Moved Maven multiproject setup
This commit is contained in:
Nanne Baars
@ -0,0 +1,835 @@
|
||||
package org.owasp.webgoat.lessons;
|
||||
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.Body;
|
||||
import org.apache.ecs.html.Form;
|
||||
import org.apache.ecs.html.Head;
|
||||
import org.apache.ecs.html.Html;
|
||||
import org.apache.ecs.html.IMG;
|
||||
import org.apache.ecs.html.PRE;
|
||||
import org.apache.ecs.html.Title;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.Screen;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
import org.owasp.webgoat.session.WebgoatContext;
|
||||
import org.owasp.webgoat.session.WebgoatProperties;
|
||||
import org.owasp.webgoat.util.BeanProvider;
|
||||
import org.owasp.webgoat.util.LabelManager;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
import java.io.BufferedReader;
|
||||
import java.io.File;
|
||||
import java.io.FileNotFoundException;
|
||||
import java.io.FileReader;
|
||||
import java.io.InputStreamReader;
|
||||
import java.io.StringReader;
|
||||
import java.net.HttpURLConnection;
|
||||
import java.net.URL;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
import java.util.HashMap;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
* <p>
|
||||
* <p>
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
* <p>
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
* <p>
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
* <p>
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
* <p>
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
* <p>
|
||||
* Getting Source ==============
|
||||
* <p>
|
||||
* Source for this application is maintained at
|
||||
* https://github.com/WebGoat/WebGoat, a repository for free software projects.
|
||||
* <p>
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public abstract class AbstractLesson extends Screen implements Comparable<Object> {
|
||||
|
||||
private static final Logger logger = LoggerFactory.getLogger(AbstractLesson.class);
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
public final static String ADMIN_ROLE = "admin";
|
||||
|
||||
public final static String CHALLENGE_ROLE = "challenge";
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
public final static String HACKED_ADMIN_ROLE = "hacked_admin";
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
public final static String USER_ROLE = "user";
|
||||
|
||||
private static int count = 1;
|
||||
|
||||
private Integer id = null;
|
||||
|
||||
final static IMG nextGrey = new IMG("images/right16.gif").setAlt("Next").setBorder(0).setHspace(0).setVspace(0);
|
||||
|
||||
final static IMG previousGrey = new IMG("images/left14.gif").setAlt("Previous").setBorder(0).setHspace(0)
|
||||
.setVspace(0);
|
||||
|
||||
private Integer ranking;
|
||||
|
||||
private Category category;
|
||||
|
||||
private boolean hidden;
|
||||
|
||||
private String sourceFileName;
|
||||
|
||||
private Map<String, String> lessonPlanFileName = new HashMap<String, String>();
|
||||
|
||||
private String lessonSolutionFileName;
|
||||
|
||||
private WebgoatContext webgoatContext;
|
||||
|
||||
private LinkedList<String> availableLanguages = new LinkedList<String>();
|
||||
|
||||
private String defaultLanguage = "en";
|
||||
|
||||
private LabelManager labelManager = null;
|
||||
|
||||
/**
|
||||
* Constructor for the Lesson object
|
||||
*/
|
||||
public AbstractLesson() {
|
||||
id = new Integer(++count);
|
||||
}
|
||||
|
||||
public String getName() {
|
||||
String className = getClass().getName();
|
||||
return className.substring(className.lastIndexOf('.') + 1);
|
||||
}
|
||||
|
||||
public void setRanking(Integer ranking) {
|
||||
this.ranking = ranking;
|
||||
}
|
||||
|
||||
public void setHidden(boolean hidden) {
|
||||
this.hidden = hidden;
|
||||
}
|
||||
|
||||
public void update(WebgoatProperties properties) {
|
||||
String className = getClass().getName();
|
||||
className = className.substring(className.lastIndexOf(".") + 1);
|
||||
setRanking(new Integer(properties.getIntProperty("lesson." + className + ".ranking", getDefaultRanking()
|
||||
.intValue())));
|
||||
String categoryRankingKey = "category." + getDefaultCategory().getName() + ".ranking";
|
||||
// System.out.println("Category ranking key: " + categoryRankingKey);
|
||||
Category tempCategory = Category.getCategory(getDefaultCategory().getName());
|
||||
tempCategory.setRanking(new Integer(properties.getIntProperty(categoryRankingKey, getDefaultCategory()
|
||||
.getRanking().intValue())));
|
||||
category = tempCategory;
|
||||
setHidden(properties.getBooleanProperty("lesson." + className + ".hidden", getDefaultHidden()));
|
||||
// System.out.println(className + " in " + tempCategory.getName() + "
|
||||
// (Category Ranking: " + tempCategory.getRanking() + " Lesson ranking:
|
||||
// " + getRanking() + ", hidden:" + hidden +")");
|
||||
}
|
||||
|
||||
public boolean isCompleted(WebSession s) {
|
||||
return getLessonTracker(s, this).getCompleted();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the credits attribute of the AbstractLesson object
|
||||
*
|
||||
* @return The credits value
|
||||
* @deprecated - Credits have moved to the about page
|
||||
*/
|
||||
public abstract Element getCredits();
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param obj Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public int compareTo(Object obj) {
|
||||
return this.getRanking().compareTo(((AbstractLesson) obj).getRanking());
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param obj Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public boolean equals(Object obj) {
|
||||
return this.getScreenId() == ((AbstractLesson) obj).getScreenId();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the Lesson object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
public Category getCategory() {
|
||||
return category;
|
||||
}
|
||||
|
||||
protected abstract Integer getDefaultRanking();
|
||||
|
||||
protected abstract Category getDefaultCategory();
|
||||
|
||||
protected abstract boolean getDefaultHidden();
|
||||
|
||||
/**
|
||||
* Gets the fileMethod attribute of the Lesson class
|
||||
*
|
||||
* @param reader Description of the Parameter
|
||||
* @param methodName Description of the Parameter
|
||||
* @param numbers Description of the Parameter
|
||||
* @return The fileMethod value
|
||||
*/
|
||||
public static String getFileMethod(BufferedReader reader, String methodName, boolean numbers) {
|
||||
int count = 0;
|
||||
StringBuffer sb = new StringBuffer();
|
||||
boolean echo = false;
|
||||
boolean startCount = false;
|
||||
int parenCount = 0;
|
||||
|
||||
try {
|
||||
String line;
|
||||
|
||||
while ((line = reader.readLine()) != null) {
|
||||
if ((line.indexOf(methodName) != -1)
|
||||
&& ((line.indexOf("public") != -1) || (line.indexOf("protected") != -1) || (line
|
||||
.indexOf("private") != -1))) {
|
||||
echo = true;
|
||||
startCount = true;
|
||||
}
|
||||
|
||||
if (echo && startCount) {
|
||||
if (numbers) {
|
||||
sb.append(pad(++count) + " ");
|
||||
}
|
||||
|
||||
sb.append(line + "\n");
|
||||
}
|
||||
|
||||
if (echo && (line.indexOf("{") != -1)) {
|
||||
parenCount++;
|
||||
}
|
||||
|
||||
if (echo && (line.indexOf("}") != -1)) {
|
||||
parenCount--;
|
||||
|
||||
if (parenCount == 0) {
|
||||
startCount = false;
|
||||
echo = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
reader.close();
|
||||
} catch (Exception e) {
|
||||
System.out.println(e);
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (sb.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads text from a file into an ElementContainer. Each line in the file is
|
||||
* represented in the ElementContainer by a StringElement. Each
|
||||
* StringElement is appended with a new-line character.
|
||||
*
|
||||
* @param reader Description of the Parameter
|
||||
* @param numbers Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static String readFromFile(BufferedReader reader, boolean numbers) {
|
||||
return (getFileText(reader, numbers));
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the fileText attribute of the Screen class
|
||||
*
|
||||
* @param reader Description of the Parameter
|
||||
* @param numbers Description of the Parameter
|
||||
* @return The fileText value
|
||||
*/
|
||||
public static String getFileText(BufferedReader reader, boolean numbers) {
|
||||
int count = 0;
|
||||
StringBuffer sb = new StringBuffer();
|
||||
|
||||
try {
|
||||
String line;
|
||||
|
||||
while ((line = reader.readLine()) != null) {
|
||||
if (numbers) {
|
||||
sb.append(pad(++count) + " ");
|
||||
}
|
||||
sb.append(line + System.getProperty("line.separator"));
|
||||
}
|
||||
|
||||
reader.close();
|
||||
} catch (Exception e) {
|
||||
System.out.println(e);
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (sb.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Will this screen be included in an enterprise edition.
|
||||
*
|
||||
* @return The ranking value
|
||||
*/
|
||||
public boolean isEnterprise() {
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the hintCount attribute of the Lesson object
|
||||
*
|
||||
* @param s The user's WebSession
|
||||
* @return The hintCount value
|
||||
*/
|
||||
public int getHintCount(WebSession s) {
|
||||
return getHints(s).size();
|
||||
}
|
||||
|
||||
protected abstract List<String> getHints(WebSession s);
|
||||
|
||||
// @TODO we need to restrict access at the service layer
|
||||
// rather than passing session object around
|
||||
public List<String> getHintsPublic(WebSession s) {
|
||||
List<String> hints = getHints(s);
|
||||
return hints;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fill in a minor hint that will help people who basically get it, but are
|
||||
* stuck on somthing silly.
