From 3d0f879c12733af3b5f83f9a055b913fa67b43e6 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 16:17:16 +0200 Subject: [PATCH 001/161] Remove dep status --- README.MD | 1 - 1 file changed, 1 deletion(-) diff --git a/README.MD b/README.MD index 39623a026..8ee64a83d 100644 --- a/README.MD +++ b/README.MD @@ -3,7 +3,6 @@ [![Build Status](https://travis-ci.org/WebGoat/WebGoat.svg?branch=develop)](https://travis-ci.org/WebGoat/WebGoat) [![Coverage Status](https://coveralls.io/repos/WebGoat/WebGoat/badge.svg?branch=develop&service=github)](https://coveralls.io/github/WebGoat/WebGoat?branch=master) [![Codacy Badge](https://api.codacy.com/project/badge/b69ee3a86e3b4afcaf993f210fccfb1d)](https://www.codacy.com/app/dm/WebGoat) -[![Dependency Status](https://www.versioneye.com/user/projects/562da95ae346d7000e0369aa/badge.svg?style=flat)](https://www.versioneye.com/user/projects/562da95ae346d7000e0369aa) [![OWASP Labs](https://img.shields.io/badge/owasp-lab%20project-f7b73c.svg)](https://www.owasp.org/index.php/OWASP_Project_Inventory#tab=Labs_Projects) [![GitHub release](https://img.shields.io/github/release/WebGoat/WebGoat.svg)](https://github.com/WebGoat/WebGoat/releases/latest) From 3a2bfc9c249bd5b0b990c6ede2797de3e90f17f1 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 16:19:22 +0200 Subject: [PATCH 002/161] Cleanup readme --- README.MD | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/README.MD b/README.MD index 8ee64a83d..612c2fffc 100644 --- a/README.MD +++ b/README.MD @@ -33,7 +33,7 @@ first thing that all hackers claim.* Download the latest WebGoat release from [https://github.com/WebGoat/WebGoat/releases](https://github.com/WebGoat/WebGoat/releases) ```Shell -java -jar webgoat-server-8.0.0.VERSION.jar [--server.port=8080] [--server.address=localhost] +java -jar webgoat-server-8.1.0.jar [--server.port=8080] [--server.address=localhost] ``` The latest version of WebGoat needs Java 11 or above. By default WebGoat starts on port 8080 with `--server.port` you can specify a different port. With `server.address` you @@ -122,20 +122,6 @@ To change IP address add the following variable to WebGoat/webgoat-container/src server.address=x.x.x.x ``` -# Building a new Docker image - -NOTE: Travis will create a new Docker image automatically when making a new release. - -```Shell -cd WebGoat/ -mvn install -cd webgoat-server -docker build -t webgoat/webgoat-8.0 . -docker tag webgoat/webgoat-8.0 webgoat/webgoat-8.0:8.0 -docker login -docker push webgoat/webgoat-8.0 -``` - # Run Instructions: Once installed connect to http://localhost:8080/WebGoat and http://localhost:9090/WebWolf From 304312018b27ebde1d52a8baa4a9414fe1281cbc Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 16:22:23 +0200 Subject: [PATCH 003/161] Update README.MD --- README.MD | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/README.MD b/README.MD index 612c2fffc..50284a770 100644 --- a/README.MD +++ b/README.MD @@ -28,19 +28,7 @@ first thing that all hackers claim.* # Installation Instructions: -## 1. Standalone - -Download the latest WebGoat release from [https://github.com/WebGoat/WebGoat/releases](https://github.com/WebGoat/WebGoat/releases) - -```Shell -java -jar webgoat-server-8.1.0.jar [--server.port=8080] [--server.address=localhost] -``` - -The latest version of WebGoat needs Java 11 or above. By default WebGoat starts on port 8080 with `--server.port` you can specify a different port. With `server.address` you -can bind it to a different address (default localhost) - - -## 2. Run using Docker +## 1. Run using Docker Every release is also published on [DockerHub]((https://hub.docker.com/r/webgoat/webgoat-8.0/)). @@ -84,6 +72,19 @@ WebWolf will be located at: http://www.webwolf.local/WebWolf **Important**: the current directory on your host will be mapped into the container for keeping state. +## 2. Standalone + +Download the latest WebGoat and WebWolf release from [https://github.com/WebGoat/WebGoat/releases](https://github.com/WebGoat/WebGoat/releases) + +```Shell +java -jar webgoat-server-8.1.0.jar [--server.port=8080] [--server.address=localhost] +java -jar webwolf-8.1.0.jar [--server.port=9090] [--server.address=localhost] +``` + +The latest version of WebGoat needs Java 11 or above. By default WebGoat and WebWolf start on port 8080 and 9090 with `--server.port` you can specify a different port. With `server.address` you +can bind it to a different address (default localhost) + + ## 3. Run from the sources From c695614facfbd1eef48eb5c3152dc7c1fb558865 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 16:29:47 +0200 Subject: [PATCH 004/161] Fix Docker link --- scripts/deploy-webgoat.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/deploy-webgoat.sh b/scripts/deploy-webgoat.sh index 5498e5e9a..36504116a 100644 --- a/scripts/deploy-webgoat.sh +++ b/scripts/deploy-webgoat.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash docker login -u $DOCKER_USER -p $DOCKER_PASS -export REPO=webgoat/webgoat-8.0 +export REPO=webgoat/webgoat cd webgoat-server ls target/ From 90ea59cfca224dd05b606b60d9421f25f88c015c Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 16:30:35 +0200 Subject: [PATCH 005/161] Remove Github pages, too many things to keep in sync. Let's keep the focus on the OWASP page and the Github README --- docs/index.html | 568 ++++++++++++++++++++++++------------------------ 1 file changed, 290 insertions(+), 278 deletions(-) diff --git a/docs/index.html b/docs/index.html index 9e408e860..5c58e5e04 100644 --- a/docs/index.html +++ b/docs/index.html @@ -2,285 +2,297 @@ - - - - - - WebGoat - - - - - - - - - - - - - - - + + - - - - - - - -
-
-
-
-

