diff --git a/README.txt b/README.txt
index eb4ed01c4..f1b240c33 100644
--- a/README.txt
+++ b/README.txt
@@ -73,6 +73,7 @@ delete artifacts from previous build:
Building the Eclipse project files
----------------------------------
+> mvn eclipse:clean
> mvn eclipse:eclipse
Afterward the project can be imported within Eclipse:
diff --git a/build.xml b/build.xml
index 52c34732a..36ea45d2a 100644
--- a/build.xml
+++ b/build.xml
@@ -54,14 +54,21 @@
project is bound to this path.
-->
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -143,8 +109,27 @@
dependencies) will have been assembled
-->
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -155,23 +140,12 @@
includes="project/.project, project/.classpath, project/.settings/**, workspace/**"/>
-
-
-
-
-
-
-
-
-
-
-
+
-
-
+
@@ -236,18 +210,26 @@
-
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
+
diff --git a/pom.xml b/pom.xml
index 973e66e89..6800715ae 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,7 +4,7 @@
webgoat
webgoat
war
- 5.41-SNAPSHOT
+ 5.4-SNAPSHOT
diff --git a/src/main/java/org/owasp/webgoat/lessons/OffByOne.java b/src/main/java/org/owasp/webgoat/lessons/OffByOne.java
index 18834df8c..574855702 100644
--- a/src/main/java/org/owasp/webgoat/lessons/OffByOne.java
+++ b/src/main/java/org/owasp/webgoat/lessons/OffByOne.java
@@ -130,6 +130,8 @@ public class OffByOne extends LessonAdapter
hints.add("See which fields during the registration process, allow for really long input to be submitted.");
hints.add("Check for hidden form fields during registration");
hints.add("Typically, web-based buffer overflows occur just above the value of 2 to the power of a number. E.g. 1024 + 1, 2048 + 1, 4096 + 1");
+ hints.add("Overflow the room number field with 4096+1 characters and look for hidden fields");
+ hints.add("Enter the VIP name in the first and last naem fields");
return hints;
}
@@ -405,7 +407,9 @@ public class OffByOne extends LessonAdapter
private Element makeThirdStep(WebSession s)
{
ElementContainer ec = new ElementContainer();
- String param = "";
+ String param1 = "";
+ String param2 = "";
+ String param3 = "";
// Header
ec.addElement(new StringElement("You have now completed the 2 step process and have access to the Internet"));
@@ -453,23 +457,23 @@ public class OffByOne extends LessonAdapter
ec.addElement("\r\n");
// Hidden Form Fields
- param = s.getParser().getStringParameter(LAST_NAME, "");
- Input input = new Input(Input.HIDDEN, "a", param);
+ param1 = s.getParser().getStringParameter(LAST_NAME, "");
+ Input input = new Input(Input.HIDDEN, "a", param1);
ec.addElement(input);
ec.addElement("\r\n");
- param = s.getParser().getStringParameter(FIRST_NAME, "");
- input = new Input(Input.HIDDEN, "b", param);
+ param2 = s.getParser().getStringParameter(FIRST_NAME, "");
+ input = new Input(Input.HIDDEN, "b", param2);
ec.addElement(input);
ec.addElement("\r\n");
- param = s.getParser().getStringParameter(ROOM_NUMBER, "");
- input = new Input(Input.HIDDEN, "c", param);
+ param3 = s.getParser().getStringParameter(ROOM_NUMBER, "");
+ input = new Input(Input.HIDDEN, "c", param3);
ec.addElement(input);
ec.addElement("\r\n");
// And finally the check...
- if(param.length() > 4096)
+ if(param3.length() > 4096)
{
ec.addElement(new Input(Input.hidden, "d", "Johnathan"));
ec.addElement("\r\n");
@@ -498,9 +502,18 @@ public class OffByOne extends LessonAdapter
ec.addElement("\r\n");
ec.addElement(new Input(Input.hidden, "o", "9901"));
ec.addElement("\r\n");
- // :)
- makeSuccess(s);
+ s.setMessage("To complete the lesson, restart lesson and enter VIP first/last name");
+
+ }
+ if (("Johnathan".equalsIgnoreCase(param2) || "John".equalsIgnoreCase(param2)
+ || "Ana".equalsIgnoreCase(param2) ||"Lewis".equalsIgnoreCase(param2))
+ && ("Ravern".equalsIgnoreCase(param1) || "Smith".equalsIgnoreCase(param1)
+ || "Arneta".equalsIgnoreCase(param1) ||"Hamilton".equalsIgnoreCase(param1)))
+ {
+ // :)
+ // Allows for mixed VIP names, but that's not really the point
+ makeSuccess(s);
}
// Footer
@@ -510,7 +523,6 @@ public class OffByOne extends LessonAdapter
ec.addElement(new br());
ec.addElement(new br());
-
return ec;
}
diff --git a/webgoat for SQL Server.bat b/webgoat for SQL Server.bat
new file mode 100644
index 000000000..d88d8dd35
--- /dev/null
+++ b/webgoat for SQL Server.bat
@@ -0,0 +1,34 @@
+@echo on
+
+
+@REM Clear the lib env var as it can hose tomcat
+SET lib=
+
+@REM Make sure the webgoat DB is writable
+attrib -R .\tomcat\webapps\WebGoat\database\*.*
+
+@REM Set env vars for tomcat and java, use PWD as some machines don't have
+@REM \. on their path
+set PWD=%cd%
+set CATALINA_HOME=%PWD%\tomcat
+set JAVA_HOME=%PWD%\java
+
+@REM Configure environment variables to override web.xml
+SET DatabaseDriver=net.sourceforge.jtds.jdbc.Driver
+SET DatabaseConnectionString=jdbc:jtds:sqlserver://./webgoat;namedPipe=true;INSTANCE=WEBGOAT
+SET DatabaseUser=webgoat
+SET DtabasePassword=_webgoat
+
+delete .\tomcat\conf\server.xml
+copy .\tomcat\conf\server_80.xml .\tomcat\conf\server.xml
+
+@REM Run tomcat: must have quotes incase var has spaces in it
+call "%CATALINA_HOME%\bin\startup.bat" start
+
+echo
+echo If the Tomcat DOS shell quit immediately, it is likely that
+echo there is another service listening on port 80.