|
||||
*
|
||||
* @param s The users WebSession
|
||||
* @return The hint1 value
|
||||
*/
|
||||
public String getHint(WebSession s, int hintNumber) {
|
||||
return "Hint: " + getHints(s).get(hintNumber);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the AbstractLesson object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public abstract String getInstructions(WebSession s);
|
||||
|
||||
/**
|
||||
* Gets the lessonPlan attribute of the Lesson object
|
||||
*
|
||||
* @return The lessonPlan value
|
||||
*/
|
||||
protected String getLessonName() {
|
||||
return this.getClass().getSimpleName();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the HelloScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public abstract String getTitle();
|
||||
|
||||
/**
|
||||
* Gets the content of lessonPlanURL
|
||||
*
|
||||
* @param s The user's WebSession
|
||||
* @return The HTML content of the current lesson plan
|
||||
*/
|
||||
public String getLessonPlan(WebSession s) {
|
||||
StringBuffer src = new StringBuffer();
|
||||
String lang = s.getCurrrentLanguage();
|
||||
|
||||
try {
|
||||
// System.out.println("Loading lesson plan file: " +
|
||||
// getLessonPlanFileName());
|
||||
String filename = getLessonPlanFileName(lang);
|
||||
if (filename == null) {
|
||||
filename = getLessonPlanFileName(getDefaultLanguage());
|
||||
|
||||
}
|
||||
|
||||
src.append(readFromFile(new BufferedReader(new FileReader(filename)), false));
|
||||
|
||||
} catch (Exception e) {
|
||||
// s.setMessage( "Could not find lesson plan for " +
|
||||
// getLessonName());
|
||||
src = new StringBuffer("Could not find lesson plan for: " + getLessonName() + " and language " + lang);
|
||||
|
||||
}
|
||||
return src.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the ranking attribute of the Lesson object
|
||||
*
|
||||
* @return The ranking value
|
||||
*/
|
||||
public Integer getRanking() {
|
||||
if (ranking != null) {
|
||||
return ranking;
|
||||
} else {
|
||||
return getDefaultRanking();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the hidden value of the Lesson Object
|
||||
*
|
||||
* @return The hidden value
|
||||
*/
|
||||
public boolean getHidden() {
|
||||
return this.hidden;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the role attribute of the AbstractLesson object
|
||||
*
|
||||
* @return The role value
|
||||
*/
|
||||
public String getRole() {
|
||||
// FIXME: Each lesson should have a role assigned to it. Each
|
||||
// user/student
|
||||
// should also have a role(s) assigned. The user would only be allowed
|
||||
// to see lessons that correspond to their role. Eventually these roles
|
||||
// will be stored in the internal database. The user will be able to
|
||||
// hack
|
||||
// into the database and change their role. This will allow the user to
|
||||
// see the admin screens, once they figure out how to turn the admin
|
||||
// switch on.
|
||||
return USER_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the uniqueID attribute of the AbstractLesson object
|
||||
*
|
||||
* @return The uniqueID value
|
||||
*/
|
||||
public int getScreenId() {
|
||||
return id.intValue();
|
||||
}
|
||||
|
||||
public String getHtml_DELETE_ME(WebSession s) {
|
||||
String html = null;
|
||||
|
||||
// FIXME: This doesn't work for the labs since they do not implement
|
||||
// createContent().
|
||||
String rawHtml = createContent(s).toString();
|
||||
// System.out.println("Getting raw html content: " +
|
||||
// rawHtml.substring(0, Math.min(rawHtml.length(), 100)));
|
||||
html = convertMetachars(AbstractLesson.readFromFile(new BufferedReader(new StringReader(rawHtml)), true));
|
||||
// System.out.println("Getting encoded html content: " +
|
||||
// html.substring(0, Math.min(html.length(), 100)));
|
||||
|
||||
return html;
|
||||
}
|
||||
|
||||
public String getSource(WebSession s) {
|
||||
String source = null;
|
||||
String src = null;
|
||||
|
||||
try {
|
||||
// System.out.println("Loading source file: " +
|
||||
// getSourceFileName());
|
||||
src = convertMetacharsJavaCode(readFromFile(new BufferedReader(new FileReader(getSourceFileName())), true));
|
||||
|
||||
// TODO: For styled line numbers and better memory efficiency,
|
||||
// use a custom FilterReader
|
||||
// that performs the convertMetacharsJavaCode() transform plus
|
||||
// optionally adds a styled
|
||||
// line number. Wouldn't color syntax be great too?
|
||||
} catch (Exception e) {
|
||||
s.setMessage("Could not find source file");
|
||||
src = ("Could not find the source file or source file does not exist.<br/>"
|
||||
+ "Send this message to: <a href=\"mailto:" + s.getWebgoatContext().getFeedbackAddress()
|
||||
+ "?subject=Source " + getSourceFileName() + " not found. Lesson: "
|
||||
+ s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext()
|
||||
.getFeedbackAddress() + "</a>");
|
||||
}
|
||||
|
||||
Html html = new Html();
|
||||
|
||||
Head head = new Head();
|
||||
head.addElement(new Title(getSourceFileName()));
|
||||
|
||||
Body body = new Body();
|
||||
body.addElement(new StringElement(src));
|
||||
|
||||
html.addElement(head);
|
||||
html.addElement(body);
|
||||
|
||||
source = html.toString();
|
||||
|
||||
return source;
|
||||
}
|
||||
|
||||
public String getRawSource(WebSession s) {
|
||||
String src;
|
||||
|
||||
try {
|
||||
logger.debug("Loading source file: " + getSourceFileName());
|
||||
src = readFromFile(new BufferedReader(new FileReader(getSourceFileName())), false);
|
||||
|
||||
} catch (FileNotFoundException e) {
|
||||
s.setMessage("Could not find source file");
|
||||
src = ("Could not find the source file or source file does not exist.<br/>"
|
||||
+ "Send this message to: <a href=\"mailto:" + s.getWebgoatContext().getFeedbackAddress()
|
||||
+ "?subject=Source " + getSourceFileName() + " not found. Lesson: "
|
||||
+ s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext()
|
||||
.getFeedbackAddress() + "</a>");
|
||||
}
|
||||
|
||||
return src;
|
||||
}
|
||||
|
||||
public String getSolution(WebSession s) {
|
||||
String src = null;
|
||||
|
||||
try {
|
||||
// System.out.println("Solution: " + getLessonSolutionFileName());
|
||||
src = readFromFile(new BufferedReader(new FileReader(getLessonSolutionFileName())), false);
|
||||
} catch (Exception e) {
|
||||
logger.error("Could not find solution for {}", getLessonSolutionFileName());
|
||||
s.setMessage("Could not find the solution file");
|
||||
src = ("Could not find the solution file or solution file does not exist.<br/>"
|
||||
+ "Send this message to: <a href=\"mailto:" + s.getWebgoatContext().getFeedbackAddress()
|
||||
+ "?subject=Solution " + getLessonSolutionFileName() + " not found. Lesson: "
|
||||
+ s.getCurrentLesson().getLessonName() + "\">" + s.getWebgoatContext()
|
||||
.getFeedbackAddress() + "</a>");
|
||||
}
|
||||
|
||||
// Solutions are html files
|
||||
return src;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>
|
||||
* Returns the default "path" portion of a lesson's URL.</p>
|
||||
* <p>
|
||||
* <p>
|
||||
* Legacy webgoat lesson links are of the form
|
||||
* "attack?Screen=Xmenu=Ystage=Z". This method returns the path portion of
|
||||
* the url, i.e., "attack" in the string above.</p>
|
||||
* <p>
|
||||
* <p>
|
||||
* Newer, Spring-Controller-based classes will override this method to
|
||||
* return "*.do"-styled paths.</p>
|
||||
*/
|
||||
protected String getPath() {
|
||||
return "#attack";
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the link that can be used to request this screen.
|
||||
*
|
||||
* @return
|
||||
*/
|
||||
public String getLink() {
|
||||
StringBuffer link = new StringBuffer();
|
||||
|
||||
// mvc update:
|
||||
link.append(getPath()).append("/");
|
||||
link.append(getScreenId());
|
||||
link.append("/");
|
||||
link.append(getCategory().getRanking());
|
||||
return link.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the link to the jsp page used to render this screen.
|
||||
*
|
||||
* @return
|
||||
*/
|
||||
public String getPage(WebSession s) {
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the link to the jsp template page used to render this screen.
|
||||
*
|
||||
* @return
|
||||
*/
|
||||
public String getTemplatePage(WebSession s) {
|
||||
return null;
|
||||
}
|
||||
|
||||
public abstract String getCurrentAction(WebSession s);
|
||||
|
||||
public abstract void setCurrentAction(WebSession s, String lessonScreen);
|
||||
|
||||
/**
|
||||
* Override this method to implement accesss control in a lesson.
|
||||
*
|
||||
* @param s
|
||||
* @param functionId
|
||||
* @return
|
||||
*/
|
||||
public boolean isAuthorized(WebSession s, int employeeId, String functionId) {
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Override this method to implement accesss control in a lesson.