Learn the hack - Stop the attack

- - -
-
-
-
-

WebGoat is a deliberately insecure application that allows interested developers just like you to test vulnerabilities - commonly found in Java-based applications that use common and popular open source components.

-
-
- - Download standalone - - - Run using Docker - -
-
-
-
- - -
-
-

Learn in 3 steps

-
-
-
- -
-
- -
-
- - -
-
- -
-
- -
-
- - -
-
- -
-
- -
-
- - -
-
-
-
- - -
-
-

Goals

-
-
-
-

- Web application security is difficult to learn and practice. Not many people have full blown web applications like online book - stores or online banks that can be used to scan for vulnerabilities. In addition, security professionals frequently need to test - tools against a platform known to be vulnerable to ensure that they perform as advertised. All of this needs to happen in a safe - and legal environment. - -

-
-
-

Even if your intentions are good, we believe you should never attempt to find vulnerabilities without - permission. The primary goal of the WebGoat project is simple: create a de-facto interactive teaching environment for web application security. - In the future, the project team hopes to extend WebGoat into becoming a security benchmarking platform and a Java-based Web site Honeypot. -

-
-
-
-
- - -
-
-

More information

-
-
-
-

For more information about running WebGoat / FAQ see our wiki pages. -

-
-
-

Interested in contributing to WebGoat, take a look at our issues.

- -
-
-
-
- - - - - -
-
- Team WebGoat 2019 -
-
- - -
- - - -
- - -
-
- - - -
-
-
-

Explain the vulnerability

-
- -

Teaching is now a first class citizen of WebGoat, we explain explain the vulnerability. Instead of 'just hacking' we now focus on explaining from the beginning what for example a SQL injection is. -

- - - Close -
-
-
-
-
- - -
-
- - - -
-
-
-

Learn by doing

-
- -

During the explanation of a vulnerability we build assignments which will help you understand how it works.

- - - Close -
-
-
-
-
- - -
-
- - - -
-
-
-

Explain mitigations

-
- -

At the end of each lesson you will receive an overview of possible mitigations which will help you during your development work.

