dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Stored Cross-Site Scripting Lesson

Browse Source
This commit is contained in:
Àngel Ollé Blázquez
2023-08-25 20:37:56 +02:00
parent 8749137d1e
commit 368c046779
7 changed files with 10 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/resources/lessons/xss/html/CrossSiteScriptingStored.html
View File

@ -67,7 +67,7 @@
<form class="attack-form" accept-charset="UNKNOWN"
method="POST" name="DOMFollowUp"
action="/WebGoat/CrossSiteScripting/stored-xss-follow-up">
action="/WebGoat/CrossSiteScriptingStored/stored-xss-follow-up">
<input name="successMessage" value="" type="TEXT" />
<input name="submitMessage" value="Submit" type="SUBMIT"/>
</form>

5
src/main/resources/lessons/xss/i18n/WebGoatLabels.properties
View File

@ -1,7 +1,8 @@
# XSS success, failure messages and hints
xss.title=Cross Site Scripting
xss-stored.title=Cross Site Scripting (stored)
4.xss.title=Cross Site Scripting
5.xss-stored.title=Cross Site Scripting (stored)
xss-mitigation.title=Cross Site Scripting (mitigation)
xss-reflected-5a-success-alert=Congratulations, but alerts are not very impressive are they? Let's continue to the next assignment.
xss-reflected-5a-success-console=Congratulations, but console logs are not very impressive are they? Let's continue to the next assignment.
xss-reflected-5a-failed-wrong-field=Seems like you tried to compromise our shop with an reflected XSS attack.<br/> We do our... "best"... to prevent such attacks. Try again!

4
src/main/resources/lessons/xss/js/stored-xss.js
View File

@ -3,7 +3,7 @@ $(document).ready(function () {
var commentInput = $("#commentInput").val();
$.ajax({
type: 'POST',
url: 'CrossSiteScripting/stored-xss',
url: '/WebGoat/CrossSiteScriptingStored/stored-xss',
data: JSON.stringify({text: commentInput}),
contentType: "application/json",
dataType: 'json'
@ -32,7 +32,7 @@ $(document).ready(function () {
function getChallenges() {
$("#list").empty();
$.get('CrossSiteScripting/stored-xss', function (result, status) {
$.get('/WebGoat/CrossSiteScriptingStored/stored-xss', function (result, status) {
for (var i = 0; i < result.length; i++) {
var comment = html.replace('USER', result[i].user);
comment = comment.replace('DATETIME', result[i].dateTime);