|
||||
*
|
||||
* @param s
|
||||
* @param functionId
|
||||
* @return
|
||||
*/
|
||||
public boolean isAuthorized(WebSession s, String role, String functionId) {
|
||||
logger.info("Checking if " + role + " authorized for: " + functionId);
|
||||
boolean authorized = false;
|
||||
try {
|
||||
String query = "SELECT * FROM auth WHERE role = '" + role + "' and functionid = '" + functionId + "'";
|
||||
try {
|
||||
Statement answer_statement = WebSession.getConnection(s)
|
||||
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet answer_results = answer_statement.executeQuery(query);
|
||||
authorized = answer_results.first();
|
||||
logger.info("authorized: " + authorized);
|
||||
} catch (SQLException sqle) {
|
||||
s.setMessage("Error authorizing");
|
||||
logger.error("Error authorizing", sqle);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
s.setMessage("Error authorizing");
|
||||
logger.error("Error authorizing", e);
|
||||
}
|
||||
return authorized;
|
||||
}
|
||||
|
||||
public int getUserId(WebSession s) throws ParameterNotFoundException {
|
||||
return -1;
|
||||
}
|
||||
|
||||
public String getUserName(WebSession s) throws ParameterNotFoundException {
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param windowName Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static String makeWindowScript(String windowName) {
|
||||
// FIXME: make this string static
|
||||
StringBuffer script = new StringBuffer();
|
||||
script.append("<script language=\"JavaScript\">\n");
|
||||
script.append(" <!--\n");
|
||||
script.append(" function makeWindow(url) {\n");
|
||||
script.append("\n");
|
||||
script.append(" agent = navigator.userAgent;\n");
|
||||
script.append("\n");
|
||||
script.append(" params = \"\";\n");
|
||||
script.append(" params += \"toolbar=0,\";\n");
|
||||
script.append(" params += \"location=0,\";\n");
|
||||
script.append(" params += \"directories=0,\";\n");
|
||||
script.append(" params += \"status=0,\";\n");
|
||||
script.append(" params += \"menubar=0,\";\n");
|
||||
script.append(" params += \"scrollbars=1,\";\n");
|
||||
script.append(" params += \"resizable=1,\";\n");
|
||||
script.append(" params += \"width=500,\";\n");
|
||||
script.append(" params += \"height=350\";\n");
|
||||
script.append("\n");
|
||||
script.append(" // close the window to vary the window size\n");
|
||||
script.append(" if (typeof(win) == \"object\" && !win.closed){\n");
|
||||
script.append(" win.close();\n");
|
||||
script.append(" }\n");
|
||||
script.append("\n");
|
||||
script.append(" win = window.open(url, '" + windowName + "' , params);\n");
|
||||
script.append("\n");
|
||||
script.append(" // bring the window to the front\n");
|
||||
script.append(" win.focus();\n");
|
||||
script.append(" }\n");
|
||||
script.append(" //-->\n");
|
||||
script.append(" </script>\n");
|
||||
|
||||
return script.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Simply reads a url into an Element for display. CAUTION: you might want
|
||||
* to tinker with any non-https links (href)
|
||||
*
|
||||
* @param url Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static Element readFromURL(String url) {
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try {
|
||||
URL u = new URL(url);
|
||||
HttpURLConnection huc = (HttpURLConnection) u.openConnection();
|
||||
BufferedReader reader = new BufferedReader(new InputStreamReader(huc.getInputStream()));
|
||||
String line;
|
||||
|
||||
while ((line = reader.readLine()) != null) {
|
||||
ec.addElement(new StringElement(line));
|
||||
}
|
||||
|
||||
reader.close();
|
||||
} catch (Exception e) {
|
||||
System.out.println(e);
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param reader Description of the Parameter
|
||||
* @param numbers Description of the Parameter
|
||||
* @param methodName Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public static Element readMethodFromFile(BufferedReader reader, String methodName, boolean numbers) {
|
||||
PRE pre = new PRE().addElement(getFileMethod(reader, methodName, numbers));
|
||||
|
||||
return (pre);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
*/
|
||||
public void handleRequest(WebSession s) {
|
||||
// call createContent first so messages will go somewhere
|
||||
Form form = new Form(getFormAction(), Form.POST).setName("form").setEncType("");
|
||||
form.addElement(createContent(s));
|
||||
setContent(form);
|
||||
s.getRequest().getRequestURL();
|
||||
}
|
||||
|
||||
public String getFormAction() {
|
||||
return getLink();
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public String toString() {
|
||||
return getTitle();
|
||||
}
|
||||
|
||||
public String getDefaultLanguage() {
|
||||
return this.defaultLanguage;
|
||||
}
|
||||
|
||||
public String getLessonPlanFileName(String lang) {
|
||||
String ret = lessonPlanFileName.get(lang);
|
||||
if (ret == null) {
|
||||
ret = lessonPlanFileName.get(getDefaultLanguage());
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
public void setLessonPlanFileName(String lang, String lessonPlanFileName) {
|
||||
this.lessonPlanFileName.put(lang, lessonPlanFileName);
|
||||
this.availableLanguages.add(lang);
|
||||
}
|
||||
|
||||
public List<String> getAvailableLanguages() {
|
||||
return this.availableLanguages;
|
||||
}
|
||||
|
||||
public String getLessonSolutionFileName() {
|
||||
return lessonSolutionFileName;
|
||||
}
|
||||
|
||||
public void setLessonSolutionFileName(String lessonSolutionFileName) {
|
||||
this.lessonSolutionFileName = lessonSolutionFileName;
|
||||
}
|
||||
|
||||
public String getSourceFileName() {
|
||||
return sourceFileName;
|
||||
}
|
||||
|
||||
public void setSourceFileName(String sourceFileName) {
|
||||
logger.debug("Setting source file of lesson " + this + " to: " + sourceFileName);
|
||||
this.sourceFileName = sourceFileName;
|
||||
}
|
||||
|
||||
public WebgoatContext getWebgoatContext() {
|
||||
return webgoatContext;
|
||||
}
|
||||
|
||||
public void setWebgoatContext(WebgoatContext webgoatContext) {
|
||||
this.webgoatContext = webgoatContext;
|
||||
}
|
||||
|
||||
protected LabelManager getLabelManager() {
|
||||
if (labelManager == null) {
|
||||
labelManager = BeanProvider.getBean("labelManager", LabelManager.class);
|
||||
}
|
||||
return labelManager;
|
||||
}
|
||||
|
||||
/**
|
||||
* A reference from an image, script and link tag must include the context path.
|
||||
* <p>
|
||||
* A reference in include directives are made from within the web application on the server.
|
||||
* However, img tags (and the like) make references from the client browser.
|
||||
* In such external references, the context path must be included.
|
||||
*/
|
||||
protected final String buildImagePath(WebSession w, String imgResourceName) {
|
||||
return w.getRequest()
|
||||
.getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/images/" + imgResourceName;
|
||||
}
|
||||
|
||||
|
||||
protected final String buildJspPath(WebSession w, String jspResourceName, boolean includeContextPath) {
|
||||
String path = includeContextPath ? w.getContext().getContextPath() : "";
|
||||
return path + "/plugin_extracted/plugin/" + getLessonName() + "/jsp/" + jspResourceName;
|
||||
}
|
||||
|
||||
protected final String buildJsPath(WebSession w, String jsResourceName) {
|
||||
return w.getRequest()
|
||||
.getContextPath() + "/plugin_extracted/plugin/" + getLessonName() + "/js/" + jsResourceName;
|
||||
}
|
||||
|
||||
protected final File getLessonDirectory(WebSession w) {
|
||||
return new File(w.getContext().getRealPath("/plugin_extracted/plugin/" + getLessonName() + "/"));
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,166 @@
|
||||
package org.owasp.webgoat.lessons;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Iterator;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class Category implements Comparable {
|
||||
|
||||
public final static Category INTRODUCTION = new Category("Introduction", new Integer(5));
|
||||
|
||||
public final static Category GENERAL = new Category("General", new Integer(100));
|
||||
|
||||
public final static Category ACCESS_CONTROL = new Category("Access Control Flaws", new Integer(200));
|
||||
|
||||
public final static Category AJAX_SECURITY = new Category("AJAX Security", new Integer(400));
|
||||
|
||||
public final static Category AUTHENTICATION = new Category("Authentication Flaws", new Integer(500));
|
||||
|
||||
public final static Category BUFFER_OVERFLOW = new Category("Buffer Overflows", new Integer(600));
|
||||
|
||||
public final static Category CODE_QUALITY = new Category("Code Quality", new Integer(700));
|
||||
|
||||
public final static Category CONCURRENCY = new Category("Concurrency", new Integer(800));