+echo
+
+
+
diff --git a/webgoat.bat b/webgoat.bat
new file mode 100644
index 000000000..885ccd849
--- /dev/null
+++ b/webgoat.bat
@@ -0,0 +1,25 @@
+@echo on
+
+
+@REM Clear the lib env var as it can hose tomcat
+SET lib=
+
+@REM Make sure the webgoat DB is writable
+attrib -R .\tomcat\webapps\WebGoat\database\*.*
+
+@REM Set env vars for tomcat and java, use PWD as some machines don't have
+@REM \. on their path
+set PWD=%cd%
+set CATALINA_HOME=%PWD%\tomcat
+set JAVA_HOME=%PWD%\java
+
+delete .\tomcat\conf\server.xml
+copy .\tomcat\conf\server_80.xml .\tomcat\conf\server.xml
+
+@REM Run tomcat: must have quotes incase var has spaces in it
+call "%CATALINA_HOME%\bin\startup.bat" start
+
+echo
+echo If the Tomcat DOS shell quit immediately, it is likely that
+echo there is another service listening on port 80.
+echo
diff --git a/webgoat.sh b/webgoat.sh
new file mode 100644
index 000000000..25f26ea17
--- /dev/null
+++ b/webgoat.sh
@@ -0,0 +1,60 @@
+#! /bin/sh
+
+SYSTEM=`uname -s`
+CATALINA_HOME=./tomcat
+PATH=${PATH}:./tomcat/bin
+export CATALINA_HOME PATH
+
+chmod +x ./$CATALINA_HOME/bin/*.sh
+if [ $SYSTEM = "Darwin" ]; then
+ JAVA_HOME=/System/Library/Frameworks/JavaVM.framework/Versions/1.5/Home
+ export JAVA_HOME
+
+else
+
+is_java_1dot5() {
+ if [ "X$JAVA_HOME" != "X" -a -d $JAVA_HOME ]; then
+ $JAVA_HOME/bin/java -version 2>&1 | grep 'version \"1.5' >/dev/null
+ if [ $? -ne 0 ]; then
+ echo "The JVM in \$JAVA_HOME isn't version 1.5."
+ exit 1
+ fi
+ else
+ echo "Please set JAVA_HOME to a Java 1.5 JDK install"
+ exit 1
+ fi
+}
+
+is_java_1dot5
+
+fi
+
+case "$1" in
+ start80)
+ cp -f $CATALINA_HOME/conf/server_80.xml $CATALINA_HOME/conf/server.xml
+ $CATALINA_HOME/bin/startup.sh
+ printf "\n Open http://127.0.0.1/WebGoat/attack"
+ printf "\n Username: guest"
+ printf "\n Password: guest"
+ printf "\n Or try http://guest:guest@127.0.0.1/WebGoat/attack \n\n\r"
+ sleep 2
+ tail -f $CATALINA_HOME/logs/catalina.out
+ ;;
+ start8080)
+ cp -f $CATALINA_HOME/conf/server_8080.xml $CATALINA_HOME/conf/server.xml
+ $CATALINA_HOME/bin/startup.sh
+ printf "\n Open http://127.0.0.1:8080/WebGoat/attack"
+ printf "\n Username: guest"
+ printf "\n Password: guest"
+ printf "\n Or try http://guest:guest@127.0.0.1:8080/WebGoat/attack \n\n\r"
+ sleep 2
+ tail -f $CATALINA_HOME/logs/catalina.out
+ ;;
+ stop)
+ $CATALINA_HOME/bin/shutdown.sh
+ ;;
+ *)
+ echo $"Usage: $prog {start8080|start80|stop}"
+ exit 1
+ ;;
+esac
diff --git a/webgoat_8080.bat b/webgoat_8080.bat
new file mode 100644
index 000000000..a7f9dbb3f
--- /dev/null
+++ b/webgoat_8080.bat
@@ -0,0 +1,25 @@
+@echo on
+
+
+@REM Clear the lib env var as it can hose tomcat
+SET lib=
+
+@REM Make sure the webgoat DB is writable
+attrib -R .\tomcat\webapps\WebGoat\database\*.*
+
+@REM Set env vars for tomcat and java, use PWD as some machines don't have
+@REM \. on their path
+set PWD=%cd%
+set CATALINA_HOME=%PWD%\tomcat
+set JAVA_HOME=%PWD%\java
+
+delete .\tomcat\conf\server.xml
+copy .\tomcat\conf\server_8080.xml .\tomcat\conf\server.xml
+
+@REM Run tomcat: must have quotes incase var has spaces in it
+call "%CATALINA_HOME%\bin\startup.bat" start
+
+echo
+echo If the Tomcat DOS shell quit immediately, it is likely that
+echo there is another service listening on port 80.
+echo
diff --git a/webscarab.bat b/webscarab.bat
new file mode 100644
index 000000000..9db235089
--- /dev/null
+++ b/webscarab.bat
@@ -0,0 +1,7 @@
+@echo off
+
+
+@REM Run webscarab
+@REM - Assumes webscarab.properties file is in webscarab directory
+cd webscarab
+..\java\bin\javaw -Duser.home=.\ -jar webscarab.jar