- - - Close -
-
-
-
-
- - - - - - - - - - - - + +

+ The page been moved to https://owasp.org/www-project-webgoat/ +

+ - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file From 2dad97bdcbbc3fac5d44aa6e494a10b95e3625bd Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 16:39:37 +0200 Subject: [PATCH 006/161] Docker command without -d option to show output int console --- README.MD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.MD b/README.MD index 50284a770..eb7141d0a 100644 --- a/README.MD +++ b/README.MD @@ -37,7 +37,7 @@ Every release is also published on [DockerHub]((https://hub.docker.com/r/webgoat The easiest way to start WebGoat as a Docker container is to use the all-in-one docker container. This is a docker image that has WebGoat and WebWolf running inside. ```shell -docker run -d -p 8080:8080 -p 9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf +docker run -p 8080:8080 -p 9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf ``` WebGoat will be located at: http://127.0.0.1:8080/WebGoat From 637d393889d1b9e97ebd7b35eac8fc7d3abfca39 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 16:40:54 +0200 Subject: [PATCH 007/161] Update README.MD --- README.MD | 3 --- 1 file changed, 3 deletions(-) diff --git a/README.MD b/README.MD index eb7141d0a..6071ab238 100644 --- a/README.MD +++ b/README.MD @@ -123,6 +123,3 @@ To change IP address add the following variable to WebGoat/webgoat-container/src server.address=x.x.x.x ``` -# Run Instructions: - -Once installed connect to http://localhost:8080/WebGoat and http://localhost:9090/WebWolf From 851fd9ae0379a4a715daa123636b8b873702eaf6 Mon Sep 17 00:00:00 2001 From: Nanne Baars Date: Sat, 23 May 2020 17:01:13 +0200 Subject: [PATCH 008/161] Only push to 1 Docker repo --- scripts/deploy-webgoat.sh | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/scripts/deploy-webgoat.sh b/scripts/deploy-webgoat.sh index 36504116a..3f9dfa4d4 100644 --- a/scripts/deploy-webgoat.sh +++ b/scripts/deploy-webgoat.sh @@ -1,32 +1,6 @@ #!/usr/bin/env bash docker login -u $DOCKER_USER -p $DOCKER_PASS -export REPO=webgoat/webgoat - -cd webgoat-server -ls target/ - -if [ ! -z "${TRAVIS_TAG}" ]; then - # If we push a tag to master this will update the LATEST Docker image and tag with the version number - docker build --build-arg webgoat_version=${TRAVIS_TAG:1} -f Dockerfile -t $REPO:latest -t $REPO:${TRAVIS_TAG} . - docker push $REPO -else - echo "Skipping releasing to DockerHub because it is a build of branch ${BRANCH}" -fi - - -export REPO=webgoat/webwolf -cd .. -cd webwolf -ls target/ - -if [ ! -z "${TRAVIS_TAG}" ]; then - # If we push a tag to master this will update the LATEST Docker image and tag with the version number - docker build --build-arg webwolf_version=${TRAVIS_TAG:1} -f Dockerfile -t $REPO:latest -t $REPO:${TRAVIS_TAG} . - docker push $REPO -else - echo "Skipping releasing to DockerHub because it is a build of branch ${BRANCH}" -fi export REPO=webgoat/goatandwolf cd .. From 966d7a7aedaa4c6bb4dba96f6dcd98ef3c3d843a Mon Sep 17 00:00:00 2001 From: Elie De Brauwer Date: Sat, 23 May 2020 11:12:41 +0200 Subject: [PATCH 009/161] JWT_refresh.adoc: Fix spelling issues --- .../src/main/resources/lessonPlans/en/JWT_refresh.adoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/webgoat-lessons/jwt/src/main/resources/lessonPlans/en/JWT_refresh.adoc b/webgoat-lessons/jwt/src/main/resources/lessonPlans/en/JWT_refresh.adoc index 571bfcc21..214f3cec8 100644 --- a/webgoat-lessons/jwt/src/main/resources/lessonPlans/en/JWT_refresh.adoc +++ b/webgoat-lessons/jwt/src/main/resources/lessonPlans/en/JWT_refresh.adoc @@ -9,11 +9,11 @@ In this section we touch upon refreshing an access token. === Types of tokens -In general there are two type of tokens: access token and a refresh token. The access token is used for making API +In general there are two types of tokens: an access token and a refresh token. The access token is used for making API calls towards the server. Access tokens have a limited life span, that's where the refresh token comes in. Once -the access token is no longer valid a request can me made towards the server to get a new access token by presenting +the access token is no longer valid a request can be made towards the server to get a new access token by presenting the refresh token. The refresh token can expire but their life span is much longer. This solves the problem of a user -having to authenticate again with their credentials. Whether you should use a refresh token and access token depends, +having to authenticate again with their credentials. Whether you should use a refresh token and an access token depends, below can find a couple of points to keep in mind while choosing which tokens to use. So a normal flow can look like: @@ -53,7 +53,7 @@ client can use the new access token to make the API call. Regardless of the chosen solution you should store enough information on the server side to validate whether the user is still trusted. You can think of many things, like store the ip address, keep track of how many times the refresh token is used (using the refresh token multiple times in the valid time window of the access token might indicate strange -behavior, you can revoke all the tokens an let the user authenticate again). +behavior, you can revoke all the tokens and let the user authenticate again). Also keep track of which access token belonged to which refresh token otherwise an attacker might be able to get a new access token for a different user with the refresh token of the attacker (see https://emtunc.org/blog/11/2017/jwt-refresh-token-manipulation/ for a nice write up about how this attack works) From 2e8d0dd9b5a90148c21bef4213995b5f6f5bfd19 Mon Sep 17 00:00:00 2001 From: Elie De Brauwer Date: Sat, 23 May 2020 15:52:53 +0200 Subject: [PATCH 010/161] PasswordReset_plan.adoc: Spelling fixes --- .../resources/lessonPlans/en/PasswordReset_plan.adoc | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_plan.adoc b/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_plan.adoc index fac4211c0..0545e5516 100644 --- a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_plan.adoc +++ b/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_plan.adoc @@ -12,11 +12,11 @@ Teach how to securely implement password reset functionality within your applica == Introduction Each and every one of us will have used the password reset functionality on websites before. Each website implements -this functionality in a different manner. On some site you have to answer some question on other sites an e-mail -with an activation link will be send to you. In this lesson we will go through some of the most common password +this functionality in a different manner. On some sites you have to answer some question on other sites an e-mail +with an activation link will be sent to you. In this lesson we will go through some of the most common password reset functionalities and show where it can go wrong. Still there are companies which will send the password in plaintext to a user in an e-mail. For a couple of examples -you can take a look at http://plaintextoffenders.com/ Here you will find website which still send you the plaintext -password in an e-mail. Not only this should make you question the security of the site but this also mean they store -your password in plaintext! \ No newline at end of file +you can take a look at http://plaintextoffenders.com/. Here you will find websites which still send you the plaintext +password in an e-mail. Not only this should make you question the security of the site but this also means they store +your password in plaintext! From 60087e441df228b0e12b9f9a5dd69047dd31a937 Mon Sep 17 00:00:00 2001 From: Elie De Brauwer Date: Sat, 23 May 2020 16:12:50 +0200 Subject: [PATCH 011/161] PasswordReset_SecurityQuestions.adoc: Typo fix. --- .../lessonPlans/en/PasswordReset_SecurityQuestions.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_SecurityQuestions.adoc b/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_SecurityQuestions.adoc index ba5981da4..4df7cb7cb 100644 --- a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_SecurityQuestions.adoc +++ b/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_SecurityQuestions.adoc @@ -1,6 +1,6 @@ == The Problem with Security Questions -While Security Questions my at first seem like a good way to do authentication, they +While Security Questions may at first seem like a good way to do authentication, they have some big problems. The "perfect" security question should be hard to crack, but easy to remember. Also the answer needs to fixed, @@ -13,4 +13,4 @@ If you have to pick a security question, we recommend not answering them truthfu To further elaborate on the matter, there is a small assignment for you: There is a list of some common security questions down below. if you choose one, it will show to you why the question you picked is not really as good as one may think. -When you have looked at two questions the assignment will be marked as complete. \ No newline at end of file +When you have looked at two questions the assignment will be marked as complete. From 23762885fac39a98afa6c0d9e4cbb2be43a5cd4f Mon Sep 17 00:00:00 2001 From: Elie De Brauwer Date: Sat, 23 May 2020 16:16:47 +0200 Subject: [PATCH 012/161] PasswordReset_host_header.adoc: Typo fixes --- .../resources/lessonPlans/en/PasswordReset_host_header.