diff --git a/src/main/java/org/owasp/webgoat/util/LabelProvider.java b/src/main/java/org/owasp/webgoat/util/LabelProvider.java index ad6ffe4ff..8126c9eb0 100644 --- a/src/main/java/org/owasp/webgoat/util/LabelProvider.java +++ b/src/main/java/org/owasp/webgoat/util/LabelProvider.java @@ -1,10 +1,11 @@ package org.owasp.webgoat.util; +import org.springframework.stereotype.Component; + import java.util.HashMap; import java.util.Locale; import java.util.ResourceBundle; -import org.springframework.stereotype.Component; /*************************************************************************************************** @@ -52,6 +53,10 @@ public class LabelProvider return labels.get(locale).getString(strName); } + public void addLabels() { + + } + private class WebGoatResourceBundleController extends ResourceBundle.Control { private final Locale fallbackLocale = new Locale(DEFAULT_LANGUAGE); diff --git a/src/main/resources/WebGoatLabels.properties b/src/main/resources/WebGoatLabels.properties index 21e1a6125..3d9db4fda 100644 --- a/src/main/resources/WebGoatLabels.properties +++ b/src/main/resources/WebGoatLabels.properties @@ -4,4 +4,18 @@ RestartLesson=Restart this Lesson SolutionVideos=Solution Videos ErrorGenerating=Error generating InvalidData=Invalid Data +Go!=Go! + + +#StringSqlInjection.java +StringSqlInjectionSecondStage=Now that you have successfully performed an SQL injection, try the same type of attack on a parameterized query. Restart the lesson if you wish to return to the injectable query. +EnterLastName=Enter your last name: +NoResultsMatched=No results matched. Try Again. +SqlStringInjectionHint1=The application is taking your input and inserting it at the end of a pre-formed SQL command. +SqlStringInjectionHint2=This is the code for the query being built and issued by WebGoat:

"SELECT * FROM user_data WHERE last_name = "accountName" +SqlStringInjectionHint3=Compound SQL statements can be made by joining multiple tests with keywords like AND and OR. Try appending a SQL statement that always resolves to true +SqlStringInjectionHint4=Try entering [ smith' OR '1' = '1 ]. + + + diff --git a/src/main/webapp/plugin_lessons/SqlStringInjection-1.0.jar b/src/main/webapp/plugin_lessons/SqlStringInjection-1.0.jar index a934e3f78..698175bb8 100644 Binary files a/src/main/webapp/plugin_lessons/SqlStringInjection-1.0.jar and b/src/main/webapp/plugin_lessons/SqlStringInjection-1.0.jar differ