|
||||
|
||||
public final static Category XSS = new Category("Cross-Site Scripting (XSS)", new Integer(900));
|
||||
|
||||
public final static Category ERROR_HANDLING = new Category("Improper Error Handling", new Integer(1000));
|
||||
|
||||
public final static Category INJECTION = new Category("Injection Flaws", new Integer(1100));
|
||||
|
||||
public final static Category DOS = new Category("Denial of Service", new Integer(1200));
|
||||
|
||||
public final static Category INSECURE_COMMUNICATION = new Category("Insecure Communication", new Integer(1300));
|
||||
|
||||
public final static Category INSECURE_CONFIGURATION = new Category("Insecure Configuration", new Integer(1400));
|
||||
|
||||
public final static Category INSECURE_STORAGE = new Category("Insecure Storage", new Integer(1500));
|
||||
|
||||
public final static Category MALICIOUS_EXECUTION = new Category("Malicious Execution", new Integer(1600));
|
||||
|
||||
public final static Category PARAMETER_TAMPERING = new Category("Parameter Tampering", new Integer(1700));
|
||||
|
||||
public final static Category SESSION_MANAGEMENT = new Category("Session Management Flaws", new Integer(1800));
|
||||
|
||||
public final static Category WEB_SERVICES = new Category("Web Services", new Integer(1900));
|
||||
|
||||
public final static Category ADMIN_FUNCTIONS = new Category("Admin Functions", new Integer(2000));
|
||||
|
||||
public final static Category CHALLENGE = new Category("Challenge", new Integer(3000));
|
||||
|
||||
private static final List<Category> categories = new ArrayList<Category>();
|
||||
|
||||
private String category;
|
||||
|
||||
private Integer ranking;
|
||||
|
||||
static {
|
||||
categories.add(INTRODUCTION);
|
||||
categories.add(PARAMETER_TAMPERING);
|
||||
categories.add(ACCESS_CONTROL);
|
||||
categories.add(AUTHENTICATION);
|
||||
categories.add(SESSION_MANAGEMENT);
|
||||
categories.add(XSS);
|
||||
categories.add(BUFFER_OVERFLOW);
|
||||
categories.add(INJECTION);
|
||||
categories.add(MALICIOUS_EXECUTION);
|
||||
categories.add(ERROR_HANDLING);
|
||||
categories.add(INSECURE_STORAGE);
|
||||
categories.add(DOS);
|
||||
categories.add(INSECURE_CONFIGURATION);
|
||||
categories.add(WEB_SERVICES);
|
||||
categories.add(AJAX_SECURITY);
|
||||
categories.add(ADMIN_FUNCTIONS);
|
||||
categories.add(GENERAL);
|
||||
categories.add(CODE_QUALITY);
|
||||
categories.add(CONCURRENCY);
|
||||
categories.add(INSECURE_COMMUNICATION);
|
||||
categories.add(CHALLENGE);
|
||||
}
|
||||
|
||||
public static synchronized void addCategory(Category c) {
|
||||
categories.add(c);
|
||||
}
|
||||
|
||||
public static synchronized Category getCategory(String name) {
|
||||
Iterator<Category> it = categories.iterator();
|
||||
while (it.hasNext()) {
|
||||
Category c = it.next();
|
||||
if (c.getName().equals(name)) {
|
||||
return c;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
public Category(String category, Integer ranking) {
|
||||
this.category = category;
|
||||
this.ranking = ranking;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int compareTo(Object obj) {
|
||||
int value = 1;
|
||||
|
||||
if (obj instanceof Category) {
|
||||
value = this.getRanking().compareTo(((Category) obj).getRanking());
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
public Integer getRanking() {
|
||||
return ranking;
|
||||
}
|
||||
|
||||
public Integer setRanking(Integer ranking) {
|
||||
return this.ranking = ranking;
|
||||
}
|
||||
|
||||
public String getName() {
|
||||
return category;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean equals(Object obj) {
|
||||
return (obj instanceof Category) && getName().equals(((Category) obj).getName());
|
||||
}
|
||||
|
||||
@Override
|
||||
public String toString() {
|
||||
return getName();
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,244 @@
|
||||
package org.owasp.webgoat.lessons;
|
||||
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.Center;
|
||||
import org.apache.ecs.html.H3;
|
||||
import org.apache.ecs.html.P;
|
||||
import org.apache.ecs.html.PRE;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.Table;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
import java.io.BufferedReader;
|
||||
import java.io.FileReader;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public abstract class LessonAdapter extends AbstractLesson {
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s) {
|
||||
// Mark this lesson as completed.
|
||||
makeSuccess(s);
|
||||
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
ec.addElement(new Center().addElement(new H3().addElement(new StringElement(
|
||||
"Detailed Lesson Creation Instructions."))));
|
||||
ec.addElement(new P());
|
||||
ec
|
||||
.addElement(new StringElement(
|
||||
"Lesson are simple to create and very little coding is required. "
|
||||
+ "In fact, most lessons can be created by following the easy to use instructions in the "
|
||||
+ "<A HREF=http://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents>WebGoat User Guide.</A> "
|
||||
+ "If you would prefer, send your lesson ideas to "
|
||||
+ getWebgoatContext().getFeedbackAddressHTML()));
|
||||
|
||||
String fileName = s.getContext().getRealPath("WEB-INF/classes/New Lesson Instructions.txt");
|
||||
if (fileName != null) {
|
||||
try {
|
||||
PRE pre = new PRE();
|
||||
BufferedReader in = new BufferedReader(new FileReader(fileName));
|
||||
String line = null;
|
||||
while ((line = in.readLine()) != null) {
|
||||
pre.addElement(line + "\n");
|
||||
}
|
||||
ec.addElement(pre);
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the LessonAdapter object. The default
|
||||
* category is "General" Only override this method if you wish to create a
|
||||
* new category or if you wish this lesson to reside within a category other
|
||||
* the "General"
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory() {
|
||||
return Category.GENERAL;
|
||||
}
|
||||
|
||||
protected boolean getDefaultHidden() {
|
||||
return false;
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(1000);
|
||||
|
||||
protected Integer getDefaultRanking() {
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the hintCount attribute of the LessonAdapter object
|
||||
*
|
||||
* @return The hintCount value
|
||||
*/
|
||||
public int getHintCount(WebSession s) {
|
||||
return getHints(s).size();
|
||||
}
|
||||
|
||||
/**
|
||||
* Fill in a minor hint that will help people who basically get it, but are
|
||||
* stuck on somthing silly. Hints will be returned to the user in the order
|
||||
* they appear below. The user must click on the "next hint" button before
|
||||
* the hint will be displayed.
|
||||
*
|
||||
* @return The hint1 value
|
||||
*/
|
||||
protected List<String> getHints(WebSession s) {
|
||||
List<String> hints = new ArrayList<String>();
|
||||
hints.add("There are no hints defined.");
|
||||
return hints;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the credits attribute of the AbstractLesson object
|
||||
*
|
||||
* @deprecated Credits are in the about page. This method s no
|
||||
* longer called from WebGoat
|
||||
* @return The credits value
|
||||
*/
|
||||
public Element getCredits() {
|
||||
return new StringElement();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the LessonAdapter object. Instructions
|
||||
* will rendered as html and will appear below the control area and above
|
||||
* the actual lesson area. Instructions should provide the user with the
|
||||
* general setup and goal of the lesson.
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public String getInstructions(WebSession s) {
|
||||
StringBuffer buff = new StringBuffer();
|
||||
String lang = s.getCurrrentLanguage();
|
||||
try {
|
||||
String fileName = getLessonPlanFileName(lang);
|
||||
if (fileName != null) {
|
||||
BufferedReader in = new BufferedReader(new FileReader(fileName));
|
||||
String line = null;
|
||||
boolean startAppending = false;
|
||||
while ((line = in.readLine()) != null) {
|
||||
if (line.indexOf("<!-- Start Instructions -->") != -1) {
|
||||
startAppending = true;
|
||||
continue;
|
||||
}
|
||||
if (line.indexOf("<!-- Stop Instructions -->") != -1) {
|
||||
startAppending = false;
|
||||
continue;
|
||||
}
|
||||
if (startAppending) {
|
||||
buff.append(line + "\n");
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
}
|
||||
|
||||
return buff.toString();
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Fill in a descriptive title for this lesson. The title of the lesson.
|
||||
* This will appear above the control area at the top of the page. This
|
||||
* field will be rendered as html.
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle() {
|
||||
return "Untitled Lesson " + getScreenId();
|
||||
}
|
||||
|
||||
public String getCurrentAction(WebSession s) {
|
||||
return s.getLessonSession(this).getCurrentLessonScreen();
|
||||
}
|
||||
|
||||
public void setCurrentAction(WebSession s, String lessonScreen) {
|
||||
s.getLessonSession(this).setCurrentLessonScreen(lessonScreen);
|
||||
}
|
||||
|
||||
public Object getSessionAttribute(WebSession s, String key) {
|
||||
return s.getRequest().getSession().getAttribute(key);
|
||||
}
|
||||
|
||||
public void setSessionAttribute(WebSession s, String key, Object value) {
|
||||
s.getRequest().getSession().setAttribute(key, value);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeSuccess(WebSession s) {
|
||||
getLessonTracker(s).setCompleted(true);
|
||||
|
||||
s.setMessage(getLabelManager().get("LessonCompleted"));
|
||||
|
||||
return (null);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the credits attribute of the AbstractLesson object
|
||||
*
|
||||
* @return The credits value
|
||||
*/
|
||||
protected Element getCustomCredits(String text, Element e) {
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(0).setBorder(0).setWidth("90%").setAlign("RIGHT");
|
||||
TR tr = new TR();
|
||||
tr.addElement(new TD(text).setVAlign("MIDDLE").setAlign("RIGHT").setWidth("100%"));
|
||||
tr.addElement(new TD(e).setVAlign("MIDDLE").setAlign("RIGHT"));
|
||||
t.addElement(tr);
|
||||
return t;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,99 @@
|
||||
|
||||
package org.owasp.webgoat.lessons;
|
||||
|
||||
import java.sql.Connection;
|
||||
import java.sql.SQLException;
|
||||
import org.owasp.webgoat.session.CreateDB;
|
||||
import org.owasp.webgoat.session.DatabaseUtilities;
|
||||
import org.owasp.webgoat.session.LessonTracker;
|
||||
import org.owasp.webgoat.session.RandomLessonTracker;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
public abstract class RandomLessonAdapter extends LessonAdapter
|
||||
{
|
||||
|
||||
public abstract String[] getStages();
|
||||
|
||||
public void setStage(WebSession s, String stage)
|
||||
{
|
||||
getLessonTracker(s).setStage(stage);
|
||||
try
|
||||
{
|
||||
Connection connection = DatabaseUtilities.getConnection(s);
|
||||
|
||||
CreateDB db = new CreateDB();
|
||||
db.makeDB(connection);
|
||||
System.out.println("Successfully refreshed the database.");
|
||||
|
||||
} catch (SQLException sqle)
|
||||
{
|
||||
System.out.println("Error refreshing the database!");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public String getStage(WebSession s)
|
||||
{
|
||||
return getLessonTracker(s).getStage();
|
||||
}
|
||||
|
||||
public void setStageComplete(WebSession s, String stage)
|
||||
{
|
||||
RandomLessonTracker lt = getLessonTracker(s);
|
||||
lt.setStageComplete(stage, true);
|
||||
if (lt.getCompleted())
|
||||
{
|
||||
s.setMessage("Congratulations, you have completed this lab");
|
||||
}
|
||||
else
|
||||
{
|
||||
s.setMessage("You have completed Stage " + (lt.getStageNumber(stage) + 1) + ": " + stage + ".");
|
||||
if (!stage.equals(lt.getStage()))
|
||||
s.setMessage(" Welcome to Stage " + (lt.getStageNumber(lt.getStage()) + 1) + ": " + lt.getStage());
|
||||
}
|
||||
try
|
||||
{
|
||||
Connection connection = DatabaseUtilities.getConnection(s);
|
||||
|
||||
CreateDB db = new CreateDB();
|
||||
db.makeDB(connection);
|
||||
System.out.println("Successfully refreshed the database.");
|
||||
|
||||
} catch (SQLException sqle)
|
||||
{
|
||||
System.out.println("Error refreshing the database!");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public boolean isStageComplete(WebSession s, String stage)
|
||||
{
|
||||
return getLessonTracker(s).hasCompleted(stage);
|
||||
}
|
||||
|
||||
@Override
|
||||
public RandomLessonTracker getLessonTracker(WebSession s)
|
||||
{
|
||||
return (RandomLessonTracker) super.getLessonTracker(s);
|
||||
}
|
||||
|
||||
@Override
|
||||
public RandomLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson)
|
||||
{
|
||||
return (RandomLessonTracker) super.getLessonTracker(s, lesson);
|
||||
}
|
||||
|
||||
@Override
|
||||
public RandomLessonTracker getLessonTracker(WebSession s, String userNameOverride)
|
||||
{
|
||||
return (RandomLessonTracker) super.getLessonTracker(s, userNameOverride);
|
||||
}
|
||||
|
||||
@Override
|
||||
public LessonTracker createLessonTracker()
|
||||
{
|
||||
return new RandomLessonTracker(getStages());
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,138 @@
|
||||
|
||||
package org.owasp.webgoat.lessons;
|
||||
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.owasp.webgoat.session.LessonTracker;
|
||||
import org.owasp.webgoat.session.SequentialLessonTracker;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
public abstract class SequentialLessonAdapter extends LessonAdapter
|
||||
{
|
||||
|
||||
public void setStage(WebSession s, int stage)
|
||||
{
|
||||
// System.out.println("Changed to stage " + stage);
|
||||
getLessonTracker(s).setStage(stage);
|
||||
}
|
||||
|
||||
/*
|
||||
* By default returns 1 stage. (non-Javadoc)
|
||||
*/
|
||||
public int getStageCount()
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
|
||||
public int getStage(WebSession s)
|
||||
{
|
||||
int stage = getLessonTracker(s).getStage();
|
||||
|
||||
// System.out.println("In stage " + stage);
|
||||
return stage;
|
||||
}
|
||||
|
||||
@Override
|
||||
public SequentialLessonTracker getLessonTracker(WebSession s)
|
||||
{
|
||||
return (SequentialLessonTracker) super.getLessonTracker(s);
|
||||
}
|
||||
|
||||
@Override
|
||||
public SequentialLessonTracker getLessonTracker(WebSession s, AbstractLesson lesson)
|
||||
{
|
||||
return (SequentialLessonTracker) super.getLessonTracker(s, lesson);
|
||||
}
|
||||
|
||||
@Override
|
||||
public SequentialLessonTracker getLessonTracker(WebSession s, String userNameOverride)
|
||||
{
|
||||
return (SequentialLessonTracker) super.getLessonTracker(s, userNameOverride);
|
||||
}
|
||||
|
||||
@Override
|
||||
public LessonTracker createLessonTracker()
|
||||
{
|
||||
return new SequentialLessonTracker();
|
||||
}
|
||||
|
||||
protected Element createStagedContent(WebSession s)
|
||||
{
|
||||
try
|
||||
{
|
||||
int stage = getLessonTracker(s).getStage();
|
||||
// int stage = Integer.parseInt(
|
||||
// getLessonTracker(s).getLessonProperties().getProperty(WebSession.STAGE,"1"));
|
||||
|
||||
switch (stage)
|
||||
{
|
||||
case 1:
|
||||
return (doStage1(s));
|
||||
case 2:
|
||||
return (doStage2(s));
|
||||
case 3:
|
||||
return (doStage3(s));
|
||||
case 4:
|
||||
return (doStage4(s));
|
||||
case 5:
|
||||
return (doStage5(s));
|
||||
case 6:
|
||||
return (doStage6(s));
|
||||
default:
|
||||
throw new Exception("Invalid stage");
|
||||
}
|
||||
} catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
// System.out.println(e);
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (new StringElement(""));
|
||||
}
|
||||
|
||||
protected Element doStage1(WebSession s) throws Exception
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement("Stage 1 Stub");
|
||||
return ec;
|
||||
}
|
||||
|
||||
protected Element doStage2(WebSession s) throws Exception
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement("Stage 2 Stub");
|
||||
return ec;
|
||||
}
|
||||
|
||||
protected Element doStage3(WebSession s) throws Exception
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement("Stage 3 Stub");
|
||||
return ec;
|
||||
}
|
||||
|
||||
protected Element doStage4(WebSession s) throws Exception
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement("Stage 4 Stub");
|
||||
return ec;
|
||||
}
|
||||
|
||||
protected Element doStage5(WebSession s) throws Exception
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement("Stage 5 Stub");
|
||||
return ec;
|
||||
}
|
||||
|
||||
protected Element doStage6(WebSession s) throws Exception
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement("Stage 6 Stub");
|
||||
return ec;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,145 @@
|
||||
|
||||
package org.owasp.webgoat.lessons;
|
||||
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.HtmlColor;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.Center;
|
||||
import org.apache.ecs.html.Form;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.Table;
|
||||
import org.owasp.webgoat.session.*;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class WelcomeScreen extends Screen
|
||||
{
|
||||
|
||||
/**
|
||||
* Constructor for the WelcomeScreen object
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public WelcomeScreen(WebSession s)
|
||||
{
|
||||
setup(s);
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructor for the WelcomeScreen object
|
||||
*/
|
||||
public WelcomeScreen()
|
||||
{
|
||||
}
|
||||
|
||||
public void setup(WebSession s)
|
||||
{
|
||||
// call createContent first so messages will go somewhere
|
||||
|
||||
Form form = new Form("attack", Form.POST).setName("form").setEncType("");
|
||||
|
||||
form.addElement(wrapForm(s));
|
||||
|
||||
TD lowerright = new TD().setHeight("100%").setVAlign("top").setAlign("left").addElement(form);
|
||||
TR row = new TR().addElement(lowerright);
|
||||
Table layout = new Table().setBgColor(HtmlColor.WHITE).setCellSpacing(0).setCellPadding(0).setBorder(0);
|
||||
|
||||
layout.addElement(row);
|
||||
|
||||
setContent(layout);
|
||||
}
|
||||
|
||||
protected Element wrapForm(WebSession s)
|
||||
{
|
||||
if (s == null) { return new StringElement("Invalid Session"); }
|
||||
|
||||
Table container = new Table().setWidth("100%").setCellSpacing(10).setCellPadding(0).setBorder(0);
|
||||
|
||||
// CreateContent can generate error messages so you MUST call it before makeMessages()
|
||||
Element content = createContent(s);
|
||||
container.addElement(new TR().addElement(new TD().setColSpan(2).setVAlign("TOP").addElement(makeMessages(s))));
|
||||
container.addElement(new TR().addElement(new TD().setColSpan(2).addElement(content)));
|
||||
container.addElement(new TR());
|
||||
|
||||
return (container);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
Element b = ECSFactory.makeButton("Start the Course!");
|
||||
ec.addElement(new Center(b));
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the WelcomeScreen object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
protected String getInstructions()
|
||||
{
|
||||
String instructions = "Enter your name and learn how HTTP really works!";
|
||||
|
||||
return (instructions);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the WelcomeScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Welcome to the Penetration Testing Course");
|
||||
}
|
||||
|
||||
/*
|
||||
* (non-Javadoc)
|
||||
* @see session.Screen#getRole()
|
||||
*/
|
||||
public String getRole()
|
||||
{
|
||||
return AbstractLesson.USER_ROLE;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,104 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.session.Screen;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public abstract class AdminScreen extends Screen
|
||||
{
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
protected String query = null;
|
||||
|
||||
/**
|
||||
* Constructor for the AdminScreen object
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @param q
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public AdminScreen(WebSession s, String q)
|
||||
{
|
||||
setQuery(q);
|
||||
|
||||
// setupAdmin(s); FIXME: what was this supposed to do?
