dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

This patch contains the HTTP connector that intercepts the requests to the application and tries to communicate with OSG.

Browse Source 
It also contains the DOM Injection lesson

git-svn-id: http://webgoat.googlecode.com/svn/trunk@35 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
sherif.fathy
2006-12-16 22:39:14 +00:00
parent 80a2add2d7
commit 296254e279
7 changed files with 664 additions and 331 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
webgoat/main/eclipse.bat
View File

@ -1,5 +1,7 @@
set JAVAHOME=.\java
set JAVAHOME= C:\Program Files\Java\jdk1.5.0_08
set PATH=%JAVAHOME%\bin;%PATH%
set ECLIPSE_HOME=.\eclipse
set ECLIPSE_HOME= C:\webgoat\tools\eclipse
SET JAVA_OPTS=%JAVA_OPTS% -Xms128m -Xmx768m
%ECLIPSE_HOME%\eclipse.exe -data .\workspace

3
webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/AbstractLesson.java
View File

@ -104,6 +104,8 @@ public abstract class AbstractLesson extends Screen implements Comparable
*/
public final static Category WEB_SERVICES = new Category( "Web Services", new Integer( 1110 ) );
public final static Category AJAX_SECURITY = new Category( "AJAX Security", new Integer( 1150 ) );
public final static Category NEW_LESSON = new Category ( "New Lessons" , new Integer ( 1210 ) );
public final static Category ADMIN_FUNCTIONS = new Category( "Admin Functions", new Integer( 10 ) );
@ -162,6 +164,7 @@ public abstract class AbstractLesson extends Screen implements Comparable
categories.add(A9);
categories.add(A10);
categories.add(WEB_SERVICES);
categories.add(AJAX_SECURITY);
categories.add(NEW_LESSON);
categories.add(ADMIN_FUNCTIONS);
categories.add(GENERAL);

163
webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/DOMInjection.java Normal file
View File

