diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java index 7bf96665f..64eb4ee9f 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/CrossSiteScripting/CrossSiteScripting.java @@ -155,42 +155,36 @@ public class CrossSiteScripting extends GoatHillsFinancial String stage = getStage(s); if (STAGE1.equals(stage)) { - instructions = getStage(s) - + ": Execute a Stored Cross Site Scripting (XSS) attack.
" + instructions = "Execute a Stored Cross Site Scripting (XSS) attack.
" + "For this exercise, your mission is to cause the application to serve a script of your making " + " to some other user."; } else if (STAGE2.equals(stage)) { - instructions = getStage(s) - + ": Block Stored XSS using Input Validation.
" + instructions = "Block Stored XSS using Input Validation.
" + "You will modify the application to perform input validation on the vulnerable input field " + "you just exploited."; } else if (STAGE3.equals(stage)) { - instructions = getStage(s) - + ": Execute a previously Stored Cross Site Scripting (XSS) attack.
" + instructions = "Execute a previously Stored Cross Site Scripting (XSS) attack.
" + "The application is still vulnerable to scripts in the database. Trigger a pre-stored " + "script by logging in as employee 'David' and viewing Bruce's profile."; } else if (STAGE4.equals(stage)) { - instructions = getStage(s) - + ": Block Stored XSS using Output Encoding.
" + instructions = "Block Stored XSS using Output Encoding.
" + "Encode data served from the database to the client so that any scripts are rendered harmless."; } else if (STAGE5.equals(stage)) { - instructions = getStage(s) - + ": Execute a Reflected XSS attack.
" + instructions = "Execute a Reflected XSS attack.
" + "Your goal here is to craft a link containing a script which the application will " + "serve right back to any client that activates the link."; } else if (STAGE6.equals(stage)) { - instructions = getStage(s) - + ": Block Reflected XSS using Input Validation.
" + instructions = "Block Reflected XSS using Input Validation.
" + "Use the input validation techniques learned ealier in this lesson to close the vulnerability " + "you just exploited."; } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java index db613c995..3c3b6f7a7 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/RoleBasedAccessControl/RoleBasedAccessControl.java @@ -140,35 +140,27 @@ public class RoleBasedAccessControl extends GoatHillsFinancial String stage = getStage(s); if (STAGE1.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Breaking functional access control.
" + instructions = "Breaking functional access control.
" + "You should be able to login as a regular employee and delete another user's employee " + "profile, even though that is supposed to be an HR-only function."; } else if (STAGE2.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Implementing access control in the Business Layer
" + instructions = "Implementing access control in the Business Layer
" + "Access control has already been implemented in the Presentation Layer, but as we have just " + "seen, this is not enough. Implement access control in the Businesss Layer to verify " + "authorization to use the Delete function before actually executing it."; } else if (STAGE3.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Breaking data access control.
" + instructions = "Breaking data access control.
" + "Data Layer access control is being already done on the staff list, but it has not been " + "globally implemented. Take advantage of this to login as a regular employee and view the " + "CEO's employee profile."; } else if (STAGE4.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Implementing access control in the Data Layer.
" + instructions = "Implementing access control in the Data Layer.
" + "Implement Data Layer access control to prevent unauthorized (and potentially career threatening) " + "access to employee personal data."; } diff --git a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java index c3b4ad057..a176fa6ae 100644 --- a/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java +++ b/ webgoat/main/project/JavaSource/org/owasp/webgoat/lessons/SQLInjection/SQLInjection.java @@ -148,9 +148,7 @@ public class SQLInjection extends GoatHillsFinancial String stage = getStage(s); if (STAGE1.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Use String SQL Injection to bypass authentication. " + instructions = "Use String SQL Injection to bypass authentication. " + "The goal here is to login as the user " + PRIZE_EMPLOYEE_NAME + ", who is in the Admin group. " @@ -158,26 +156,20 @@ public class SQLInjection extends GoatHillsFinancial } else if (STAGE2.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Use a parameterized query.
" + instructions = "Use a parameterized query.
" + "A dynamic SQL query is not necessary for the login function to work. Change login " + "to use a parameterized query to protect against malicious SQL in the query parameters."; } else if (STAGE3.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Use Integer SQL Injection to bypass access control.
" + instructions = "Use Integer SQL Injection to bypass access control.
" + "The goal here is to view the CEO's employee profile, again, even with data access " + "control checks in place from a previous lesson. " + "As before, you do not have the password, but the form is SQL injectable."; } else if (STAGE4.equals(stage)) { - instructions = "Stage " - + getStage(s) - + ": Use a parameterized query again.
" + instructions = "Use a parameterized query again.
" + "Change the ViewProfile function to use a parameterized query to protect against " + "malicious SQL in the numeric query parameter."; }