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructor for the AdminScreen object
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public AdminScreen(WebSession s)
|
||||
{
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructor for the AdminScreen object
|
||||
*/
|
||||
public AdminScreen()
|
||||
{
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the AdminScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Admin Information");
|
||||
}
|
||||
|
||||
public String getRole()
|
||||
{
|
||||
return AbstractLesson.ADMIN_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the query attribute of the AdminScreen object
|
||||
*
|
||||
* @param q
|
||||
* The new query value
|
||||
*/
|
||||
public void setQuery(String q)
|
||||
{
|
||||
query = q;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,121 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import java.sql.Connection;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.ResultSetMetaData;
|
||||
import java.sql.Statement;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.owasp.webgoat.lessons.Category;
|
||||
import org.owasp.webgoat.lessons.LessonAdapter;
|
||||
import org.owasp.webgoat.session.DatabaseUtilities;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class ProductsAdminScreen extends LessonAdapter
|
||||
{
|
||||
|
||||
private final static String QUERY = "SELECT * FROM product_system_data";
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try
|
||||
{
|
||||
Connection connection = DatabaseUtilities.getConnection(s);
|
||||
|
||||
Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet results = statement.executeQuery(QUERY);
|
||||
|
||||
if (results != null)
|
||||
{
|
||||
makeSuccess(s);
|
||||
ResultSetMetaData resultsMetaData = results.getMetaData();
|
||||
ec.addElement(DatabaseUtilities.writeTable(results, resultsMetaData));
|
||||
}
|
||||
} catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the ProductsAdminScreen object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.ADMIN_FUNCTIONS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the role attribute of the ProductsAdminScreen object
|
||||
*
|
||||
* @return The role value
|
||||
*/
|
||||
public String getRole()
|
||||
{
|
||||
return HACKED_ADMIN_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the ProductsAdminScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Product Information");
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(1000);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,157 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import java.sql.Connection;
|
||||
import org.owasp.webgoat.lessons.*;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.A;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.Table;
|
||||
import org.owasp.webgoat.session.*;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class RefreshDBScreen extends LessonAdapter
|
||||
{
|
||||
|
||||
private final static String REFRESH = "Refresh";
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try
|
||||
{
|
||||
boolean refresh = s.getParser().getBooleanParameter(REFRESH, false);
|
||||
|
||||
if (refresh)
|
||||
{
|
||||
refreshDB(s);
|
||||
ec.addElement(new StringElement("Successfully refreshed the database."));
|
||||
}
|
||||
else
|
||||
{
|
||||
Element label = new StringElement("Refresh the database? ");
|
||||
A link1 = ECSFactory.makeLink("Yes", REFRESH, true);
|
||||
A link2 = ECSFactory.makeLink("No", REFRESH, false);
|
||||
TD td1 = new TD().addElement(label);
|
||||
TD td2 = new TD().addElement(link1);
|
||||
TD td3 = new TD().addElement(link2);
|
||||
TR row = new TR().addElement(td1).addElement(td2).addElement(td3);
|
||||
Table t = new Table().setCellSpacing(40).setWidth("50%");
|
||||
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
|
||||
t.addElement(row);
|
||||
ec.addElement(t);
|
||||
}
|
||||
} catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the RefreshDBScreen object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.ADMIN_FUNCTIONS;
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(1000);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the role attribute of the RefreshDBScreen object
|
||||
*
|
||||
* @return The role value
|
||||
*/
|
||||
public String getRole()
|
||||
{
|
||||
return ADMIN_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the RefreshDBScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Refresh Database");
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public void refreshDB(WebSession s)
|
||||
{
|
||||
try
|
||||
{
|
||||
Connection connection = DatabaseUtilities.getConnection(s);
|
||||
|
||||
CreateDB db = new CreateDB();
|
||||
db.makeDB(connection);
|
||||
System.out.println("Successfully refreshed the database.");
|
||||
} catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error refreshing database " + this.getClass().getName());
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,294 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import java.util.Iterator;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.HtmlColor;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.Center;
|
||||
import org.apache.ecs.html.H2;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TH;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.Table;
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.Category;
|
||||
import org.owasp.webgoat.lessons.LessonAdapter;
|
||||
import org.owasp.webgoat.session.LessonTracker;
|
||||
import org.owasp.webgoat.session.Screen;
|
||||
import org.owasp.webgoat.session.UserTracker;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class ReportCardScreen extends LessonAdapter
|
||||
{
|
||||
|
||||
/**
|
||||
* Description of the Field
|
||||
*/
|
||||
protected final static String USERNAME = "Username";
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
String user = null;
|
||||
|
||||
try
|
||||
{
|
||||
if (s.getRequest().isUserInRole(WebSession.WEBGOAT_ADMIN))
|
||||
{
|
||||
user = s.getParser().getRawParameter(USERNAME);
|
||||
}
|
||||
else
|
||||
{
|
||||
user = s.getUserName();
|
||||
}
|
||||
} catch (Exception e)
|
||||
{
|
||||
}
|
||||
|
||||
if (user == null)
|
||||
{
|
||||
user = s.getUserName();
|
||||
}
|
||||
|
||||
ec.addElement(makeFeedback(s));
|
||||
ec.addElement(makeReportCard(s, user));
|
||||
|
||||
return ec;
|
||||
}
|
||||
|
||||
private Element makeFeedback(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
ec.addElement(new StringElement("Comments and suggestions are welcome. "
|
||||
+ getWebgoatContext().getFeedbackAddressHTML() + "<br><br>"));
|
||||
|
||||
return ec;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.ADMIN_FUNCTIONS;
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(1000);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the role attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The role value
|
||||
*/
|
||||
public String getRole()
|
||||
{
|
||||
return USER_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Report Card");
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param screen
|
||||
* Description of the Parameter
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @param user
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
private TR makeLessonRow(WebSession s, String user, Screen screen)
|
||||
{
|
||||
LessonTracker lessonTracker = UserTracker.instance().getLessonTracker(s, user, screen);
|
||||
TR tr = new TR();
|
||||
if (lessonTracker.getCompleted())
|
||||
{
|
||||
tr.setBgColor(HtmlColor.LIGHTGREEN);
|
||||
}
|
||||
else if (lessonTracker.getNumVisits() == 0)
|
||||
{
|
||||
tr.setBgColor(HtmlColor.LIGHTBLUE);
|
||||
}
|
||||
else if (!lessonTracker.getCompleted() && lessonTracker.getNumVisits() > 10)
|
||||
{
|
||||
tr.setBgColor(HtmlColor.RED);
|
||||
}
|
||||
else
|
||||
{
|
||||
tr.setBgColor(HtmlColor.YELLOW);
|
||||
}
|
||||
tr.addElement(new TD().addElement(screen.getTitle()));
|
||||
tr.addElement(new TD().setAlign("CENTER").addElement(lessonTracker.getCompleted() ? "Y" : "N"));
|
||||
tr.addElement(new TD().setAlign("CENTER").addElement(Integer.toString(lessonTracker.getNumVisits())));
|
||||
tr.addElement(new TD().setAlign("CENTER").addElement(Integer.toString(lessonTracker.getMaxHintLevel())));
|
||||
return tr;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeMessages(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @param user
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
public Element makeReportCard(WebSession s, String user)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
ec.addElement(makeUser(s, user));
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(1);
|
||||
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
TR tr = new TR();
|
||||
t.addElement(makeUserHeaderRow());
|
||||
|
||||
// These are all the user lesson
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().setAlign("CENTER").setColSpan(9).addElement("Normal user lessons"));
|
||||
t.addElement(tr);
|
||||
for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.USER_ROLE).iterator(); lessonIter
|
||||
.hasNext();)
|
||||
{
|
||||
Screen screen = (Screen) lessonIter.next();
|
||||
t.addElement(makeLessonRow(s, user, screen));
|
||||
}
|
||||
|
||||
// The user figured out there was a hackable admin acocunt
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().setAlign("CENTER").setColSpan(9).addElement("Hackable Admin Screens"));
|
||||
t.addElement(tr);
|
||||
for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.HACKED_ADMIN_ROLE).iterator(); lessonIter
|
||||
.hasNext();)
|
||||
{
|
||||
Screen screen = (Screen) lessonIter.next();
|
||||
t.addElement(makeLessonRow(s, user, screen));
|
||||
}
|
||||
|
||||
// The user figured out how to actually hack the admin acocunt
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().setAlign("CENTER").setColSpan(9).addElement("Actual Admin Screens"));
|
||||
t.addElement(tr);
|
||||
for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.ADMIN_ROLE).iterator(); lessonIter
|
||||
.hasNext();)
|
||||
{
|
||||
Screen screen = (Screen) lessonIter.next();
|
||||
t.addElement(makeLessonRow(s, user, screen));
|
||||
}
|
||||
|
||||
ec.addElement(t);
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @param user
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeUser(WebSession s, String user)
|
||||
{
|
||||
H2 h2 = new H2();
|
||||
// FIXME: The session is the current session, not the session of the user we are reporting.
|
||||
// String type = s.isAdmin() ? " [Administrative User]" : s.isHackedAdmin() ?