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_host_header.adoc b/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_host_header.adoc index 40a94f6b6..74eec08d3 100644 --- a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_host_header.adoc +++ b/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_host_header.adoc @@ -6,8 +6,8 @@ When creating a password reset link you need to make sure: - It can only be used once - The link is only valid for a limited amount of time. -Send a link with a random token means an attacker cannot start a simple DOS attack to your website by starting to -block users. The link should not be used more than once which makes it impossible to change the password again. +Sending a link with a random token means an attacker cannot start a simple DOS attack to your website by starting to +block users. The link should not be usable more than once which makes it impossible to change the password again. The time out is necessary to restrict the attack window, having a link opens up a lot of possibilities for the attacker. == Assignment From dfa3242aebeab77935c221a3d0ce43e203a47d5e Mon Sep 17 00:00:00 2001 From: Elie De Brauwer Date: Sat, 23 May 2020 16:21:11 +0200 Subject: [PATCH 013/161] Delete unused PasswordReset_password_reset_link.adoc Not referenced in webgoat-lessons/password-reset/src/main/resources/html/PasswordReset.html, looks like a placeholder/dead code. --- .../lessonPlans/en/PasswordReset_password_reset_link.adoc | 3 --- 1 file changed, 3 deletions(-) delete mode 100644 webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_password_reset_link.adoc diff --git a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_password_reset_link.adoc b/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_password_reset_link.adoc deleted file mode 100644 index c7ba7dd90..000000000 --- a/webgoat-lessons/password-reset/src/main/resources/lessonPlans/en/PasswordReset_password_reset_link.adoc +++ /dev/null @@ -1,3 +0,0 @@ -== Password reset link - -Should be unique, do From c42d6b15c367b3c14ced40ebdc01e4ecbb29c179 Mon Sep 17 00:00:00 2001 From: Elie De Brauwer Date: Sat, 23 May 2020 17:00:59 +0200 Subject: [PATCH 014/161] SecurePasswordsAssignment: Fix output formatting - When solving the solution (entering a correct password) then the 'Score: 4/4' does not start on a new line, instead it is glue to the Estimated cracking time line. As a solution the
is added as a suffix on that line (and successive lines). - Maximum score is 4, not 5 (see also the assignment, and https://github.com/nulab/zxcvbn4j/blob/master/src/main/java/com/nulabinc/zxcvbn/TimeEstimates.java#L23 which is the origin of getScore() ) --- .../secure_password/SecurePasswordsAssignment.java | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java index 2e8e63813..24bbf5bf2 100644 --- a/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java +++ b/webgoat-lessons/secure-passwords/src/main/java/org/owasp/webgoat/secure_password/SecurePasswordsAssignment.java @@ -55,17 +55,17 @@ public class SecurePasswordsAssignment extends AssignmentEndpoint { } else { output.append("
 

"); } - output.append("Estimated cracking time: " + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond())); + output.append("Estimated cracking time: " + calculateTime((long) strength.getCrackTimeSeconds().getOnlineNoThrottling10perSecond()) + "
"); if (strength.getFeedback().getWarning().length() != 0) - output.append("
Warning: " + strength.getFeedback().getWarning()); + output.append("Warning: " + strength.getFeedback().getWarning() + "
"); // possible feedback: https://github.com/dropbox/zxcvbn/blob/master/src/feedback.coffee // maybe ask user to try also weak passwords to see and understand feedback? if (strength.getFeedback().getSuggestions().size() != 0) { - output.append("
Suggestions: