diff --git a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACHiddenMenus.java b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACHiddenMenus.java index 160aca0e1..baa487694 100644 --- a/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACHiddenMenus.java +++ b/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACHiddenMenus.java @@ -45,7 +45,6 @@ public class MissingFunctionACHiddenMenus extends AssignmentEndpoint { @PostMapping(path = "/access-control/hidden-menu", produces = {"application/json"}) @ResponseBody public AttackResult completed(String hiddenMenu1, String hiddenMenu2) { - //overly simple example for success. See other existing lesssons for ways to detect 'success' or 'failure' if (hiddenMenu1.equals("Users") && hiddenMenu2.equals("Config")) { return success(this) .output("") diff --git a/webgoat-lessons/missing-function-ac/src/main/resources/css/ac.css b/webgoat-lessons/missing-function-ac/src/main/resources/css/ac.css deleted file mode 100644 index ae659093a..000000000 --- a/webgoat-lessons/missing-function-ac/src/main/resources/css/ac.css +++ /dev/null @@ -1,30 +0,0 @@ -.hidden-menu-item { - display:none; - visibility:hidden; -} - -#ac-menu li { - list-style-type: none; - background-color: #aaa; - width: auto; - max-width: 20%; -} - -#ac-menu li:hover { - color: white; - background-color: #333; -} - -#ac-menu div { - margin-bottom: -60px; - margin-top: -10px; -} - -#ac-menu h3 { - color:white; - background-color:#666; -} - -#ac-menu-wrapper { - border-bottom: 2px solid #444; -} diff --git a/webgoat-lessons/missing-function-ac/src/main/resources/html/MissingFunctionAC.html b/webgoat-lessons/missing-function-ac/src/main/resources/html/MissingFunctionAC.html index b0589c439..c3465584c 100644 --- a/webgoat-lessons/missing-function-ac/src/main/resources/html/MissingFunctionAC.html +++ b/webgoat-lessons/missing-function-ac/src/main/resources/html/MissingFunctionAC.html @@ -1,82 +1,92 @@ -
-
-
+
+
+
-
-
- - +
+
-
-
-
-

Account

-
-
    -
  • My Profile
    • -
  • Privacy/Security
    • -
  • Log Out
    • -
-
-

Messages

-
-
+
+ +
+ +
+
+ +

Hidden item 1

+

Hidden item 2


+ -
- - -

Hidden Item 1

-

Hidden Item 2

-
- - -
- -
-
-
+ +
+
-
+
-
+
-
-
-
+
-

Your Hash:

-
- +
+
+ - +

Your Hash:

+
+ -
-
-
+ +
+
+
+ diff --git a/webgoat-lessons/missing-function-ac/src/main/resources/js/missing-function-ac.js b/webgoat-lessons/missing-function-ac/src/main/resources/js/missing-function-ac.js deleted file mode 100644 index 0f98933b5..000000000 --- a/webgoat-lessons/missing-function-ac/src/main/resources/js/missing-function-ac.js +++ /dev/null @@ -1,6 +0,0 @@ -webgoat.customjs.accessControlMenu = function() { - //webgoat.customjs.jquery('#ac-menu-ul').menu(); - webgoat.customjs.jquery('#ac-menu').accordion(); -} - -webgoat.customjs.accessControlMenu(); \ No newline at end of file diff --git a/webgoat-lessons/missing-function-ac/src/main/resources/lessonPlans/en/missing-function-ac-02-client-controls.adoc b/webgoat-lessons/missing-function-ac/src/main/resources/lessonPlans/en/missing-function-ac-02-client-controls.adoc index 6c8441bcb..19a13c0e2 100644 --- a/webgoat-lessons/missing-function-ac/src/main/resources/lessonPlans/en/missing-function-ac-02-client-controls.adoc +++ b/webgoat-lessons/missing-function-ac/src/main/resources/lessonPlans/en/missing-function-ac-02-client-controls.adoc @@ -1,9 +1,9 @@ -== Relying on Obscurity +== Relying on obscurity One could rely on HTML, CSS, or javascript to hide links that users don't normally access. In the past, a network router tried to protect (hide) admin functionality with javascript in the UI: https://www.wired.com/2009/10/routers-still-vulnerable. -=== Finding Hidden Items +=== Finding hidden items There are usually hints to finding functionality the UI does not openly expose in: @@ -11,6 +11,6 @@ There are usually hints to finding functionality the UI does not openly expose i * Commented out elements * Items hidden via CSS controls/classes -=== Your Mission +=== Your mission Find two invisible menu items in the menu below that are or would be of interest to an attacker/malicious user and submit the labels for those menu items (there are no links right now in the menus). \ No newline at end of file