|
||||
// " [Normal User - Hacked Admin Access]" : " [Normal User]";
|
||||
String type = "";
|
||||
h2.addElement(new StringElement("Results for: " + user + type));
|
||||
return h2;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
private TR makeUserHeaderRow()
|
||||
{
|
||||
TR tr = new TR();
|
||||
|
||||
tr.addElement(new TH("Lesson"));
|
||||
tr.addElement(new TH("Complete"));
|
||||
tr.addElement(new TH("Visits"));
|
||||
tr.addElement(new TH("Hints"));
|
||||
|
||||
return tr;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,314 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import java.util.Enumeration;
|
||||
import java.util.Iterator;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.HtmlColor;
|
||||
import org.apache.ecs.html.Center;
|
||||
import org.apache.ecs.html.Input;
|
||||
import org.apache.ecs.html.P;
|
||||
import org.apache.ecs.html.TD;
|
||||
import org.apache.ecs.html.TH;
|
||||
import org.apache.ecs.html.TR;
|
||||
import org.apache.ecs.html.Table;
|
||||
import org.owasp.webgoat.lessons.AbstractLesson;
|
||||
import org.owasp.webgoat.lessons.Category;
|
||||
import org.owasp.webgoat.lessons.LessonAdapter;
|
||||
import org.owasp.webgoat.session.LessonTracker;
|
||||
import org.owasp.webgoat.session.Screen;
|
||||
import org.owasp.webgoat.session.UserTracker;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Bruce mayhew <a href="http://code.google.com">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class SummaryReportCardScreen extends LessonAdapter
|
||||
{
|
||||
|
||||
private int totalUsersNormalComplete = 0;
|
||||
|
||||
private int totalUsersAdminComplete = 0;
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
String selectedUser = null;
|
||||
|
||||
try
|
||||
{
|
||||
if (s.getRequest().isUserInRole(WebSession.WEBGOAT_ADMIN))
|
||||
{
|
||||
Enumeration e = s.getParser().getParameterNames();
|
||||
|
||||
while (e.hasMoreElements())
|
||||
{
|
||||
String key = (String) e.nextElement();
|
||||
if (key.startsWith("View_"))
|
||||
{
|
||||
selectedUser = key.substring("View_".length());
|
||||
ReportCardScreen reportCard = new ReportCardScreen();
|
||||
return reportCard.makeReportCard(s, selectedUser);
|
||||
}
|
||||
if (key.startsWith("Delete_"))
|
||||
{
|
||||
selectedUser = key.substring("Delete_".length());
|
||||
deleteUser(selectedUser);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e)
|
||||
{
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
ec.addElement(new Center().addElement(makeSummary(s)));
|
||||
|
||||
ec.addElement(new P());
|
||||
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(4).setBorder(1).setWidth("100%");
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
t.addElement(makeUserSummaryHeader());
|
||||
|
||||
for (Iterator<String> userIter = UserTracker.instance().getAllUsers(WebSession.WEBGOAT_USER).iterator(); userIter
|
||||
.hasNext();)
|
||||
{
|
||||
|
||||
String user = userIter.next();
|
||||
t.addElement(makeUserSummaryRow(s, user));
|
||||
}
|
||||
|
||||
ec.addElement(new Center().addElement(t));
|
||||
|
||||
return ec;
|
||||
}
|
||||
|
||||
protected Element makeSummary(WebSession s)
|
||||
{
|
||||
Table t = new Table().setCellSpacing(0).setCellPadding(2).setBorder(0).setWidth("100%");
|
||||
if (s.isColor())
|
||||
{
|
||||
t.setBorder(1);
|
||||
}
|
||||
TR tr = new TR();
|
||||
// tr.addElement( new TH().addElement( "Summary").setColSpan(1));
|
||||
// t.addElement( tr );
|
||||
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().setWidth("60%").addElement("Total number of users"));
|
||||
tr.addElement(new TD().setAlign("LEFT").addElement(
|
||||
Integer.toString(UserTracker.instance()
|
||||
.getAllUsers(WebSession.WEBGOAT_USER).size())));
|
||||
t.addElement(tr);
|
||||
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().setWidth("60%").addElement("Total number of users that completed all normal lessons"));
|
||||
tr.addElement(new TD().setAlign("LEFT").addElement(Integer.toString(totalUsersNormalComplete)));
|
||||
t.addElement(tr);
|
||||
|
||||
tr = new TR();
|
||||
tr.addElement(new TD().setWidth("60%").addElement("Total number of users that completed all admin lessons"));
|
||||
tr.addElement(new TD().setAlign("LEFT").addElement(Integer.toString(totalUsersAdminComplete)));
|
||||
t.addElement(tr);
|
||||
return t;
|
||||
}
|
||||
|
||||
private void deleteUser(String user)
|
||||
{
|
||||
UserTracker.instance().deleteUser(user);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.ADMIN_FUNCTIONS;
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(1000);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the role attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The role value
|
||||
*/
|
||||
public String getRole()
|
||||
{
|
||||
return ADMIN_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Summary Report Card");
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeMessages(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeUserSummaryHeader()
|
||||
{
|
||||
TR tr = new TR();
|
||||
|
||||
tr.addElement(new TH("User Name"));
|
||||
tr.addElement(new TH("Normal Complete"));
|
||||
tr.addElement(new TH("Admin Complete"));
|
||||
tr.addElement(new TH("View"));
|
||||
tr.addElement(new TH("Delete"));
|
||||
|
||||
return tr;
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @param user
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element makeUserSummaryRow(WebSession s, String user)
|
||||
{
|
||||
TR tr = new TR();
|
||||
|
||||
tr.addElement(new TD().setAlign("LEFT").addElement(user));
|
||||
int lessonCount = 0;
|
||||
int passedCount = 0;
|
||||
boolean normalComplete = false;
|
||||
boolean adminComplete = false;
|
||||
|
||||
for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.USER_ROLE).iterator(); lessonIter
|
||||
.hasNext();)
|
||||
{
|
||||
lessonCount++;
|
||||
Screen screen = (Screen) lessonIter.next();
|
||||
|
||||
LessonTracker lessonTracker = UserTracker.instance().getLessonTracker(s, user, screen);
|
||||
if (lessonTracker.getCompleted())
|
||||
{
|
||||
passedCount++;
|
||||
}
|
||||
}
|
||||
if (lessonCount == passedCount)
|
||||
{
|
||||
normalComplete = true;
|
||||
totalUsersNormalComplete++;
|
||||
}
|
||||
String text = Integer.toString(passedCount) + " of " + Integer.toString(lessonCount);
|
||||
tr.addElement(new TD().setAlign("CENTER").addElement(text));
|
||||
|
||||
lessonCount = 0;
|
||||
passedCount = 0;
|
||||
for (Iterator lessonIter = s.getCourse().getLessons(s, AbstractLesson.HACKED_ADMIN_ROLE).iterator(); lessonIter
|
||||
.hasNext();)
|
||||
{
|
||||
lessonCount++;
|
||||
Screen screen = (Screen) lessonIter.next();
|
||||
|
||||
LessonTracker lessonTracker = UserTracker.instance().getLessonTracker(s, user, screen);
|
||||
if (lessonTracker.getCompleted())
|
||||
{
|
||||
passedCount++;
|
||||
}
|
||||
}
|
||||
if (lessonCount == passedCount)
|
||||
{
|
||||
adminComplete = true;
|
||||
totalUsersAdminComplete++;
|
||||
}
|
||||
text = Integer.toString(passedCount) + " of " + Integer.toString(lessonCount);
|
||||
tr.addElement(new TD().setAlign("CENTER").addElement(text));
|
||||
|
||||
tr.addElement(new TD().setAlign("CENTER").addElement(new Input(Input.SUBMIT, "View_" + user, "View")));
|
||||
tr.addElement(new TD().setAlign("CENTER").addElement(new Input(Input.SUBMIT, "Delete_" + user, "Delete")));
|
||||
|
||||
if (normalComplete && adminComplete)
|
||||
{
|
||||
tr.setBgColor(HtmlColor.GREEN);
|
||||
}
|
||||
else if (normalComplete)
|
||||
{
|
||||
tr.setBgColor(HtmlColor.LIGHTGREEN);
|
||||
}
|
||||
else
|
||||
{
|
||||
tr.setBgColor(HtmlColor.LIGHTBLUE);
|
||||
}
|
||||
|
||||
return (tr);
|
||||
}
|
||||
|
||||
public boolean isEnterprise()
|
||||
{
|
||||
return true;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,121 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import java.sql.Connection;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.ResultSetMetaData;
|
||||
import java.sql.Statement;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.owasp.webgoat.lessons.Category;
|
||||
import org.owasp.webgoat.lessons.LessonAdapter;
|
||||
import org.owasp.webgoat.session.DatabaseUtilities;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Bruce Mayhew <a href="http://code.google.com/p/webgoat">WebGoat</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class UserAdminScreen extends LessonAdapter
|
||||
{
|
||||
|
||||
private final static String QUERY = "SELECT * FROM user_system_data";
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try
|
||||
{
|
||||
Connection connection = DatabaseUtilities.getConnection(s);
|
||||
|
||||
Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet results = statement.executeQuery(QUERY);
|
||||
|
||||
if (results != null)
|
||||
{
|
||||
makeSuccess(s);
|
||||
ResultSetMetaData resultsMetaData = results.getMetaData();
|
||||
ec.addElement(DatabaseUtilities.writeTable(results, resultsMetaData));
|
||||
}
|
||||
} catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.ADMIN_FUNCTIONS;
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(1000);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the role attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The role value
|
||||
*/
|
||||
public String getRole()
|
||||
{
|
||||
return HACKED_ADMIN_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the UserAdminScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("User Information");
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,162 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import java.sql.Connection;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.ResultSetMetaData;
|
||||
import java.sql.Statement;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import org.owasp.webgoat.lessons.*;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.StringElement;
|
||||
import org.apache.ecs.html.Input;
|
||||
import org.owasp.webgoat.session.*;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class ViewDatabase extends LessonAdapter
|
||||
{
|
||||
|
||||
private final static String SQL = "sql";
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
try
|
||||
{
|
||||
ec.addElement(new StringElement("Enter a SQL statement: "));
|
||||
|
||||
StringBuffer sqlStatement = new StringBuffer(s.getParser().getRawParameter(SQL, ""));
|
||||
Input input = new Input(Input.TEXT, SQL, sqlStatement.toString());
|
||||
ec.addElement(input);
|
||||
|
||||
Element b = ECSFactory.makeButton("Go!");
|
||||
ec.addElement(b);
|
||||
|
||||
Connection connection = DatabaseUtilities.getConnection(s);
|
||||
|
||||
if (sqlStatement.length() > 0)
|
||||
{
|
||||
|
||||
Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet results = statement.executeQuery(sqlStatement.toString());
|
||||
|
||||
if ((results != null) && (results.first() == true))
|
||||
{
|
||||
makeSuccess(s);
|
||||
ResultSetMetaData resultsMetaData = results.getMetaData();
|
||||
ec.addElement(DatabaseUtilities.writeTable(results, resultsMetaData));