@ -0,0 +1,163 @@
package org.owasp.webgoat.lessons;
import java.io.PrintWriter;
import java.util.ArrayList;
import java.util.List;
import org.apache.ecs.Element;
import org.apache.ecs.ElementContainer;
import org.apache.ecs.StringElement;
import org.apache.ecs.html.BR;
import org.apache.ecs.html.Form;
import org.apache.ecs.html.H1;
import org.apache.ecs.html.Input;
import org.apache.ecs.html.TD;
import org.apache.ecs.html.TR;
import org.apache.ecs.html.Table;
import org.apache.ecs.html.Button;
import org.owasp.webgoat.session.ECSFactory;
import org.owasp.webgoat.session.WebSession;
public class DOMInjection extends LessonAdapter {
private final static Integer DEFAULT_RANKING = new Integer(10);
private final static String KEY = "key";
/*public void handleRequest( WebSession s )
{
//Setting a special action to be able to submit to redirect.jsp
Form form = new Form( "/WebGoat/lessons/AJAXSecurity/DOMInjection.jsp?" +
"Screen=" + String.valueOf(getScreenId()) +
"&menu=" + getDefaultCategory().getRanking().toString()
, Form.POST ).setName( "form" ).setEncType( "" );
form.addElement( createContent( s ) );
setContent(form);
}*/
protected Element createContent(WebSession s) {
String key = "K1JFWP8BSO8HI52LNPQS8F5L01N";
ElementContainer ec = new ElementContainer();
try
{
String userKey = s.getParser().getRawParameter(KEY, "");
String fromAJAX = s.getParser().getRawParameter("from" , "");
if (fromAJAX.equalsIgnoreCase("ajax") && userKey.length()!= 0 && userKey.equals(key))
{
s.getResponse().setContentType("text/html");
s.getResponse().setHeader("Cache-Control", "no-cache");
PrintWriter out = new PrintWriter(s.getResponse().getOutputStream());
out.print("document.forms[0].SUBMIT.disabled = false;");
out.flush();
out.close();
return ec;
}
if (s.getRequest().getMethod().equalsIgnoreCase("POST"))
{
makeSuccess(s);
}
}
catch(Exception e)
{
s.setMessage( "Error generating " + this.getClass().getName() );
e.printStackTrace();
}
String lineSep = System.getProperty("line.separator");
String script = "<script>" + lineSep +
"function validate() {" + lineSep +
"alert('we are here');" + lineSep +
"var keyField = document.getElementById('key');" + lineSep +
"var url = '/WebGoat/attack?Screen=" + String.valueOf(getScreenId()) +
"&menu=" + getDefaultCategory().getRanking().toString() +
"&from=ajax&key=' + encodeURIComponent(keyField.value);" + lineSep +
"if (typeof XMLHttpRequest != 'undefined') {" + lineSep +
"req = new XMLHttpRequest();" + lineSep +
"} else if (window.ActiveXObject) {" + lineSep +
"req = new ActiveXObject('Microsoft.XMLHTTP');" + lineSep +
" }" + lineSep +
" req.open('GET', url, true);" + lineSep +
" req.onreadystatechange = callback;" + lineSep +
" req.send(null);" + lineSep +
"}" + lineSep +
"function callback() {" + lineSep +
" if (req.readyState == 4) { " + lineSep +
" if (req.status == 200) { " + lineSep +
" var message = req.responseText;" + lineSep +
" eval(message);" + lineSep +
" }}}" + lineSep +
"</script>" + lineSep;
ec.addElement( new StringElement(script));
ec.addElement( new BR().addElement (new H1().addElement( "Welcome to WebGoat Registration Page:")));
ec.addElement( new BR().addElement ("Please enter the license key that was emailed to you to start using the application."));
ec.addElement( new BR());
ec.addElement( new BR());
Table t1 = new Table().setCellSpacing(0).setCellPadding(0).setBorder(0).setWidth("70%").setAlign("center");
TR tr = new TR();
tr.addElement( new TD( new StringElement( "License Key: " ) ));
Input input1 = new Input( Input.TEXT, KEY , "" );
input1.addAttribute("onkeyup", "validate();");
tr.addElement( new TD( input1 ) );
t1.addElement( tr );
tr = new TR();
tr.addElement( new TD( "&nbsp;" ).setColSpan(2));
t1.addElement( tr );
tr = new TR();
Input b = new Input();
b.setType( Input.SUBMIT );
b.setValue( "Activate!" );
b.setName("SUBMIT");
b.setDisabled(true);
tr.addElement(new TD( "&nbsp;" ));
tr.addElement( new TD( b ) );
t1.addElement(tr);
ec.addElement( t1 );
return ec ;
}
@Override
public Element getCredits() {
return new StringElement("This screen created by: Sherif Koussa");
}
@Override
protected Category getDefaultCategory() {
return AJAX_SECURITY;
}
@Override
protected Integer getDefaultRanking() {
return DEFAULT_RANKING;
}
@Override
protected List getHints() {
List<String> hints = new ArrayList<String>();
hints.add( "This page is using XMLHTTP to comunicate with the server." );
hints.add( "Try to find a way to inject the DOM to enable the Activate button." );
hints.add( "Intercept the reply and add document.forms[0].SUBMIT.disabled = false;" );
return hints;
}
@Override
public String getTitle() {
// TODO Auto-generated method stub
return "DOM Injection";
}
}

1
webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/HttpSplitting.java
View File

@ -77,6 +77,7 @@ public class HttpSplitting extends LessonAdapter {
if (Arrays.binarySearch(arrTokens, "CONTENT-LENGTH: 0") >= 0 &&
Arrays.binarySearch(arrTokens, "HTTP/1.1 200 OK") >= 0 )
{
ec.addElement("HTTP/1.1 200 OK" + System.getProperty("line.separator") + "test");
makeSuccess( s );
}
}

112
webgoat/main/project/JavaSource/org/owasp/webgoat/util/Interceptor.java Normal file
View File

