are NOT running on localhost (default configuration), You should disconnect from the network while using this program. +
+
+ This program is for educational purposes only. Use of these techniques + without permission could lead to job termination, financial liability, + and/or criminal penalties.
+
+
+ +
+ + diff --git a/src/main/webapp/WEB-INF/pages/main_new.jsp b/src/main/webapp/WEB-INF/pages/main_new.jsp index c7f0c0809..f534f2fe2 100644 --- a/src/main/webapp/WEB-INF/pages/main_new.jsp +++ b/src/main/webapp/WEB-INF/pages/main_new.jsp @@ -1,6 +1,7 @@ <%@ page contentType="text/html; charset=ISO-8859-1" language="java" errorPage=""%> <%@page import="org.owasp.webgoat.session.WebSession"%> +<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%> <% WebSession webSession = ((WebSession) session.getAttribute(WebSession.SESSION)); %> @@ -60,7 +61,7 @@ -
+