|
||||
}
|
||||
|
||||
}
|
||||
} catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error generating " + this.getClass().getName());
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the category attribute of the DatabaseScreen object
|
||||
*
|
||||
* @return The category value
|
||||
*/
|
||||
protected Category getDefaultCategory()
|
||||
{
|
||||
return Category.ADMIN_FUNCTIONS;
|
||||
}
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(1000);
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the hints attribute of the DatabaseScreen object
|
||||
*
|
||||
* @return The hints value
|
||||
*/
|
||||
protected List<String> getHints(WebSession s)
|
||||
{
|
||||
List<String> hints = new ArrayList<String>();
|
||||
hints.add("There are no hints defined");
|
||||
|
||||
return hints;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the instructions attribute of the ViewDatabase object
|
||||
*
|
||||
* @return The instructions value
|
||||
*/
|
||||
public String getInstructions(WebSession s)
|
||||
{
|
||||
String instructions = "Please post a message to to the WebGoat forum. Your messages will be available for everyone to read.";
|
||||
|
||||
return (instructions);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the role attribute of the ViewDatabase object
|
||||
*
|
||||
* @return The role value
|
||||
*/
|
||||
public String getRole()
|
||||
{
|
||||
return HACKED_ADMIN_ROLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the DatabaseScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Adhoc Query");
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,89 @@
|
||||
|
||||
package org.owasp.webgoat.lessons.admin;
|
||||
|
||||
import org.owasp.webgoat.lessons.WelcomeScreen;
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.html.Center;
|
||||
import org.apache.ecs.html.H1;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*
|
||||
* @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
|
||||
* @created October 28, 2003
|
||||
*/
|
||||
public class WelcomeAdminScreen extends WelcomeScreen
|
||||
{
|
||||
|
||||
/**
|
||||
* Constructor for the WelcomeAdminScreen object
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
*/
|
||||
public WelcomeAdminScreen(WebSession s)
|
||||
{
|
||||
super(s);
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructor for the WelcomeAdminScreen object
|
||||
*/
|
||||
public WelcomeAdminScreen()
|
||||
{
|
||||
}
|
||||
|
||||
/**
|
||||
* Description of the Method
|
||||
*
|
||||
* @param s
|
||||
* Description of the Parameter
|
||||
* @return Description of the Return Value
|
||||
*/
|
||||
protected Element createContent(WebSession s)
|
||||
{
|
||||
ElementContainer ec = new ElementContainer();
|
||||
|
||||
ec.addElement(new Center(new H1("You are logged on as an administrator")));
|
||||
ec.addElement(super.createContent(s));
|
||||
|
||||
return (ec);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the title attribute of the WelcomeAdminScreen object
|
||||
*
|
||||
* @return The title value
|
||||
*/
|
||||
public String getTitle()
|
||||
{
|
||||
return ("Admin Welcome");
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,82 @@
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*/
|
||||
package org.owasp.webgoat.lessons.model;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author rlawson
|
||||
*/
|
||||
public class Hint {
|
||||
|
||||
private String hint;
|
||||
private String lesson;
|
||||
private int number;
|
||||
|
||||
/**
|
||||
* @return the hint
|
||||
*/
|
||||
public String getHint() {
|
||||
return hint;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param hint the hint to set
|
||||
*/
|
||||
public void setHint(String hint) {
|
||||
this.hint = hint;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the lesson
|
||||
*/
|
||||
public String getLesson() {
|
||||
return lesson;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param lesson the lesson to set
|
||||
*/
|
||||
public void setLesson(String lesson) {
|
||||
this.lesson = lesson;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the number
|
||||
*/
|
||||
public int getNumber() {
|
||||
return number;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param number the number to set
|
||||
*/
|
||||
public void setNumber(int number) {
|
||||
this.number = number;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,48 @@
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*/
|
||||
package org.owasp.webgoat.lessons.model;
|
||||
|
||||
/**
|
||||
* Model component for the Http Basics lesson. Using a model
|
||||
* for that simple lesson is architectural overkill. We do it anyway
|
||||
* for illustrative purposes - to demonstrate the pattern that we will
|
||||
* use for more complex lessons.
|
||||
*
|
||||
*/
|
||||
public class HttpBasicsModel {
|
||||
|
||||
private String personName;
|
||||
|
||||
public String getPersonName() {
|
||||
return personName;
|
||||
}
|
||||
|
||||
public void setPersonName(String personName) {
|
||||
this.personName = personName;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,160 @@
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at
|
||||
* https://github.com/WebGoat/WebGoat, a repository for free software projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*/
|
||||
package org.owasp.webgoat.lessons.model;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author rlawson
|
||||
*/
|
||||
public class LessonMenuItem {
|
||||
|
||||
private String name;
|
||||
private LessonMenuItemType type;
|
||||
private List<LessonMenuItem> children = new ArrayList<LessonMenuItem>();
|
||||
private boolean complete;
|
||||
private String link;
|
||||
private boolean showSource = true;
|
||||
private boolean showHints = true;
|
||||
|
||||
/**
|
||||
* @return the name
|
||||
*/
|
||||
public String getName() {
|
||||
return name;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param name the name to set
|
||||
*/
|
||||
public void setName(String name) {
|
||||
this.name = name;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the children
|
||||
*/
|
||||
public List<LessonMenuItem> getChildren() {
|
||||
return children;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param children the children to set
|
||||
*/
|
||||
public void setChildren(List<LessonMenuItem> children) {
|
||||
this.children = children;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the type
|
||||
*/
|
||||
public LessonMenuItemType getType() {
|
||||
return type;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param type the type to set
|
||||
*/
|
||||
public void setType(LessonMenuItemType type) {
|
||||
this.type = type;
|
||||
}
|
||||
|
||||
public void addChild(LessonMenuItem child) {
|
||||
children.add(child);
|
||||
}
|
||||
|
||||
@Override
|
||||
public String toString() {
|
||||
StringBuilder bldr = new StringBuilder();
|
||||
bldr.append("Name: ").append(name).append(" | ");
|
||||
bldr.append("Type: ").append(type).append(" | ");
|
||||
return bldr.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the complete
|
||||
*/
|
||||
public boolean isComplete() {
|
||||
return complete;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param complete the complete to set
|
||||
*/
|
||||
public void setComplete(boolean complete) {
|
||||
this.complete = complete;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the link
|
||||
*/
|
||||
public String getLink() {
|
||||
return link;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param link the link to set
|
||||
*/
|
||||
public void setLink(String link) {
|
||||
this.link = link;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the showSource
|
||||
*/
|
||||
public boolean isShowSource() {
|
||||
return showSource;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param showSource the showSource to set
|
||||
*/
|
||||
public void setShowSource(boolean showSource) {
|
||||
this.showSource = showSource;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the showHints
|
||||
*/
|
||||
public boolean isShowHints() {
|
||||
return showHints;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param showHints the showHints to set
|
||||
*/
|
||||
public void setShowHints(boolean showHints) {
|
||||
this.showHints = showHints;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,39 @@
|
||||
/***************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
|
||||
* please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under the terms of the
|
||||
* GNU General Public License as published by the Free Software Foundation; either version 2 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
|
||||
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with this program; if
|
||||
* not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
|
||||
* 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
|
||||
* projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.lessons.model;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author rlawson
|
||||
*/
|
||||
public enum LessonMenuItemType {
|
||||
CATEGORY,
|
||||
LESSON,
|
||||
STAGE
|
||||
}
|
||||
@ -0,0 +1,66 @@
|
||||
/**
|
||||
* *************************************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 20014 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://webgoat.github.io
|
||||
*/
|
||||
package org.owasp.webgoat.lessons.model;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author rlawson
|
||||
*/
|
||||
public class RequestParameter implements Comparable<RequestParameter> {
|
||||
|
||||
private final String name;
|
||||
private final String value;
|
||||
|
||||
public RequestParameter(String name, String value) {
|
||||
this.name = name;
|
||||
this.value = value;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the name
|
||||
*/
|
||||
public String getName() {
|
||||
return name;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return the values
|
||||
*/
|
||||
public String getValue() {
|
||||
return value;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int compareTo(RequestParameter o) {
|
||||
return this.name.compareTo(o.getName());
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,31 @@
|
||||
/*
|
||||
* To change this license header, choose License Headers in Project Properties.
|
||||
* To change this template file, choose Tools | Templates
|
||||
* and open the template in the editor.
|
||||
*/
|
||||
|
||||
package org.owasp.webgoat.lessons.model;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author rlawson
|
||||
*/
|
||||
public class SourceListing {
|
||||
|
||||
private String source;
|
||||
|
||||
/**
|
||||
* @return the source
|
||||
*/
|
||||
public String getSource() {
|
||||
return source;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param source the source to set
|
||||
*/
|
||||
public void setSource(String source) {
|
||||
this.source = source;
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user