@ -0,0 +1,112 @@
/**
*
*/
package org.owasp.webgoat.util;
import java.io.IOException;
import java.io.BufferedReader;
import java.io.PrintWriter;
import java.io.InputStreamReader;
import java.net.UnknownHostException;
import java.net.Socket;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.RequestDispatcher;
import javax.servlet.http.HttpServletRequest;
/**
* @author sherif koussa - Macadamian Technologies
*
*/
public class Interceptor implements Filter {
private static final String OSG_SERVER_NAME = "OSGServerName";
private static final String OSG_SERVER_PORT = "OSGServerPort";
/* (non-Javadoc)
* @see javax.servlet.Filter#destroy()
*/
public void destroy() {
// TODO Auto-generated method stub
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest)request;
Socket osgSocket = null;
PrintWriter out = null;
BufferedReader in = null;
String osgServerName = req.getSession().getServletContext().getInitParameter(OSG_SERVER_NAME);
String osgServerPort = req.getSession().getServletContext().getInitParameter(OSG_SERVER_PORT);
try {
//If these parameters are not defined then no communication will happen with OSG
if (osgServerName != null && osgServerName.length() != 0 &&
osgServerPort != null && osgServerPort.length() != 0 )
{
osgSocket = new Socket(osgServerName, Integer.parseInt(osgServerPort));
if ( osgSocket != null )
{
out = new PrintWriter(osgSocket.getOutputStream(), true);
in = new BufferedReader(new InputStreamReader(
osgSocket.getInputStream()));
//String message = "HTTPRECEIVEHTTPREQUEST,-,DataValidation_SqlInjection_Basic.aspx";
//out.println(message);
//System.out.println(in.readLine());
}
}
}
catch (UnknownHostException e)
{
e.printStackTrace();
}
catch (IOException e)
{
e.printStackTrace();
}
finally
{
if (out != null)
{
out.close();
}
if (in != null)
{
in.close();
}
if (osgSocket != null)
{
osgSocket.close();
}
}
String url = req.getRequestURL().toString();
RequestDispatcher disp = req.getRequestDispatcher(url.substring(url.lastIndexOf("WebGoat/") + "WebGoat".length()));
disp.forward(request, response);
}
/* (non-Javadoc)
* @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
*/
public void init(FilterConfig arg0) throws ServletException {
// TODO Auto-generated method stub
}
}

32
webgoat/main/project/WebContent/WEB-INF/web.xml
View File

@ -44,6 +44,28 @@
</description>
</context-param>
<!-- Enable the following two elements if you want to integrate with
OWASP Site Generator, the OSGServerName represents the server on which the
OSG desktop application resides and the OSGServerPort represents the port it is
listening to-->
<!--
<context-param>
<param-name>OSGServerName</param-name>
<param-value>localhost</param-value>
<description>Enable this element if you want to integrate with
OWASP Site Generator
</description>
</context-param>
<context-param>
<param-name>OSGServerPort</param-name>
<param-value>4000</param-value>
<description>
The EMAIL address of the administrator to whom questions
and comments about this application should be addressed.
</description>
</context-param>
-->
<!-- Servlet definitions for the servlets that make up
your web application, including initialization
parameters. With Tomcat, you can also send requests
@ -68,7 +90,14 @@
You can define any number of servlets, including zero.
-->
<filter>
<filter-name>Interceptor</filter-name>
<filter-class>org.owasp.webgoat.util.Interceptor</filter-class>
</filter>
<filter-mapping>
<filter-name>Interceptor</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
<servlet-name>AxisServlet</servlet-name>
<display-name>Apache-Axis Servlet</display-name>
@ -334,3 +363,4 @@
</web-app>

22
webgoat/main/project/WebContent/lesson_plans/DOMInjection.html Normal file
View File

@ -0,0 +1,22 @@
<div align="Center">
<p><b>Lesson Plan Title:</b>DOM Injection. </p>
</div>
<p><b>Concept / Topic To Teach:</b> </p>
How to perform DOM injection attacks.
<br>
<div align="Left">
<p>
<b>How the attacks works:</b>
</p>
Some applications specially the ones that uses AJAX manipulates and updates the DOM
directly using javascript, DHTML and eval.<br>
An attacker may take advantage of that by intercepting the reply and try to inject some
javascript commands to exploit his attacks.
</div>
<p><b>General Goal(s):</b> </p>
<!-- Start Instructions -->
* Your victim is a system that takes an activatation key to allow you to use it.
* Your goal should be to try to get to enable the activate button.<br>
* Take some time to see the HTML source in order to understand how does it work.<br>
<!-- Stop Instructions -->